Bug 1061365

Summary:	NetworkManager-ssh exposes ssh credentials via /proc
Product:	[Fedora] Fedora	Reporter:	Martin Cermak <mcermak>
Component:	NetworkManager-ssh	Assignee:	Dan Fruehauf <malkodan>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	20	CC:	echevemaster, jklimes, malkodan, psimerda
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:	NetworkManager-ssh-0.9.2-0.2.20140209git46247c2.fc20	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-03-15 15:05:31 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Martin Cermak 2014-02-04 17:11:26 UTC

NetworkManager-ssh calls sshpass with the -p swich exposing the password via /proc. Verified using systemtap. Man sshpass reads: The -p option should be considered the least secure of all of sshpass's options. The sshpass itself was packaged primarily for QA purposes with no security impact.

Comment 1 Dan Fruehauf 2014-02-04 21:05:46 UTC

(In reply to Martin Cermak from comment #0)
> NetworkManager-ssh calls sshpass with the -p swich exposing the password via
> /proc. Verified using systemtap. Man sshpass reads: The -p option should be
> considered the least secure of all of sshpass's options. The sshpass itself
> was packaged primarily for QA purposes with no security impact.

Martin, thanks for that. I already had a bug for that upstream:
https://github.com/danfruehauf/NetworkManager-ssh/issues/27

I just have to get to it (hopefully soon).

Comment 2 Fedora Update System 2014-02-09 11:28:45 UTC

NetworkManager-ssh-0.9.2-0.2.20140209git46247c2.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/NetworkManager-ssh-0.9.2-0.2.20140209git46247c2.fc20

Comment 3 Fedora Update System 2014-02-10 03:13:58 UTC

Package NetworkManager-ssh-0.9.2-0.2.20140209git46247c2.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing NetworkManager-ssh-0.9.2-0.2.20140209git46247c2.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-2221/NetworkManager-ssh-0.9.2-0.2.20140209git46247c2.fc20
then log in and leave karma (feedback).

Comment 4 Fedora Update System 2014-03-15 15:05:31 UTC

NetworkManager-ssh-0.9.2-0.2.20140209git46247c2.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.