Vinícius Ferrão
7fa755719a
The daemon redacted secret attributes on the joined command string. The match failed when a value held a space. The match also failed for a "+=" splice assignment. The validate() path did not quote the arguments, so a multi-word secret value kept its later words in syslog and in the auditlog table. A password that a command receives through an option or a positional operand was not redacted at all. The debug dispatch trace wrote the raw arguments to syslog when site.xcatdebugmode was set. Redact the argument vector before the daemon joins it. Add redact_password_args for this task. The routine masks the value of a secret attribute in any argument, at the start or embedded after another token. An embedded secret assignment masks to the end of the argument, because a shell value may hold quotes and spaces. The routine allows spaces around the operator. It accepts the "=", "+=", ",=", "^=", "!=", "=~" and "!~" operators that chdef, nodech and node selection use. It masks a password option value in each form that Getopt::Long accepts: a separate argument, a compact short option, a bundle of short options with the "?" help letter, a "+" option prefix, a single-letter option with two dashes, a long option, a long option with an equals sign, and an abbreviated long option. The long-name match runs first, so a long option keeps its name and masks its value. A walk over each bundle then finds the first secret letter, so the mask always starts at the option and the result does not depend on hash order. The walk knows which other letters of a command take a value, so a secret letter inside such a value does not redact and the audit text stays correct. The walk also knows which letters take an integer, because the z/VM cpu option consumes only its signed digits and the parser then continues the bundle into the password option. The value stops match letter case, because a bundle keeps short options case sensitive and an unknown capital letter does not absorb the rest. The mkvm secret match ignores letter case, because the z/VM parser keeps the Getopt::Long default for long names. The mkhwconn match keeps letter case, because -p is the hardware control point and -P is the password. The routine knows the password options of bmcdiscover, switchdiscover, mkhwconn, mkvm, createvcluster, lsvcluster and rmvcluster, the rspconfig password assignments, the mkvm clone pw= operand, and the positional password operands of chvm. It masks the site.value argument of tabch and chtab when a selector or a site.key assignment names snmpc. An exact short option that takes a non-secret value stays visible, so the PPC mkvm -p profile is not an abbreviation of --password. The dispatch trace builds its text from the redacted vector. Add snmpc, productkey, prodkey.key, tokenid and token.tokenid to the secret list, with community and pdu.community. The secret list holds only attributes that map to a secret column, so key and sshkeydir stay visible. redact_password keeps a second pass over the joined string. This pass masks an embedded secret assignment to the end of the line, because the argument boundaries are gone after the join. The commands.log response classifier marks a response sensitive when the request was redacted. The argument vector pass sets that signal, so a secret whose name has no "passw" text still marks its response.
xCAT
xCAT is a toolkit for deployment and administration of clusters of all sizes.
The xCAT sunset was only a quick eclipse
Dear xCAT Community,
The xCAT sunset has changed course. VersatusHPC has been invited to join the xCAT Consortium, and future development will move toward direct upstream contributions coordinated with the Consortium and its existing member companies.
That matters most for Enterprise Linux 10 (EL10). EL10 support is coming to xCAT, restoring a future operating-system path for sites that still rely on xCAT. This is an important change from the previous sunset guidance, where the lack of an EL10 path was one of the strongest reasons to move away from xCAT.
The xCAT Consortium continues to recommend Confluent as the long-term successor to xCAT, and that remains the Consortium position. Users planning new cluster-management deployments should evaluate Confluent and its xCAT comparison documentation.
At the same time, xCAT is no longer sunsetted. The Consortium and participating companies will continue updating xCAT while there is community and user demand for it.
In summary:
- xCAT development is continuing upstream through the Consortium and participating companies.
- Enterprise Linux 10 support is coming.
- Confluent remains the Consortium-recommended successor and migration path.
- xCAT updates will continue while there is community and user demand.
We want to thank the xCAT Consortium and community for keeping this project moving. The sun went behind the moon for a moment, but xCAT is still here.
For more information on Confluent and how to get started, please visit the Confluent: Project Page, Documentation or Confluent vs xCAT comparison.
With thanks,
The xCAT Consortium
Documentation
xCAT Documentation is hosted on Read The Docs: https://xcat-docs.readthedocs.io
Status
| xCAT Version | Build Status |
|---|---|
| Latest (master branch) | |
| Stable (latest release) |
Looking for older versions?
Open Source License
xCAT is made available under the EPL license: https://opensource.org/licenses/eclipse-1.0.php
Developers
Want to help? Check out the developers guide!