636082 - cronjob on brasstacks has password on the command line

Status: RESOLVED WORKSFORME

(Testing :: General, defect)

Description

[Shyam Mani [:fox2mike]]

This generally goes against best practices, so I'd recommend you switch the script over to reading stuff off disk or to not require a password. I'll CC the infrasec folks to comment on this as well, if needed.

Cron <root@sm-brasstacks01> /usr/local/bin/python /usr/local/topfails/topfails/datascraper.py --user topfails --passwd *removed* --span 1d

Also, if you have an email address to receive cron email, I'd be happy to send these emails there. infra has no use for them :) If you don't have an address and would like one, I'd be happy to set one up, add folks and re-direct cron mail there.

Comment 1

[Henrik Skupin [:whimboo][⌚️UTC+1]]

This has nothing to do with Mozmill. Moving to the right place and cc'ing Clint and Johnathan.

Comment 2

[Shyam Mani [:fox2mike]]

(In reply to comment #1)
> This has nothing to do with Mozmill. Moving to the right place and cc'ing Clint
> and Johnathan.

Okay. brasstacks.mozilla.com says :

Let's get down to brass tacks...

This is brasstacks, the Mozilla Automation & Tools' server. You can find a few things here: 

So the only component I found under QA which remotely matched, was this. :)

I'll let it sit here and wait for Clint/Johnathan to respond.

Comment 3

[Jonathan Griffin (:jgriffin)]

Is anyone still using topfails Clint?  If not, we can get rid of that cron job altogether, otherwise we can patch to read the password from a config file.

Comment 4

[cmtalbert]

(In reply to comment #3)
> Is anyone still using topfails Clint?  If not, we can get rid of that cron job
> altogether, otherwise we can patch to read the password from a config file.

Crap, I really hate that topfails script that our contractor did.  It's got more holes than swiss cheese.  Yes, unfortunately there are still people using it.  It watches branches other than mozilla-central and other products, so it has some value.  Let's patch it to do the right thing w.r.t. the config file.

Shyam thanks so much for finding this and bringing it to light.  Also, I'm moving this to the proper component.

Re: cron job email.  How much email is it generating?  My response to that question in comment 0 depends on that answer.

Comment 5

[Shyam Mani [:fox2mike]]

(In reply to comment #4)
 
> Shyam thanks so much for finding this and bringing it to light.  Also, I'm
> moving this to the proper component.

Thanks! 
 
> Re: cron job email.  How much email is it generating?  My response to that
> question in comment 0 depends on that answer.

I see about 11-12 emails in the last 24 hours.

Comment 6

[cmtalbert]

(In reply to comment #5)
> (In reply to comment #4)
> 
> > Shyam thanks so much for finding this and bringing it to light.  Also, I'm
> > moving this to the proper component.
> 
> Thanks! 
> 
> > Re: cron job email.  How much email is it generating?  My response to that
> > question in comment 0 depends on that answer.
> 
> I see about 11-12 emails in the last 24 hours.

Then I don't want to spam auto-tools with this.  Can we set up a new email alias and make it [e-mail].  
Add the following people to it:
* [e-mail]
* [e-mail]
* [e-mail]
* [e-mail]

Thanks!

Comment 7

[Ed Morley [:emorley]]

This cronjob is no longer run.