rabbitmqctl support for pre-hashed user passwords

[alanwevans]

Is your feature request related to a problem? Please describe.

The rabbitmqctl subcommands add_user and change_password can accept passwords either from the commandline arguments or from STDIN if the argument is omitted from the commandline. For the purposes of automation like Puppet, Checf, Cloud-Init and even Dockerfiles, both of the options are problematic.

Commandline

It is considered best practice NOT to pass secrets to commands/programs from the commandline. The commandline arguments of programs can often be seen by all users of a system and therfore secrets passed as part of a commandline may be visible to all users. Additionally commandline arguments may be logged or stored in histories and are generally not treated as secret data.

There are ways to mitigate these risks but it would probably be better to just to bypass the problem (or at least give users a way to bypass it).

STDIN

In a lot of ways STDIN is better but isn't without flaws. Generally it would be harder for an unpriviledged user to gain access to the STDIN of another user's command/program but it still leaves the question of how to get the password into STDIN in the first place. In automation this often leads to things like echo $PASSWORD | somecommand. In this example the argument of echo (THE PASSWORD) is still on the commandline.

Describe the solution you'd like

rabbitmqctl user related sub commands like add_user and change_password should be able to accept pre-hashed passwords.

Add a switch to the add_user and change_password rabbitqmctl subcommands to allow them to accept pre-hashed passwords.

Examples

rabbitmqctl add_user alan -Z pre_hashed_password

rabbitmqctl change_password -Z pre_hashed_passwords

Note: Here I use the switch -Z as a placeholder as I do not have a strong opinion about the exact switch to use. -h seems logical if you don't mind that -h is sometimes used for "help" also. But there is certainly plenty of precedent for using -h for other things. See: openldap-tools for example. -h is "host".

Check Password

Additionally it would be nice to be able to check that a user's password matches a provided hash. This way configuration management tools like Puppet, Chef and so on, could determine if a user's password hash needs to be updated.

One might be tempted to use the authenticate_user subcommand but I think that might be misleading. We're not trying to authenticate a user, just check that their password hash equals a certain value, as such I think it warrants a separate subcommand.

Proposed check_password subcommand

check_password should read a hash from STDIN or from the command line and then check that hash against the provided users's password hash and report the result via its exit status

rabbitqmctl check_password alan [hash]

Exit Status

The exit status should unambiguously indicate the result of the check.

Proposed Values

Note: I'm not married to these values, if rabbitmqctl already uses these values for other meanings then it might make sense to use other values. Additionally there might be other scenarios worth addressing like 'user not found' (though that could just be "other")

• 0 - user's password hash matches provided hash
• 1 - user's password hash does not match provided hash
• 2 - user does not have a password (rabbitmqctl clear_password)
• other - some other error, see STDERR

Describe alternatives you've considered

No response

Additional context

No response

[michaelklishin]

Thank you for putting together a detailed proposal.

First of all, it is extremely common for all kinds of tools to accept passwords via standard input as one of the options. It is a natural and human-friendly way. Not every design decision is driven by security.

For when you need to generate user accounts, there are already at least two options available:

• Generate credentials and use the HTTP API using any client library you like, or
• Generate a definitions file and import it, possibly on boot

The latter does not require contacting a running cluster node. That's particularly attractive in the case of tools like Puppet, Chef, Salt.

[michaelklishin]

I'm spiking support for hash passwords to rabbitmqctl add_user. If it turns out to be easy, no objections to adding it.

The code paths around adding users and updating them are some of the oldest there are, so we'll see.