Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 457154 - perl_ldap doesn't show helpful warnings with incorrect parameters
Summary: perl_ldap doesn't show helpful warnings with incorrect parameters
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Infrastructure
Classification: Unclassified
Component: Dev box issues (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Infrastructure
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-02-13 20:12 UTC by Federico Scrinzi (RETIRED)
Modified: 2014-03-08 01:00 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Federico Scrinzi (RETIRED) gentoo-dev 2013-02-13 20:12:51 UTC
As a new developer I was asked to change my password with perl_ldap.
I got unhelpful warning messages because I used the script with incorrect parameters


$ perl_ldap -b user -P 
Enter LDAP Password: 

Use of uninitialized value $uid in concatenation (.) or string at /usr/local/bin/perl_ldap line 387, <STDIN> line 1.
Updating LDAP password for user

Reproducible: Always

Steps to Reproduce:
1. on dev.gentoo.org launch  $ perl_ldap -b user -P 
2. Enter your current password
Actual Results:  
You get "Use of uninitialized value $uid in concatenation (.) or string at /usr/local/bin/perl_ldap line 387, <STDIN> line 1."

Expected Results:  
Even if a new password is entered the process fails but no specific errors are shown
Comment 1 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2013-02-14 16:34:45 UTC
Who or what documentation told you to use perl_ldap to change your password?

The LDAP guide, example 3.6, explicitly says to use passwd instead of perl_ldap to change passwords:

http://www.gentoo.org/proj/en/infrastructure/ldap.xml#doc_chap3
Comment 2 Alec Warner (RETIRED) archtester gentoo-dev Security 2013-02-14 16:47:54 UTC
Perhaps we should remove -P then, or is it what recruiters use?

-A
Comment 3 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2013-02-14 17:01:08 UTC
It's for infra purposes actually, recruiters don't use it at all.
I went and added some more error-checking to perl_ldap, but I really want to know who/what told fox to use perl_ldap for his password?
Comment 4 Federico Scrinzi (RETIRED) gentoo-dev 2013-02-14 22:35:56 UTC
It was my fault, I looked at the doc (http://www.gentoo.org/proj/en/infrastructure/ldap.xml) a too little time and as I saw the perl_ldap script there. I launched $ perl_ldap --help and I saw and used the -P option without reading the doc carefully.

If it's not safe I'd suggest to remove the -P option or at least show a warning that invites the user to use the safer "passwd".


Thanks for your support