Passing passwords via command line arguments is very bad practice. Curl has a -u option, if passed just the user it prompts for the password on stdin. This can simply be passed via shell redirection.

The issue is raised in this forum query: https://forum.vyos.io/t/commit-archive-doesnt-accept-symbols-in-password/13817
Remote host having password with special character is not accepted using with scp command

vyos@test1# set system config-management commit-archive location scp://test:[email protected]/tmp

  "//test:[email protected]/tmp" is not a valid URI for the scp URL scheme


  Invalid value
  Value validation failed
  Set failed

Version:

vyos@test1# run sh ver
Version:          VyOS 1.5-rolling-202402120819
Release train:    current

Built by:         [email protected]
Built on:         Mon 12 Feb 2024 10:20 UTC
Build UUID:       b1a917a9-cda4-49ad-a327-58321f1067dc
Build commit ID:  8c5299e1cf7c7b

In both cases it is kind of an user error, the password would have to be properly url encoded if provided in one (@ should be %40 in an URI, a ! should be %21).

We could improve it by breaking up configuration, having the user providing a URI, Protocol and optional username/password as separate values.
Then we can properly encode username/password. This would also give more flexibility how username/password are handled and passed on.

Proposal:

set system config-management commit-archive uri "stor01z-cs.int.trae32566.org/cr01b-vyos"
set system config-management commit-archive scheme "sftp"
set system config-management commit-archive username "cr01b"
set system config-management commit-archive password "$T3$TP@$$W0^%"

Which would then generate the valid url: sftp://cr01b:%24T3%24TP%40%24%24W0%5E%[email protected]/cr01b-vyos

I could create a PR for that.

Other option would be to improve validation that the first reported issue also ends up with a (better) error message on validation.

There should also be migration scripts, as CLI will be changed.

You would still be limited to not be able to use " as part of your password.

Perhaps add a method so when the password is added through conf-mode you can type it as is but when saved in the config its saved as base64 (to be reversible) or such?

Would probably need some prefix similar to how Cisco and others does this.

As in when typing it in the CLI conf-mode you could do:

set system config-management commit-archive password $T3$TP@$$W0^%

or

set system config-management commit-archive password base64 "JFQzJFRQQCQkVzBeJQ=="

where the later one is how both examples will be saved in the config?

For added service when typing just:

set system config-management commit-archive password

and hit enter it could ask the user about the password (and have the user repeat it) and if correct the base64 of that would show up in the config as:

set system config-management commit-archive password base64 "JFQzJFRQQCQkVzBeJQ=="

This way using spaces and other special characters would work without you having to construct that base64 elsewhere.

Thanks for the hints, that makes sense. Let's see how that can be implemented :)

Should be fixed after rewriting commit-archive T6304