Disallow fetching the ticket salt via REST API

[dnsmichi]

For security reasons, we should disable fetching this credential specific constant.

[lippserd]

We have to coordinate this with @Thomas-Gelf since afaik the Director makes use of this salt.

[dnsmichi]

@lippserd Thanks for mentioning, I forgot to copy the commit message into this PR.

The Director currently relies on this object attribute. For this reason
we've implemented /v1/actions/generate-ticket in Icinga 2 v2.5 which only needs
a hostname and hides the ticket salt from the caller.

Needs Icinga/icingaweb2-module-director#401

[julianbrost]

Well, some time later, this issue was rediscovered and considered more urgent which lead to GHSA-98wp-jc6q-x5q5. Commit 4fca009 is therefore obsolete now. I'd still consider including 6a566ef though.

[dnsmichi]

@julianbrost Thanks for finally fixing the security problem after 5 years (Icinga/icingaweb2-module-director#401 #4485). It had been tiring to argue for the change, disallowing auto-signing tricked by agent setups for convenience.

Yet I imagine that there are countless installations out there which have the raw ticket_salt private key fetch mechanism embedded in their scripts, following the bad practice suggested by upstream.

Feel free to cherry-pick the mentioned commit and/or close the PR, I don't have access to this repository anymore.

[cla-bot]

Thank you for your pull request and welcome to our community. We could not parse the GitHub identity of the following contributors: Michael Friedrich.
This is most likely caused by a git client misconfiguration; please make sure to:

1. check if your git client is configured with an email to sign commits git config --list | grep email
2. If not, set it up using git config --global user.email email@example.com
3. Make sure that the git commit email is configured in your GitHub account settings, see https://github.com/settings/emails

[Al2Klimov]

@bobapple If you can and want to do something about this, please do it. Otherwise feel free not to do it. We all know the situation from law POV and I don’t care for that one red CI result.

[lippserd]

Create a new PR with that change and remove this one. Or reset the author.

[Al2Klimov]

curl -ksSu root:123456 -H 'Accept: application/json' https://127.0.0.1:5665/v1/variables\?pretty\=1 |grep TicketSalt

Before

            "name": "TicketSalt",

After

[Al2Klimov]

Even resetting the author so that GitHub recognises him doesn’t help (not to mention .mailmap): Al2Klimov#15

Not the first time we ignore some checks knowing that actually everything is OK. 🤷‍♂️