public inbox for pbs-devel@lists.proxmox.com
 help / color / mirror / Atom feed
* [pbs-devel] [PATCH proxmox-backup 1/2] fix #3853: api: add force option to tape key change-passphrase
@ 2022-02-07 12:48 Stefan Sterz
  2022-02-07 12:48 ` [pbs-devel] [PATCH proxmox-backup 2/2] fix #3853: tape cli: add force flag to " Stefan Sterz
                   ` (2 more replies)
  0 siblings, 3 replies; 9+ messages in thread
From: Stefan Sterz @ 2022-02-07 12:48 UTC (permalink / raw)
  To: pbs-devel

When force is used, the current passphrase is not required. Instead
it will be read from the file pointed to by TAPE_KEYS_FILENAME and
the old key configuration will be overwritten using the new
passphrase.

Signed-off-by: Stefan Sterz <s.sterz@proxmox.com>
---
 src/api2/config/tape_encryption_keys.rs | 36 ++++++++++++++++++++++---
 1 file changed, 33 insertions(+), 3 deletions(-)

diff --git a/src/api2/config/tape_encryption_keys.rs b/src/api2/config/tape_encryption_keys.rs
index 1ad99377..b31f741d 100644
--- a/src/api2/config/tape_encryption_keys.rs
+++ b/src/api2/config/tape_encryption_keys.rs
@@ -70,6 +70,7 @@ pub fn list_keys(
             password: {
                 description: "The current password.",
                 min_length: 5,
+                optional: true,
             },
             "new-password": {
                 description: "The new password.",
@@ -78,6 +79,12 @@ pub fn list_keys(
             hint: {
                 schema: PASSWORD_HINT_SCHEMA,
             },
+            force: {
+                optional: true,
+                type: bool,
+                description: "Don't ask for the old passphrase and overwrite it. Root only.",
+                default: false,
+            },
             digest: {
                 optional: true,
                 schema: PROXMOX_CONFIG_DIGEST_SCHEMA,
@@ -91,9 +98,10 @@ pub fn list_keys(
 /// Change the encryption key's password (and password hint).
 pub fn change_passphrase(
     kdf: Option<Kdf>,
-    password: String,
+    password: Option<String>,
     new_password: String,
     hint: String,
+    force: bool,
     fingerprint: Fingerprint,
     digest: Option<String>,
     _rpcenv: &mut dyn RpcEnvironment
@@ -116,10 +124,32 @@ pub fn change_passphrase(
 
     let key_config = match config_map.get(&fingerprint) {
         Some(key_config) => key_config,
-        None => bail!("tape encryption key '{}' does not exist.", fingerprint),
+        None => bail!("tape encryption key configuration '{}' does not exist.", fingerprint),
+    };
+
+    // sanity checks for "password xor --force"
+    if force && password.is_some() {
+        bail!("password is not allowed when using force")
+    }
+
+    if !force && password.is_none() {
+        bail!("missing parameter: password")
+    }
+
+    // decrypt old key or force loading old key from plaintext file
+    let (key, created, fingerprint) = if let Some(pass) = password {
+        key_config.decrypt(&|| Ok(pass.as_bytes().to_vec()))?
+    } else {
+        let (key_map, _) = load_keys()?;
+
+        let key = match key_map.get(&fingerprint) {
+            Some(k) => k.key,
+            None => bail!("tape encryption key '{}' does not exist.", fingerprint)
+        };
+
+        (key, key_config.created, fingerprint)
     };
 
-    let (key, created, fingerprint) = key_config.decrypt(&|| Ok(password.as_bytes().to_vec()))?;
     let mut new_key_config = KeyConfig::with_key(&key, new_password.as_bytes(), kdf)?;
     new_key_config.created = created; // keep original value
     new_key_config.hint = Some(hint);
-- 
2.30.2





^ permalink raw reply	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2022-02-09 15:55 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-02-07 12:48 [pbs-devel] [PATCH proxmox-backup 1/2] fix #3853: api: add force option to tape key change-passphrase Stefan Sterz
2022-02-07 12:48 ` [pbs-devel] [PATCH proxmox-backup 2/2] fix #3853: tape cli: add force flag to " Stefan Sterz
2022-02-09 13:56   ` Wolfgang Bumiller
2022-02-07 14:58 ` [pbs-devel] [PATCH proxmox-backup 1/2] fix #3853: api: add force option to tape " Thomas Lamprecht
2022-02-07 16:14   ` Stefan Sterz
2022-02-08 15:26     ` Dominik Csapak
2022-02-08 15:30       ` Stefan Sterz
2022-02-09 15:54         ` Thomas Lamprecht
2022-02-09 13:52 ` Wolfgang Bumiller

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal