Python for Bioinformatics: Xgrid: passwords

Friday, November 6, 2009

Xgrid: passwords

This post is the fifth in a series, the others are here (1, 2, 3, and 4).

As I said, copying a password from one file to another (and still another) seems like a pretty silly hack, and it is. So I joined the Apple mailing list for xgrid-users, and put up the question: how do you do this right? No response yet. And this is the internet's way of telling you "that was a really stupid question." At least that's my take. It's happened before. At least I tried searching the archives first. (Though this is pretty painful if you use the list's tool to do it).

So I went exploring on my single machine Xgrid:

/etc/xgrid/agent

which contains

com.apple.xgrid.agent.plist.default 
controller-password

The password file contains the password we entered in System Prefs, converted to its "hashed" form. The plist file looks like this:

It's interesting that "OnlyWhenIdle" does not match the setting I have in System Prefs. The other directory is

/etc/xgrid/controller

which contains

agent-password
client-password
com.apple.xgrid.controller.plist.default

These are the two password files we created by the cp command. The plist file looks like this:

Now, I think we could do this without authentication to the controller by either agent or client. We would simply edit this file to replace "Password" above by "None", as described here.

Also I wrote my new friend at Stanford, and he says that the "hashed" passwords in question are generated by XORing with a simple key (and he gave me the secret handshake). So that leads to: (i) the realization that it really was a stupid question and (ii) the real subject of this post. If Apple wanted to make Xgrid available to non-Server users, they would have decent authentication. They do not, so therefore... (you can figure it out). Now, in the Server manual they say that they use super-duper Server methods to handle the authentication securely. And since you can have a mixed Server/standard node environment you'd probably want to do it the same way for both. But I don't see any reason you'd have to do it that way.

So... let's take a closer look at the password. I set this to be something really sophisticated: 'mypw'. And then, I copied /etc/xgrid/agent/controller-password to the Desktop (and changed the permissions). A disclaimer, I am not so hot with bytes. I'm sure this is a bit lame, but it works. Getting better at byte manipulation is on my to-do list, along with the same for Unicode. Here is the Python code:

import binascii

def loadpw():
    FH = open('pw','rb')
    data = FH.read()
    FH.close()
    return data

D = { '0':'0000','1':'0001', '2':'0010','3':'0011',
      '4':'0100','5':'0101', '6':'0110','7':'0111',
      '8':'1000','9':'1001', 'a':'1010','b':'1011',
      'c':'1100','d':'1101', 'e':'1110','f':'1111'}
       
def decode(c):
    c = c.lower()
    return D[c]

rL = list()  # for the last part

def show(h):
    L = [c.rjust(4) for c in h]
    print ''.join(L)
    L = [decode(c) for c in h]
    print ''.join(L)
    
data = loadpw()
h = binascii.b2a_hex(data)
rL.append([decode(c) for c in h])
print 'pw from file, as hex and binary:'
show(h)

pw from file, as hex and binary:
   1   0   f   0   2   2   5   4
00010000111100000010001001010100

def hexpw(s):
    retL = list()
    for c in s:
        retL.append(hex(ord(c))[2:])
    return ''.join(retL)
  
print 'pw string as text, hex and binary:'
print 'mypw'
hp = hexpw('mypw')
rL.append([decode(c) for c in hp])
show(hp)

pw string as text, hex and binary:
mypw
   6   d   7   9   7   0   7   7
01101101011110010111000001110111

key = ['0x7D','0x89','0x52',
       '0x23','0xD2','0xBC', 
       '0xDD','0xEA','0xA3',
       '0xB9','0x1F'];
L = list() 
for k in key[:4]:  
    L.extend(k[2:4])
print 'key, as hex and binary:'
show(L)
rL.append([decode(c) for c in L])

key, as hex and binary:
   7   D   8   9   5   2   2   3
01111101100010010101001000100011

Let's print them all together to see the pattern:

names = ['file:','mypw:',' key:']
for i,n in enumerate(names):
    print n, ''.join(rL[i])

file: 00010000111100000010001001010100
mypw: 01101101011110010111000001110111
 key: 01111101100010010101001000100011

Conclusions:

#1: the passwords are not stored securely, it is clear that Apple does not want me to use this for anything serious

#2: I never appreciated that XOR has this symmetry:

if C = A XOR B
then

A = B XOR C
B = A XOR C

How could I miss that?