Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adds random password generation capability to demo config install scripts #3472

Closed
wants to merge 1 commit into from
Closed

Adds random password generation capability to demo config install scripts #3472

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions tools/generate-password.bat
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
@echo off
setlocal enableDelayedExpansion

REM Set the directory of the current script
set "SCRIPT_DIR=%~dp0"

REM Set the desired password length
set "length=16"

REM Define the character set for the password
set "characters=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"

REM Initialize the password variable
set "password="

REM Loop to generate the random password
for /l %%i in (1,1,%length%) do (
set /a "index=!random! %% 62"
for %%c in (!index!) do (
set "char=!characters:~%%c,1!"
set "password=!password!!char!"
)
)
12 changes: 12 additions & 0 deletions tools/generate-password.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
#!/bin/bash

length="$1"
if [ -z "$length" ]; then
length=12 # Default password length
fi

# Define the character set for the password
characters="A-Za-z0-9"

# Use /dev/urandom to generate random bytes and tr to shuffle them
LC_ALL=C tr -dc "$characters" < /dev/urandom | head -c "$length"
34 changes: 21 additions & 13 deletions tools/install_demo_configuration.bat
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ set "assumeyes=0"
set "initsecurity=0"
set "cluster_mode=0"
set "skip_updates=-1"
set "generate_random_password=0"

goto :GETOPTS

Expand All @@ -27,6 +28,7 @@ echo -y confirm all installation dialogues automatically
echo -i initialize Security plugin with default configuration (default is to ask if -y is not given)
echo -c enable cluster mode by binding to all network interfaces (default is to ask if -y is not given)
echo -s skip updates if config is already applied to opensearch.yml
echo -g generates random password for admin
EXIT /B 0

:GETOPTS
Expand All @@ -35,6 +37,7 @@ if /I "%1" == "-y" set "assumeyes=1"
if /I "%1" == "-i" set "initsecurity=1"
if /I "%1" == "-c" set "cluster_mode=1"
if /I "%1" == "-s" set "skip_updates=0"
if /I "%1" == "-g" set "generate_random_password=1"
shift
if not "%1" == "" goto :GETOPTS

Expand Down Expand Up @@ -325,36 +328,41 @@ setlocal enabledelayedexpansion
set "ADMIN_PASSWORD_FILE=%OPENSEARCH_CONF_DIR%initialAdminPassword.txt"
set "INTERNAL_USERS_FILE=%OPENSEARCH_CONF_DIR%opensearch-security\internal_users.yml"

echo "what is in the config directory"
echo "what is in the config directory"
dir %OPENSEARCH_CONF_DIR%

echo "what is in the password file"
type "%ADMIN_PASSWORD_FILE%"


if "%initialAdminPassword%" NEQ "" (
set "ADMIN_PASSWORD=!initialAdminPassword!"
if not "%initialAdminPassword%"=="" (
set "ADMIN_PASSWORD=%initialAdminPassword%"
) else if exist "%ADMIN_PASSWORD_FILE%" (
for /f %%a in ('type "%ADMIN_PASSWORD_FILE%"') do set "ADMIN_PASSWORD=%%a"
) else if "%generate_random_password%"=="1" (
set "generate_password_script=%OPENSEARCH_PLUGINS_DIR%\opensearch-security\tools\generate-password.bat"
for /f %%a in ('"!generate_password_script!" 16') do set "ADMIN_PASSWORD=%%a"
) else (
for /f %%a in ('type "%ADMIN_PASSWORD_FILE%"') do set "ADMIN_PASSWORD=%%a"
echo Unable to find the admin password for the cluster. Please set initialAdminPassword or create a file %ADMIN_PASSWORD_FILE% with a single line that contains the password.
exit /b 1
)

if not defined ADMIN_PASSWORD (
echo Unable to find the admin password for the cluster. Please set initialAdminPassword or create a file %ADMIN_PASSWORD_FILE% with a single line that contains the password.
exit /b 1
)

echo " ***************************************************"
echo " *** ADMIN PASSWORD SET TO: %ADMIN_PASSWORD% ***"
echo " ***************************************************"

set "HASH_SCRIPT=%OPENSEARCH_PLUGINS_DIR%\opensearch-security\tools\hash.bat"

REM The error level is set to 1 here if initialAdminPassword.txt was not provided
REM so we set it to 0 otherwise it would falsely fail this script on line 367
set ERRORLEVEL=0

REM Run the command and capture its output
for /f %%a in ('%HASH_SCRIPT% -p !ADMIN_PASSWORD!') do (
set "HASHED_ADMIN_PASSWORD=%%a"
)

if errorlevel 1 (
if %ERRORLEVEL% == 1 (
echo Failed to hash the admin password
exit /b 1
)
Expand Down Expand Up @@ -397,14 +405,14 @@ echo. > securityadmin_demo.bat
echo %OPENSEARCH_PLUGINS_DIR%opensearch-security\tools\securityadmin.bat -cd %OPENSEARCH_CONF_DIR%opensearch-security -icl -key %OPENSEARCH_CONF_DIR%kirk-key.pem -cert %OPENSEARCH_CONF_DIR%kirk.pem -cacert %OPENSEARCH_CONF_DIR%root-ca.pem -nhnv >> securityadmin_demo.bat

if %initsecurity% == 0 (
echo ### After the whole cluster is up execute:
echo ### After the whole cluster is up execute:
type securityadmin_demo.bat
echo ### or run ./securityadmin_demo.bat
echo ### After that you can also use the Security Plugin ConfigurationGUI
) else (
echo ### OpenSearch Security will be automatically initialized.
echo ### If you like to change the runtime configuration
echo ### change the files in ../../../config/opensearch-security and execute:
echo ### If you like to change the runtime configuration
echo ### change the files in ../../../config/opensearch-security and execute:
type securityadmin_demo.bat
echo ### or run ./securityadmin_demo.bat
echo ### To use the Security Plugin ConfigurationGUI
Expand Down
10 changes: 9 additions & 1 deletion tools/install_demo_configuration.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ assumeyes=0
initsecurity=0
cluster_mode=0
skip_updates=-1
generate_random_password=0

function show_help() {
echo "install_demo_configuration.sh [-y] [-i] [-c]"
Expand All @@ -37,9 +38,10 @@ function show_help() {
echo " -i initialize Security plugin with default configuration (default is to ask if -y is not given)"
echo " -c enable cluster mode by binding to all network interfaces (default is to ask if -y is not given)"
echo " -s skip updates if config is already applied to opensearch.yml"
echo " -g generates random password for admin"
}

while getopts "h?yics" opt; do
while getopts "h?yicsg" opt; do
case "$opt" in
h|\?)
show_help
Expand All @@ -52,6 +54,8 @@ while getopts "h?yics" opt; do
c) cluster_mode=1
;;
s) skip_updates=0
;;
g) generate_random_password=1
esac
done

Expand Down Expand Up @@ -392,10 +396,14 @@ echo 'plugins.security.system_indices.indices: [".plugins-ml-config", ".plugins-
ADMIN_PASSWORD_FILE="$OPENSEARCH_CONF_DIR/initialAdminPassword.txt"
INTERNAL_USERS_FILE="$OPENSEARCH_CONF_DIR/opensearch-security/internal_users.yml"


if [[ -n "$initialAdminPassword" ]]; then
ADMIN_PASSWORD="$initialAdminPassword"
elif [[ -f "$ADMIN_PASSWORD_FILE" && -s "$ADMIN_PASSWORD_FILE" ]]; then
ADMIN_PASSWORD=$(head -n 1 "$ADMIN_PASSWORD_FILE")
elif [ "$generate_random_password" == 1 ]; then # Added double quotes around "1"
$SUDO_CMD chmod +x "$OPENSEARCH_PLUGINS_DIR/opensearch-security/tools/generate-password.sh"
ADMIN_PASSWORD=$("$OPENSEARCH_PLUGINS_DIR/opensearch-security/tools/generate-password.sh" 16)
else
echo "Unable to find the admin password for the cluster. Please run 'export initialAdminPassword=<your_password>' or create a file $ADMIN_PASSWORD_FILE with a single line that contains the password."
exit 1
Expand Down