Jira (PUP-8330) macOS agents fails to retrieve password hash

[Michael Krause (JIRA)]

Michael Krause created an issue

Puppet / PUP-8330 macOS agents fails to retrieve password hash Issue Type: Bug Affects Versions: PUP 5.3.3 Assignee: Unassigned Created: 2018/01/08 7:36 AM Environment: macOS 10.13.2 Priority: Major Reporter: Michael Krause Puppet Version: 5.3.3 Puppet Server Version: 5.1.4 OS Name/Version: macOS 10.13.2 puppet user provider fails with every puppet run or with puppet resource Desired Behavior: No error or error handling. Actual Behavior: Crash. Example: {{ puppet resource user admin --trace --debug [..] Debug: Executing: '/usr/bin/dscl -plist . readall /Groups' Debug: Converting binary plist to hash Debug: Converting binary plist to hash Debug: Converting binary plist to hash Debug: Converting binary plist to hash Debug: Converting binary plist to hash Error: Could not run: undefined method `unpack' for nil:NilClass /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/provider/user/directoryservice.rb:210:in `get_salted_sha512_pbkdf2' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/provider/user/directoryservice.rb:149:in `generate_attribute_hash' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/provider/user/directoryservice.rb:87:in `block in instances' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/provider/user/directoryservice.rb:86:in `collect' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/provider/user/directoryservice.rb:86:in `instances' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/type.rb:1164:in `block in instances' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/type.rb:1163:in `collect' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/type.rb:1163:in `instances' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/indirector/resource/ral.rb:14:in `find' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/indirector/indirection.rb:195:in `find' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/application/resource.rb:216:in `find_or_save_resources' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/application/resource.rb:142:in `block in main' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/context.rb:65:in `override' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet.rb:263:in `override' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/application/resource.rb:137:in `main' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/application.rb:366:in `run_command' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/application.rb:358:in `block in run' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util.rb:666:in `exit_on_fail' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/application.rb:358:in `run' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/command_line.rb:132:in `run' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/command_line.rb:72:in `execute' /opt/puppetlabs/puppet/bin/puppet:5:in `<main>' }} Add Comment

This message was sent by Atlassian JIRA (v7.0.2#70111-sha1:88534db)

[Michael Krause (JIRA)]

Michael Krause updated an issue

Puppet / PUP-8330 macOS agents fails to retrieve password hash

Change By: Michael Krause *Puppet Version: 5.3.3* *Puppet Server Version: 5.1.4* *OS Name/Version: macOS 10.13.2*

puppet user provider fails with every puppet run or with puppet resource

*Desired Behavior:*

No error or error handling.

*Actual Behavior:* Crash. *Example:* { { code} # puppet resource user admin --trace --debug

{code } }

Add Comment

[Michael Krause (JIRA)]

Michael Krause commented on PUP-8330

Re: macOS agents fails to retrieve password hash This may be related to https://www.exploit-db.com/exploits/43248/ as the affected user resource is root. I can workaround this problem by manually setting a new password with passwd.

Add Comment

[Craig Gomes (JIRA)]

Craig Gomes updated an issue

Puppet / PUP-8330

macOS agents fails to retrieve password hash

Change By: Craig Gomes Team: Platform OS

Add Comment

[Geoff Nichols (JIRA)]

Geoff Nichols updated an issue

Puppet / PUP-8330 macOS agents fails to retrieve password hash

Change By: Geoff Nichols Labels: macos type_and_provider

Add Comment

This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93)

[Branan Riley (JIRA)]

Branan Riley updated an issue

Puppet / PUP-8330 macOS agents fails to retrieve password hash

Change By: Branan Riley Labels: macos triaged type_and_provider user

Add Comment

[Josh Cooper (Jira)]

Josh Cooper commented on PUP-8330

Re: macOS agents fails to retrieve password hash It looks like the entropy field is missing from the SALTED-SHA512-PBKDF2 hash that we parsed... I'm not able to reproduce on 10.15. Since this hasn't been updated in awhile, I'm going to close. Please reopen if it's still an issue using Puppet 6 or later.

Add Comment

This message was sent by Atlassian Jira (v8.13.2#813002-sha1:c495a97)