community.general/changelogs/fragments/3160-pass-wifi-secrets-via-stdin-to-nmcli-module.yml

security_fixes:
  - nmcli - do not pass WiFi secrets on the ``nmcli`` command line. Use ``nmcli con edit``
    instead and pass secrets as ``stdin``
    (https://github.com/ansible-collections/community.general/issues/3145).
nmcli: writing secrets to command line is a security hole (#3160) * nmcli: use `stdin` for setting private `wifi_sec` options I.E.: * `802-11-wireless-security.leap-password` * `802-11-wireless-security.psk` * `802-11-wireless-security.wep-key0` * `802-11-wireless-security.wep-key1` * `802-11-wireless-security.wep-key2` * `802-11-wireless-security.wep-key3` * Changelog fragement formatting. * Update changelogs/fragments/3160-pass-wifi-secrets-via-stdin-to-nmcli-module.yml Co-authored-by: Felix Fontein <felix@fontein.de> * Make `wifi_sec_secret_options()` into a constant * Minor cleanup `'set ' + key + ' ' + value` => `'set %s %s' % (key, value)` * Change `casing` * Change `WIFI_SEC_SECRET_OPTIONS` from `list` to `tuple` * Update `edit_connection()` to not reset `edit_commands` It will just re`set` them if `edit_connection()` is called more than once. * Do not call `edit_connection()` if `connection_update()` fails Fixed `pep8` issue `E713` in tests `test for membership should be 'not in'` * Simplify `create_connection()`/`modify_connection()` logic * `WIFI_SEC_SECRET_OPTIONS`=>`SECRET_OPTIONS`, options are prefixed * Moved `if key in self.SECRET_OPTIONS` into `if value is not None` check We don't need to do anything is the value is None Co-authored-by: Felix Fontein <felix@fontein.de> 2021-08-08 18:35:52 +02:00			`security_fixes:`
			- nmcli - do not pass WiFi secrets on the ``nmcli`` command line. Use ``nmcli con edit``
			instead and pass secrets as ``stdin``
			`(https://github.com/ansible-collections/community.general/issues/3145).`