Implement the hacluster password verify gatherer

[arbulu89]

This gatherer checks if the provided password is the correct one for the hacluster user.

As stated in the code:

By now, this gatherer works with a fixed user: hacluster
It checks if the provider password in the fact Argument field matches with the user password, being:
- true: the provided password is hacluster user password
- false: the provided password does not match the hacluster password
In order to make the checked user variable, the arguments field should be converted to some more
advanced struct to allow getting more data

By now, there is not any need to check the password for other users. The aim of this one is to basically check that the hacluster user password has been changes from the default one, so the cluster doesn't have such a big security hole

Find some more information about the implementation details and how passwords work in linux systems using the hashing way here:
https://linux-audit.com/password-security-with-linux-etc-shadow-file/

[nelsonkopliku]

Thanks Xabi, great stuff!
I shared with you some thoughts about the gatherer and related DSL.
Let's hear also from the rest of the team 🚀

[rtorrero]

I'm a bit late to the party but I'm not entirely convinced that flexibility here is the key value to go for. I'd rather have the gatherer to check exclusively for a well-known pre-established password. e.g. user: hacluster, password:linux or whatever the known defaults are.

Sending user:password combinations to the gatherer is indeed more flexible and allows to reuse this gatherer for other things, but I'd seek for security over flexibility here.

As off for the code, if we still decide to go with this approach: LGTM

[nelsonkopliku]

@rtorrero you mean something like this option?

facts:
    - name: my_hacluster_pass_has_changed
      gatherer: hacluster_password_changed

that encapsulates username and related default password.

That was also my thought, let's hear also from the rest of the team.

[nelsonkopliku]

I took the liberty to pick this up and:

• modified gatherer constructor to inject an executor
• updated tests

At this stage of current gatherer's implementation we are able to tell whether a username:password combination is correct (returns true|false)

The involved check here is 1.5.2 The hacluster user password has been changed from the default value linux and expressing that via DSL and this gatherer, would look like this

# 1.5.2 The `hacluster` user password has been changed from the default value `linux`
facts:
  - name: default_hacluster_password
    gatherer: verify_password
    argument: "hacluster:linux"
expectations:
  - name: hacluster_password_has_been_changed
    expect: default_hacluster_password == false

If this is fine, let's go ahead, otherwise we'd need to change the gatherer's logic.

[dottorblaster]

LGTM

[rtorrero]

@rtorrero you mean something like this option?

facts:
    - name: my_hacluster_pass_has_changed
      gatherer: hacluster_password_changed

that encapsulates username and related default password.

That was also my thought, let's hear also from the rest of the team.

Yes (sorry for the late reply)