Linuxgsm: [FEATURE] Upload to pastebin with hidden sensitive info

[UltimateByte]

./gameserver details-share
./gameserver ds

Or

/gameserver details-support
./gameserver ds

Or

./gameserver post-details
./gameserver pd

Or

./gameserver details-post
./gameserver dp

How to upload
https://gist.github.com/yevgenko/1803605

details-share could use the same function as detailsbut with an ifstatement for sensitive info.

[UltimateByte]

0:41 - CedarLUG: http://steamcommunity.com/groups/linuxgsm/discussions/0/412448792353031314/#c412448792353224827

[cedarlug]

• password
• gslt
• steamuser
• steampass
• pushbullettoken
• authkey
• rcon_password
• rcts_strAdminPassword (SSam)
• sv_password
• zmq_stats_password
• zmq_rcon_password
• pass (Terraria)
• rconServerPassword (Starbound)
• IP Address (this actually comes in really handy for debugging, but could be stripped)
• ???

What else should be sanitized?

[UltimateByte]

I think you pretty much nailed it :o))

[cedarlug]

Teaser
I believe I have all of the items enumerated above, except IP addresses, able to be stripped.

Edit: IP addresses aren't difficult, I just personally want to keep them in.

[UltimateByte]

You've coded it ?

[cedarlug]

On my fork.

[UltimateByte]

Lol, "pd", is a french word for pédéraste, which means basically, "gay".
I'm already laughing thinking about asking people to run ./gameserver pd :o))

Good job btw..

Something cool would be to mask off the steam user only if it's something different than anonymous. That way we'd know if the user tries to login to steam while it's unnecessary.
Also, mask off passwords only if not empty. That way we'd know if a password is not set.

Does it mask off info from fn_parms already ?
Did you try pastebin upload ?

[cedarlug]

Good progress on this - need some input though.

I have it so that steamuser=anonymous and steampass empty are reported rather than stripped.

What would you like to see for the scenario where the rustserver has default CHANGE_ME password?

Currently there's a warning output in the details output. Should that be reported in the details that we ask users to post, or stripped because it's a default password used for rcon on someone's server?

[cedarlug]

... and yes, I've worked the curl to pastebin in.

[UltimateByte]

What would you like to see for the scenario where the rustserver has default CHANGE_ME password?

You're going really deep into it :o))
I wouldn't worry about checking this, just mask off the password in any case. There is already a warning for it. :)

[cedarlug]

I've only tested the pull request on Rust and several hl2 games. If you get a chance, could you roll #1037 into your local codebase and see if it works as expected?

I'm just using one fn_print_warn, as the output from postdetails is mainly just the link.

Example output: http://pastebin.com/vq2Q8eZL

[dgibbs64]

I would like to roll logs in to this output as well. See an email alert for an example

[cedarlug]

Pastebin branch created, populated, and provisionally tested (with csgoserver and rustserver).

A couple of development/debugging tips:

• pastebin limits guest posts (the type implemented in this branch) to 10 per day per IP address. So the travis builds might run into some issues.
• a hastebin option will be added shortly.
• the default duration is one week. Expiring a post is "a good thing(tm)" IMO, and a week should be enough for the developers to lay eyes on the issue.

[cedarlug]

@dgibbs64 & @UltimateByte - I'd like you to put eyes on the pastebin branch if you have a moment.

I've rolled in hastebin posting (the default), and everything should be reasonably up to date with origin.

The modifications do not effect e-mail notices, but are easily adapted to do so.

hastebin example
pastebin example

To change from one to the other, change the definition of POSTTARGET in command_postdetails.sh

[UltimateByte]

Upvote for hastebin :)
Maybe you can pr so that we can easily see modified files ?

[UltimateByte]

[ OK ] Update LGSM gmod-server: Updating functions
gmodprobuild@game:~$ ./gmodserver pd
fetching command_postdetails.sh...OK
[ OK ] Postdetails gmod-server: Posting details to hastbin.com for 1W

• url: http://hastebin.com/ifaloravaf

"hastbin.com", fail :p

Otherwise it's great !

Fixed typo :)

[UltimateByte]

Well, this is merged, we can close !

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.