Characters in string arguments get mixed up and thrown out

[patx90]

I am using icinga director to create powershell checks, which has been working great thus far.

Unfortunately when I try to pass a specific string as an argument it gets jumbled up.

I'm using a custom powershell check to retrieve a securestring (same as in Invoke-IcingaCheckHTTPStatus).

When I try to verify the input from the powershell side I get a different string.
Characters are either missing, replaced or swapped.

To reproduce:

You can use the existing Invoke-IcingaCheckHTTPStatus and try to pass my string as password:
>ne(O@.xh"|{,Y:9Z]<h

To verify the retrieved argument on powershell side, I simply used the ConvertFrom-IcingaSecureString function to convert the string back to a normal string and give it back as the value of the check result.

The output is this:
@>ne(O.xh

I also tried escaping several characters without any effect.
From my test so far, I have found, that following characters seem to cause issues:
@,"|

I tried passing it as a pure string with the same result.
I also tried using an Icinga-DSL to quote the argument in a simple macro without luck.

Your Environment

Include as many relevant details about the environment you experienced the problem in

• Icinga version:
  icinga2 - The Icinga 2 network monitoring daemon (version: 2.12.5-2)

Copyright (c) 2012-2021 Icinga GmbH (https://icinga.com/)
License GPLv2+: GNU GPL version 2 or later http://gnu.org/licenses/gpl2.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

System information:
Platform: CentOS Linux
Platform version: 8
Kernel: Linux
Kernel version: 4.18.0-240.22.1.el8_3.x86_64
Architecture: x86_64

Build information:
Compiler: GNU 8.4.1
Build host: runner-hh8q3bz2-project-322-concurrent-0
OpenSSL version: OpenSSL 1.1.1g FIPS 21 Apr 2020

Application information:

General paths:
Config directory: /etc/icinga2
Data directory: /var/lib/icinga2
Log directory: /var/log/icinga2
Cache directory: /var/cache/icinga2
Spool directory: /var/spool/icinga2
Run directory: /run/icinga2

Old paths (deprecated):
Installation root: /usr
Sysconf directory: /etc
Run directory (base): /run
Local state directory: /var

Internal paths:
Package data directory: /usr/share/icinga2
State path: /var/lib/icinga2/icinga2.state
Modified attributes path: /var/lib/icinga2/modified-attributes.conf
Objects path: /var/cache/icinga2/icinga2.debug
Vars path: /var/cache/icinga2/icinga2.vars
PID path: /run/icinga2/icinga2.pid

• CentOS Linux release 8.4.2105
• Enabled features: api checker graphite ido-mysql mainlog notification
• Icinga Web 2 Version 2.9.2
• libraries:

1. icinga/icinga-php-thirdparty | 0.10.0
2. icinga/icinga-php-library | 0.6.1

• modules

1. setup | 2.9.2
2. director | 1.8.0
3. doc | 2.9.2
4. incubator | 0.6.0
5. ipl | v0.5.0
6. monitoring | 2.9.2
7. pdfexport | 0.9.0
8. reactbundle | 0.9.0
9. reporting | 0.9.2
10. translation | 2.9.2

• Config validation (icinga2 daemon -C):
  [2021-08-02 21:09:42 +0200] information/cli: Icinga application loader (version: 2.12.5-2)
  [2021-08-02 21:09:42 +0200] information/cli: Loading configuration file(s).
  [2021-08-02 21:09:42 +0200] information/ConfigItem: Committing config item(s).
  [2021-08-02 21:09:42 +0200] information/ApiListener: My API identity: DEPBEG-MAP 01.eggedmz.local
  [2021-08-02 21:09:42 +0200] information/ConfigItem: Instantiated 1 NotificationC omponent.
  [2021-08-02 21:09:42 +0200] information/ConfigItem: Instantiated 1 IdoMysqlConne ction.
  [2021-08-02 21:09:42 +0200] information/ConfigItem: Instantiated 1 CheckerCompon ent.
  [2021-08-02 21:09:42 +0200] information/ConfigItem: Instantiated 189 ScheduledDo wntimes.
  [2021-08-02 21:09:42 +0200] information/ConfigItem: Instantiated 24 Zones.
  [2021-08-02 21:09:42 +0200] information/ConfigItem: Instantiated 2 ServiceGroups .
  [2021-08-02 21:09:42 +0200] information/ConfigItem: Instantiated 1 GraphiteWrite r.
  [2021-08-02 21:09:42 +0200] information/ConfigItem: Instantiated 175 Services.
  [2021-08-02 21:09:42 +0200] information/ConfigItem: Instantiated 1 IcingaApplica tion.
  [2021-08-02 21:09:42 +0200] information/ConfigItem: Instantiated 21 Hosts.
  [2021-08-02 21:09:42 +0200] information/ConfigItem: Instantiated 7 HostGroups.
  [2021-08-02 21:09:42 +0200] information/ConfigItem: Instantiated 22 Endpoints.
  [2021-08-02 21:09:42 +0200] information/ConfigItem: Instantiated 189 Downtimes.
  [2021-08-02 21:09:42 +0200] information/ConfigItem: Instantiated 6 Comments.
  [2021-08-02 21:09:42 +0200] information/ConfigItem: Instantiated 1 FileLogger.
  [2021-08-02 21:09:42 +0200] information/ConfigItem: Instantiated 2 ApiUsers.
  [2021-08-02 21:09:42 +0200] information/ConfigItem: Instantiated 266 CheckComman ds.
  [2021-08-02 21:09:42 +0200] information/ConfigItem: Instantiated 1 ApiListener.
  [2021-08-02 21:09:42 +0200] information/ScriptGlobal: Dumping variables to file '/var/cache/icinga2/icinga2.vars'
  [2021-08-02 21:09:42 +0200] information/cli: Finished validating the configurati on file(s).

[Al2Klimov]

Hello @patx90 and thank you for reporting!

To me this sounds like #7092. Please try v2.13.0 once released.

Best,
AK

[patx90]

Retested with 2.13.0 Unfortunately I get the same result.
The password is not trasmitted entirely.

Maybe I will try to use base64 encoding prior to SecureString and add a decode on the receiving end.
Will give more insight after further testing

[Al2Klimov]

Task

Once you're ready with everything else, have a look at this.

But if the OP didn't respond yet, ask your colleagues for other tasks first.

[patx90]

I logged the received passwort to a text file after decoding it.

$UnsecurePassword = ConvertFrom-IcingaSecureString $Password
$UnsecurePassword | Out-File -FilePath "XXX\Test.log" -Encoding UTF8 -Append

Send password >ne(O@.xh"|{,Y:9Z]<h
Received password: >ne(O@.xh|{,Y:9Z]<h

It seems that quotes still get lost even with 2.13.0.

[yhabteab]

Just tried to perform a Invoke-IcingaCheckHTTPStatus check with the password that you posted above and works without problems.

'/usr/lib/nagios/plugins/check_by_powershell' '--auth' 'Basic' '--icingacmd' 'Invoke-IcingaCheckHTTPStatus -Url icinga.com -Headers @() -Username yhabteab -Password (ConvertTo-IcingaSecureString '\''>ne(O@.xh"|{,Y:9Z]<h'\'') -Content @() -StatusCode @() -Verbosity 3' '--no-tls' 'true' '--password' 'icinga0815!' '--user' 'Administrator' '-H' 'WINDOWSHOST' '-p' '5985'

If the problem is indeed with Icinga2 then please share here step by step instructions how exactly to reproduce it.

[patx90]

If I run the check locally:
powershell -c { Use-Icinga; Invoke-IcingaCheckXXX -Password (ConvertTo-IcingaSecureString '>ne(O@.xh"|{,Y:9Z]<h') }

I receive the correct string.

However, when I supply the same string as a variable in the director check, I receive the password without the " character.

Please try via director service.

[patx90]

I have a separate check where I wanted to pass a string (not securestring) in a KeyPass Auto-Hotkey fashion (e.g. "{Username}{Tab}{Password}{Enter}").

When I passed the argument (also using a director service check), the invocation failed.
I amended the style to a colon separate string (e.g. "Username:Tab:Password:Enter") and the check now works as Intended.

[yhabteab]

Sorry, but even with the second try I could not reproduce this error with and without director. Might also be helpful to know what your plugin is doing exactly there.

Director inspection result:

'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' '-NoProfile' '-NoLogo' '-ExecutionPolicy' 'ByPass' '-C' 'try { Use-Icinga -Minimal; } catch { Write-Output '\''The Icinga PowerShell Framework is either not installed on the system or not configured properly. Please check https://icinga.com/docs/windows for further details'\''; Write-Output '\''Error:'\'' $($_.Exception.Message)Components:`r`n$( Get-Module -ListAvailable '\''icinga-powershell-*'\'' )`r`n'\''Module-Path:'\''`r`n$($Env:PSModulePath); exit 3; }; Exit-IcingaExecutePlugin -Command '\''Invoke-IcingaCheckHTTPStatus'\'' ' '-Url' '@()' '-Headers' '@()' '-Password' '(ConvertTo-IcingaSecureString '\''>ne(O@.xh"|{,Y:9Z]<h'\'')' '-Content' '@()' '-StatusCode' '@()'

And this is how Icinga2 executes the command, configured as command_endpoint. You can see this when you start the agent in foreground in debug level.

[2021-12-09 17:02:20 +0100] notice/ApiListener: Current zone master: YONASHABTEADC03
[2021-12-09 17:02:20 +0100] notice/ApiListener: Connected endpoints: docker-master (1)
[2021-12-09 17:02:20 +0100] notice/Process: PID 3772 ('C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -ExecutionPolicy ByPass -C "try { Use-Icinga -Minimal; } catch { Write-Output 'The Icinga PowerShell Framework is either not installed on the system or not configured properly. Please check https://icinga.com/docs/windows for further details'; Write-Output 'Error:' $($_.Exception.Message)Components:`r`n$( Get-Module -ListAvailable 'icinga-powershell-*' )`r`n'Module-Path:'`r`n$($Env:PSModulePath); exit 3; }; Exit-IcingaExecutePlugin -Command 'Invoke-IcingaCheckHTTPStatus' " -Url @() -Headers @() -Password "(ConvertTo-IcingaSecureString '>ne(O@.xh\"|{,Y:9Z]<h')" -Content @() -StatusCode @()') terminated with exit code 3