rabbitmq_user set password with $$ in it fails

[omeganon]

If the password for a rabbitmq_user contains the characters '$$', proper shell escaping is not occurring and $$ is replaced by the shell with the PID of the current process. For example, the password 'wh$$' may become 'wh22456'. rabbitmqctl is actually performing that substitution but salt is preventing us from properly escaping the $$ combination.

Steps to reproduce -

• add to config --
  my_user:
  rabbitmq_user.present:
  • password: fancypa$$
  • force: True
  • runas: root
• execute the salt state.
• observe that rabbitmqctl is called
• try to log in with specified password (failure)

We have tried quoting with ' and '" but salt removes those when executing rabbitmqctl.

We have tried escaping the quotes but they end up double-escaped (i.e. \'fancypa$$\', ending up, presumable, with literal ' as part of the password and PID as well

We have tried escaping the $$ but salt further escapes the escapes (i.e. fancypa$$ becomes fancypa\$\$).

We've tried all combinations of the above both directly in the state definition and in a pillar definition to no avail.

The correct invocation of rabbitmqctl that works is --
rabbitmqctl change_password my_user 'fancypa$$'

We don't see how we can get salt to achieve this construct.

[basepi]

Have you tried double quoting? '"this is a string"'

In any case, thanks for the report, we need to get this fixed.

[omeganon]

Yup…. and '"fancypa$$"', '"fancypa$$"' and '"fancypa$$"'.

Marc

Marc Powell

Infrastructure Lead | Emma®
marc.powell@myemma.com
800.595.4401 x234
615.292.0777 (fax)

On Jul 26, 2013, at 4:22 PM, Colton Myers notifications@github.com wrote:

Have you tried double quoting? '"this is a string"'

In any case, thanks for the report, we need to get this fixed.

—
Reply to this email directly or view it on GitHub.

[terminalmage]

the rabbitmq module is not escaping the password when adding a user or changing the password. This will be easy to fix. Thanks for the report!

[omeganon]

Hey guys! Sorry, I sent this as an email response on the 30th and it didn't make it into this issue for some reason. Re-quoting --

Thanks guys. I tested this and it doesn't seem to work as expected. My password still doesn't work. I manually applied the changes, removed rabbitmq.pyc and restarted saltmaster. When testing on the client --

[INFO ] Executing command 'rabbitmqctl change_password my-user fancypa$$' as user 'root' in directory '/root'

While I understand that this is not actually executing the command, I expected to see my escaped quotes here. Is there something further in that is removing quotes pre-application?

   'rabbitmqctl add_user {0} \'{1}\''.format(name, password),

   'rabbitmqctl change_password {0} \'{1}\''.format(name, password),

Also, to re-iterate, the only combination from the command line that I've found to work is the following.

sudo rabbitmqctl change_password my-user 'fancypa\$\$'

Just quoting 'fancypa$$' isn't sufficient because rabbitmqctl appears to be doing the interpolation at some point (when it shouldn't, obviously).

When I try escaping the $$ like 'fancypa$$' in the state or pillar, the log line above reflects that as 'fancypa$$' so I'm not sure at this point that it's really going to end up being the password I want with just this current fix.

[terminalmage]

@omeganon I'll look into it, thanks.

[omeganon]

one more clarification due to md funkiness --

"When I try escaping the $$ like 'fancypa$$' in the state or pillar, the log line above reflects that as 'fancypa\$\$' so ..."

[terminalmage]

@omeganon How do you login once you have set the password? Trying to do so to test right now and can't figure out how, and the internet is being less than helpful.

[omeganon]

It's the management console --

enable-rabbitmq-management-console:
  cmd.run:
    - name: rabbitmq-plugins enable rabbitmq_management
    - env: HOME=/root
    - user: root
    - require:
      - service: rabbitmq-server-service

It listens on http://:15672

[terminalmage]

No such command on my system.

[terminalmage]

Nevermind, I just edited the enabled_plugins file and restarted. I'm not seeing an issue, here, at least not when running from the develop branch. You don't need to quote the password in your pillar configuration.

[terminalmage]

Actually, I take that back. It looks like noscript was keeping the management console from re-prompting me for the password. I'll do some more testing.

[terminalmage]

@omeganon Even when setting the password on the command line (i.e. not in salt) as you posted above, I cannot login. Do I have to do anything special in the rabbitmq configuration to give the user I have created access to use the management console?

[omeganon]

I didn't create the state and am including it for clarity. I think it's probably the last bit below (munged to replace actual username with 'myuser'). There's also a default guest:guest user for the management console.

# Install Erlang
erlang:
  pkg.installed:
    - name: erlang-nox

# Install RabbitMQ
add-rabbitmq-signing-key:
  cmd.run:
    - name: wget -q http://www.rabbitmq.com/rabbitmq-signing-key-public.asc -O- | sudo apt-key add -
    - unless: sudo apt-key list | grep RabbitMQ

rabbitmq-repo:
  file.managed:
    - name: /etc/apt/sources.list.d/rabbitmq.list
    - source: salt://socialstreaming-rabbitmq/rabbitmq.list
    - require:
      - cmd: add-rabbitmq-signing-key

install-rabbitmq-server:
  pkg.installed:
    - name: rabbitmq-server
    - require:
      - file: rabbitmq-repo
      - pkg: erlang

enable-rabbitmq-management-console:
  cmd.run:
    - name: rabbitmq-plugins enable rabbitmq_management
    - env: HOME=/root
    - user: root
    - require:
      - service: rabbitmq-server-service

rabbitmq-server-service:
  service:
    - name: rabbitmq-server
    - running
    - enable: True
    - require:
      - pkg: install-rabbitmq-server

add-myapp-user:
  rabbitmq_user.present:
    - name: myuser
    - password: {{ pillar['myuser_passwd'] }} 
    - force: True
    - runas: root
    - require:
      - cmd: enable-rabbitmq-management-console

rabbitmqctl set_user_tags myuser administrator:
  cmd.run:
    - require: 
      - rabbitmq_user: add-myapp-user

  /:
  rabbitmq_vhost.present:
    - user: myuser
    - conf: .*
    - write: .*
    - read: .*
    - require:
      - rabbitmq_user: add-myapp-user

[terminalmage]

OK, I added the vhost and set_user_tags states to my configuration and I am now able to login.

I am not having any problems logging in after letting Salt set the password.

[INFO    ] Executing command "rabbitmqctl change_password rabbituser 'fancypa$$'" as user 'root' in directory '/root'