{"action":"created","issue":{"url":"https://api.github.com/repos/puppetlabs/puppetlabs-postgresql/issues/530","labels_url":"https://api.github.com/repos/puppetlabs/puppetlabs-postgresql/issues/530/labels{/name}","comments_url":"https://api.github.com/repos/puppetlabs/puppetlabs-postgresql/issues/530/comments","events_url":"https://api.github.com/repos/puppetlabs/puppetlabs-postgresql/issues/530/events","html_url":"https://github.com/puppetlabs/puppetlabs-postgresql/pull/530","id":48802163,"number":530,"title":"Using enviromental varables to hide actual password in psql commands","user":{"login":"cardil","id":540893,"avatar_url":"https://avatars.githubusercontent.com/u/540893?v=3","gravatar_id":"","url":"https://api.github.com/users/cardil","html_url":"https://github.com/cardil","followers_url":"https://api.github.com/users/cardil/followers","following_url":"https://api.github.com/users/cardil/following{/other_user}","gists_url":"https://api.github.com/users/cardil/gists{/gist_id}","starred_url":"https://api.github.com/users/cardil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cardil/subscriptions","organizations_url":"https://api.github.com/users/cardil/orgs","repos_url":"https://api.github.com/users/cardil/repos","events_url":"https://api.github.com/users/cardil/events{/privacy}","received_events_url":"https://api.github.com/users/cardil/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2014-11-14T15:32:15Z","updated_at":"2015-03-13T06:23:54Z","closed_at":"2015-03-12T18:00:24Z","pull_request":{"url":"https://api.github.com/repos/puppetlabs/puppetlabs-postgresql/pulls/530","html_url":"https://github.com/puppetlabs/puppetlabs-postgresql/pull/530","diff_url":"https://github.com/puppetlabs/puppetlabs-postgresql/pull/530.diff","patch_url":"https://github.com/puppetlabs/puppetlabs-postgresql/pull/530.patch"},"body":"### Motivation\r\n\r\nExecuting commands by Puppet is crucial, because the most concerns production environments. I wanted to avoid displaing password, even in the form of \"encrypted\" in the logs and reports. These reports are usually stored for a long time, making it possible vector of attack.\r\n\r\n### Design\r\n\r\nI decided to design it in such a way as to take advantage of the fact that the environment variables are not displayed by the `Puppet::Util::Execution` - even in debug mode. It displays actual command, in this case: \r\n```shell\r\n/usr/bin/psql -d base -t -c \"SELECT 'something' as \\\"Custom column\\\"\"\r\n```\r\n\r\n### Development\r\n\r\n1. Edited `postgresql_psql` ruby provider, `postgres::server::role` and `postgresql::server::passwd` class\r\n 1. to use environment variables to store actual passwords\r\n 1. to properly escape `\"` sign when passing command to `psql` executable\r\n1. Writen a spec test for `postgresql::server::passwd` and `postgres::server::role`\r\n1. Corrected spec test to `postgresql_psql` ruby provider\r\n\r\n### Testing\r\n\r\nI've tested those changes by running spec tests on:\r\n\r\n* rvm: 1.8.7, env: PUPPET_GEM_VERSION=\"~> 2.7.0\" FACTER_GEM_VERSION=\"~> 1.6.0\"\r\n* rvm: 1.9.3, env: PUPPET_GEM_VERSION=\"~> 3.5\" STRICT_VARIABLES=\"yes\"\r\n\r\nI've also tested those changes against a vagrant machine `wavesoftware/trusty64-nocm` using both of settings from `.travis.yaml` with:\r\n\r\n```shell\r\ntail -f /var/log/syslog | grep postgres &\r\npuppet apply test.pp --debug\r\n```\r\na test.pp contents are:\r\n\r\n```puppet\r\ninclude postgresql::server\r\npostgresql::server::db { 'mydatabasename':\r\n  user     => 'mydatabaseuser',\r\n  password => postgresql_password('mydatabaseuser', 'mypassword'),\r\n}\r\n```"},"comment":{"url":"https://api.github.com/repos/puppetlabs/puppetlabs-postgresql/issues/comments/78828100","html_url":"https://github.com/puppetlabs/puppetlabs-postgresql/pull/530#issuecomment-78828100","issue_url":"https://api.github.com/repos/puppetlabs/puppetlabs-postgresql/issues/530","id":78828100,"user":{"login":"cardil","id":540893,"avatar_url":"https://avatars.githubusercontent.com/u/540893?v=3","gravatar_id":"","url":"https://api.github.com/users/cardil","html_url":"https://github.com/cardil","followers_url":"https://api.github.com/users/cardil/followers","following_url":"https://api.github.com/users/cardil/following{/other_user}","gists_url":"https://api.github.com/users/cardil/gists{/gist_id}","starred_url":"https://api.github.com/users/cardil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cardil/subscriptions","organizations_url":"https://api.github.com/users/cardil/orgs","repos_url":"https://api.github.com/users/cardil/repos","events_url":"https://api.github.com/users/cardil/events{/privacy}","received_events_url":"https://api.github.com/users/cardil/received_events","type":"User","site_admin":false},"created_at":"2015-03-13T06:23:53Z","updated_at":"2015-03-13T06:23:53Z","body":"Nice. Thanks! "}}