diff options
| author | Nataliia Solomko <natalirs1985@gmail.com> | 2026-11-03 15:34:39 +0200 |
|---|---|---|
| committer | Nataliia Solomko <natalirs1985@gmail.com> | 2026-11-03 17:41:49 +0200 |
| commit | b12b02d17c321c671ba318ad1bfd90e7bc4b5248 (patch) | |
| tree | 23f49dc6f42f8bc5f715fdfec9a85b579c4d6bd7 /src/migration-scripts/https/5-to-6 | |
| parent | ba125538cac9596b97d2072da60766a50df8194a (diff) | |
| download | vyos-1x-b12b02d17c321c671ba318ad1bfd90e7bc4b5248.tar.gz vyos-1x-b12b02d17c321c671ba318ad1bfd90e7bc4b5248.zip | |
webproxy: T9566: Pass LDAP bind password via file instead of command line
The LDAP bind password was passed to `basic_ldap_auth` with `-w`, so any
local user could read it from `/proc/*/cmdline`. It was also written in
plain text to `squid.conf`.
The password is now written atomically to /run/squid-ldap.secret (0600,
owned by proxy), unchanged including spaces, and passed with -W. The
file is removed when LDAP authentication no longer uses a password.
Diffstat (limited to 'src/migration-scripts/https/5-to-6')
0 files changed, 0 insertions, 0 deletions