/etc/ssh/ldap_authorized_keys_bindpw contains line break, authentication fails
Nobody has claimed this yet.
- Dominant language
- Jinja
- Stars
- 1.4k
- Forks
- 379
- Avg merge
- 4d 18h
- Merged PRs (30d)
- 8
Description
Hi,
Auto generated passwords
https://github.com/debops/debops/blob/c6075e3a4351c5915cde3ec935fb1a856929e358/ansible/roles/sshd/defaults/main.yml#L1008-L1011
contain the line break in the very end and while that should be ok because jinja2 should take care of removing it via https://github.com/debops/debops/blob/master/ansible/roles/sshd/templates/etc/ssh/ldap_authorized_keys_bindpw.j2 - it fails. Resulting in ldapsearch command saying that provided credentials are invalid (via https://github.com/debops/debops/blob/master/ansible/roles/sshd/templates/etc/ssh/authorized_keys_lookup.d/ldap.j2 )
Is it jinja2 bug? Stripping the password from line breaks at ansible controller's side still re-introduces it when it's deployed on target VM.
Thanks
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with ansible/roles/sshd/defaults/main.yml around lines 1008-1011 and the templates etc/ssh/ldap_authorized_keys_bindpw.j2 and etc/ssh/authorized_keys_lookup.d/ldap.j2. Trace how the generated bind password reaches the target and how ldapsearch uses it. Done means the deployed password has no unintended line break and LDAP authentication succeeds.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ansible
- Domain
- authentication, devops, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100