Katello/katello — pull request #111 by lzap (2012-05-14 16:51:14+00:00)
Title: encryption - plain text passwords encryption

So I am adding support for plain text passwords encryption (please note this
is encryption for passwords we need to keep - obscurity not security).

1) There is a new utility called katello-passwd (see man page or help
option) to encrypt a password.

2) Encrypted passwords start with $1$ (1 is for version 1) and it can only
be used for database-password setting (we do not have any other plaintext
passwords in Katello yet).

3) Katello can also read unencrypted passwords from this field (if it does
not start with $1$).

4) I will raise a RFE against Candlepin to do the same for database
password. Pulp is fine (no passwords there so far).

5) I modified katello-configure to use the function to encrypt database
password during installation.

6) Encryption is done with passphrase stored in /etc/katello/secure
directory, the file is deployed with katello-generate-passphrase and this is
automatically done by our installer. The file has extra SELinux protection
(it's not in the regular etc_t domain).