<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
I share Doug's concerns but would state some more strongly. IMO, it
is simply unacceptable to modify user-visible behavior based on
whether some package that happens to be used in an implementation is
installed or not. This package is installed on Ubuntu by default and
may be used by other applications that have nothing to do with
OpenStack at all. <br>
<br>
The proposed behavior is biased towards a very simple use case of a
single user with a password manually invoking commands at the shell.
It is really up to the administrator of a machine with the client
installed what the security policy should be. As Doug suggested,
this change is a very small piece of an overall security
architecture which is not well spelled out here. <br>
<br>
If we really want to go down this road there should be an
environment variable that can be set to turn off this behavior for
applications that do not want it.<br>
<br>
-David<br>
<br>
On 7/30/2012 9:31 AM, Doug Hellmann wrote:
<blockquote
cite="mid:CADb+p3R4h+Xw5qxVXFPsx2Jq01pPqGRc-q5Gya1L-Kt1Bxk7Eg@mail.gmail.com"
type="cite"><br>
<br>
<div class="gmail_quote">On Sun, Jul 29, 2012 at 1:37 AM,
Bhuvaneswaran A <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:bhuvan@apache.org" target="_blank">bhuvan@apache.org</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
Team,<br>
<br>
As per patch <a moz-do-not-send="true"
href="https://review.openstack.org/#/c/9497/"
target="_blank">https://review.openstack.org/#/c/9497/</a>
we are adding<br>
keyring support for "openstack" client. If password is not
specified<br>
in command line or environment variable, the user is prompted
to enter<br>
password. During this time, the password is stored in keyring.
During<br>
next time, the password is read from keyring, instead of
prompt. It is<br>
true, if password is not specified in command line or
environment<br>
variable.<br>
<br>
This behavior is documented in this wiki page:<br>
<a moz-do-not-send="true"
href="http://wiki.openstack.org/KeyringSupport"
target="_blank">http://wiki.openstack.org/KeyringSupport</a><br>
<br>
If you have any comments, please let us know.<br>
</blockquote>
<div><br>
</div>
<div>You've already answered several of my questions on the
ticket, but I still have some "usability" concerns. </div>
<div><br>
</div>
<div>How does the keyring system support a single person logging
in using multiple user accounts? For example, if I have an
admin account and a "regular" user, how do I switch between
them based on the operations I need to perform?</div>
<div><br>
</div>
<div>Is there a way to disable the behavior of having a password
saved to a keyring for a particular user, without uninstalling
the python-keyring package (and therefore disabling keyring
support for all users)?</div>
<div><br>
</div>
<div>The wiki mentions the password being saved
using keyring.backend.UncryptedFileKeyring. Does that mean the
password is saved in cleartext? Is the file protected in some
way besides filesystem permissions?</div>
<div><br>
</div>
<div>The mention of one backend implies that there are others.
Should we give users a way to choose the backend, in case they
have a preference?</div>
<div><br>
</div>
<div>How does the use of the keyring affect scripting using the
command line tool? Can a script access the keyring, or does it
need to use the other options?</div>
<div><br>
</div>
<div>In one review comment you mention a few desktop apps that
know how to manipulate the keyring to manage its contents.
What about remote access via ssh, where a desktop environment
is not available? Does the keyring library include tools for
manipulating the file, or do we need to build our own? If so,
what tools would be needed?</div>
<div><br>
</div>
<div>Doug</div>
<div><br>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Mailing list: <a class="moz-txt-link-freetext" href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a>
Post to : <a class="moz-txt-link-abbreviated" href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a>
Unsubscribe : <a class="moz-txt-link-freetext" href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a>
More help : <a class="moz-txt-link-freetext" href="https://help.launchpad.net/ListHelp">https://help.launchpad.net/ListHelp</a>
</pre>
</blockquote>
<br>
</body>
</html>