lounge add user password

[morgzz]

Was going to setup a PHP script to execute the add/modify user command(s) but noticed it requires a user to then enter a password securely in the terminal. The documentation look like it allowed a password to be entered in as a parameter but does not currently behave this way.

Examples:
lounge add [user] with no password
would then prompt the user to enter a password

lounge add [user] [password] will not prompt the user to enter a password.

Can this behavior be added into the existing behavior?

[omnicons]

I'm sorry to nag, but can you correct the title's spelling to be correct?

[xPaw]

You can directly edit/create user files if you so desire. The CLI commands just interact with these files. But what you are suggesting is reasonable.

[morgzz]

@omnicons good catch :)

[maxpoulin64]

I'm not sure how I feel about that. Passing passwords on the command-line is a terrible idea security-wise, as anyone that runs ps aux on the server while the user is being added will see the password right there in clear. If you are going to run the command, I would recommend piping the password in instead. An even better solution would be to just write the JSON as @xPaw said. That way you can customize the other options as well, such as preconfiguring networks and other settings.

Alternatively, this can also be done in the shell itself: echo hunter1 | lounge add test works.

[morgzz]

That's a pretty good point. I'll work on PHP script to write out the JSON. Already looking at the bcyrpt libraries. I'll see what I can come up with.

[morgzz]

Does anyone know if Lounge will freak out if there are extra parameters stored in the json file. Hopefully it ignores them? :-)

Say...
"user": "blah blah",
"email": "someone@gmail.com",
"password": "encrypted",...

[maxpoulin64]

It will work fine, but it may get erased later when the file is rewritten as it just writes a whitelisted set of properties so I wouldn't count on them staying there.

[astorije]

I suggest closing this for the security concerns @maxpoulin64 exposed above, which I agree with. Any objections?