OIDCCryptoPassphrase doesn't work with exec:command anymore

[sebastian-goeldi]

Hello,

previously I had mod_auth_openidc working with OIDCCryptoPassphrase "exec:head /dev/urandom | tr -dc A-Za-z0-9 | head -c 32". Now it just terminates in a segmentation fault. I also quickly tried with other commands, but it seems that this doesn´t work anymore. Even when using the fulll path (/usr/bin/head etc.) it doesn´t work anymore.

[zandbelt]

Can you please specify which version you are using (and which version you used before that worked), as well as where you got the binaries from?

[sebastian-goeldi]

Sorry, I cannot tell you exactly with which version it worked before. I now have tried it with the version in the apt repository of debian stable/bullseye (libapache2-mod-auth-openidc/stable 2.4.9-1 amd64) and the latest 2.4.10 release for debian bullseye on github. The machine was previously on buster, so I guess it was one of these releases where it worked. Sorry, I didn't use the website often in the meantime, but I think the version packaged for debian stable around last June worked. Does this provide enough information? Otherwise I could try to spin up a buster instance and try whether it works with that version.

[zandbelt]

ok, thanks, I'll reproduce on with 2.4.10 on bullseye

[zandbelt]

I cannot explain the crash, but I do see that the implementation of ap_get_exec_line doesn't allow for shell based input, so you'd have to use:

OIDCCryptoPassphrase "exec:/bin/bash -c \"head /dev/urandom | tr -dc A-Za-z0-9 | head -c 32\""

to get a proper passphrase in the way that you want; can you confirm that?

FWIW: this is the case for me on any version so it does not really explain why it worked before either.

[sebastian-goeldi]

Thanks, that works! I almost suspected it but didn't use the full path for bash, so it didn't work