erp5testnode: make shellinabox reusing password file of pwgen

slapos/recipe/shellinabox.py

@@ -25,6 +25,7 @@
 #
 ##############################################################################
 from getpass import getpass
+import hmac
 import pwd
 import grp
 import os
@@ -33,19 +34,24 @@ import shlex
 from slapos.recipe.librecipe import GenericBaseRecipe
 
 def login_shell(args):
-  password = args['password']
+  password_file = args['password-file']
+  if password_file:
+    with open(password_file, 'r') as password_file:
+      password = password_file.read()
 
     if (password != ''):
       entered_password = getpass()
     else:
       entered_password = ''
 
-  if entered_password != password:
+    if not hmac.compare_digest(entered_password, password):
       return 1
     else:
       commandline = shlex.split(args['shell'])
       path = commandline[0]
       os.execv(path, commandline)
+  else:
+    return 1
 
 def shellinabox(args):
   certificate_dir = args['certificate_dir']
@@ -95,7 +101,7 @@ class Recipe(GenericBaseRecipe):
       self.options['login-shell'],
       '%s.login_shell' % __name__,
       {
-        'password': self.options['password'],
+        'password-file': self.options['password-file'],
         'shell': self.options['shell']
       }
     )

software/erp5testnode/instance-default.cfg

@@ -94,7 +94,7 @@ port = 8080
 shell = $${shell:wrapper}
 wrapper = $${rootdirectory:bin}/shellinaboxd
 shellinabox-binary = ${shellinabox:location}/bin/shellinaboxd
-password = $${pwgen:passwd}
+password-file = $${pwgen:storage-path}
 directory = $${buildout:directory}/
 login-shell = $${rootdirectory:bin}/login
 certificate-directory = $${directory:shellinabox}

software/erp5testnode/software.cfg

@@ -56,7 +56,7 @@ recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/instance-default.cfg
 output = ${buildout:directory}/template-default.cfg
 mode = 0644
-md5sum =  8e171816b6caef52ac75c2f8f6a69fc3
+md5sum = 05519f3887a309d3ec069e0aa9f52ebc
 
 [versions]
 PyXML = 0.8.5