CONDOR_CHECK_PASSWORD(1)

📦
version 25.12.2 · 8 versions
, in ubuntu stonking

💖 CONDOR_CHECK_PASSWORD 💖

okay bestie, gather round, because we're talking about condor_check_password — a lil HTCondor manual page that's here to snoop through your key files and find the ones that old-school HTCondor versions will NOT fully read. yes, it's giving security audit but make it cute. 🕵️‍♀️✨

🎀 NAME 🎀

condor_check_password — the HTCondor tool that examines your key files and sniffs out any keys that previous versions of HTCondor won't fully read. no cap, that's literally her whole job. 💅

🌸 SYNOPSIS 🌸

condor_check_password <-h | --help>

condor_check_password [--truncate] [key]

🦋 DESCRIPTION 🦋

so here's the tea, bestie. 📖 every version of HTCondor before 8.9.12 had a bug in the code that reads the pool password (which is lowkey why this tool is even named condor_check_password, iykyk). in some cases, the read would get truncated before the end of the file — like it just stopped reading partway through and called it a day. 😭

and here's the plot twist: the exact same code is used to read IDTOKENS signing keys, so this bug? yeah, it affects the IDTOKENS authorization method too. the drama is real. 💀

there was no backwards-compatible fix for this. nope, not even a lil one. versions 8.9.12 and later may read the same file differently than earlier versions do — which means tokens issued before 8.9.12 may not be recognized by later versions. iconic in the worst way, honestly. 🙈

what this tool does is detect key files which will not be fully read by earlier versions of HTCondor. IDTOKENS generated by such a key will not be accepted by later versions (the ones that read the whole key file, bestie, the thorough ones).

now, if you choose to truncate these files on disk, later versions of HTCondor will read only the same bits as earlier versions — so they'll accept tokens issued by earlier versions. slay, right? ✨ but wait, there's a catch, and it's a big one:

at the cost of weakening your pool's resistance to brute-force attacks. 💀 be so fr, read that again before you start truncating things.

by default, this tool checks all the key files that will be found by the current HTCondor configuration. 🫶 or, if you're feeling picky, you can specify a specific key or keys to check instead. your call, main character. 👑

✨ OPTIONS ✨

  • -h, --help — prints a usage reminder. that's it, that's the whole vibe. short, sweet, helpful. 🎀
  • --truncate — when a potentially insecure key is encountered, it truncates it to match the behavior prior to version 8.9.12. (remember that brute-force caveat up there? yeah. bestie. be careful. 🫣)

👑 EXIT STATUS 👑

  • exits with code 0 if there were no signing keys to check, or if all of the checked keys were OK. we love a clean bill of health. 💖
  • exits with code 1 if at least one checked key was not OK. not me getting a 1... 😭
  • exits non-zero if a problem was encountered along the way. like, a different problem. a journey problem. 💀

🧚 AUTHOR 🧚

HTCondor Team — the ones who made this whole thing happen. give them their flowers. 💐

1990-2026, Center for High Throughput Computing, Computer Sciences Department, University of Wisconsin-Madison, Madison, WI, US. Licensed under the Apache License, Version 2.0. legal slay, fr fr. ⭐

and that's a wrap on condor_check_password, bestie!! 🫶 this lil cutie is from the HTCondor Manual, dated Jul 26, 2026, so go forth, check your keys, and remember: truncate responsibly. 💜✨

📦 where this page comes from