Bug 1174458
Summary: | Trusted Forest bind_pwd is logged in clear text | ||||||
---|---|---|---|---|---|---|---|
Product: | Red Hat CloudForms Management Engine | Reporter: | Josh Carter <jocarter> | ||||
Component: | Appliance | Assignee: | abellott | ||||
Status: | CLOSED ERRATA | QA Contact: | Kyrylo Zvyagintsev <kzvyahin> | ||||
Severity: | medium | Docs Contact: | |||||
Priority: | low | ||||||
Version: | 5.3.0 | CC: | cpelland, jhardy, jocarter, kzvyahin, mfalesni, mfeifer, snansi, xlecauch | ||||
Target Milestone: | GA | ||||||
Target Release: | 5.5.0 | ||||||
Hardware: | All | ||||||
OS: | All | ||||||
Whiteboard: | |||||||
Fixed In Version: | 5.5.0.1 | Doc Type: | Bug Fix | ||||
Doc Text: |
In the previous version of CloudForms Management Engine, the password of the administrative user used to setup a trusted Active Directory forest would be logged to the evm log when saving the settings for the trust. This bug was a result of faulty programming logic, and was fixed by correcting the code. The administrative user's password is no longer logged when setting up a trusted Active Directory forest in the new version of CloudForms Management Engine.
|
Story Points: | --- | ||||
Clone Of: | Environment: | ||||||
Last Closed: | 2015-12-08 13:01:44 UTC | Type: | Bug | ||||
Regression: | --- | Mount Type: | --- | ||||
Documentation: | --- | CRM: | |||||
Verified Versions: | Category: | --- | |||||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
Cloudforms Team: | --- | Target Upstream Version: | |||||
Embargoed: | |||||||
Attachments: |
|
Description
Josh Carter
2014-12-15 21:22:34 UTC
Ok, I've tried with a 5.4 build 25. With both Role settings as well as adding a trusted forest, the password look filtered in the log, i.e. (bind_pwd shown as [*] and [FILTERED]). Josh, please retest with latest 5.4 when you get a chance and update the ticket accordingly. Thanks. This still is a issue on the current release. [----] I, [2015-07-21T15:05:26.013679 #977:8f1eac] INFO -- : <AuditSuccess> MIQ(Common.settings_update_save) userid: [admin] - VMDB config updated (user_proxies:[[{}]] to [[{:ldaphost=>"ad.example2.com", :ldapport=>"389", :basedn=>"dc=example2,dc=com", :bind_dn=>"joe", :bind_pwd=>"smartvm1"}]]) rpm -qa | grep cfme cfme-lib-5.4.0.5-1.el6cf.x86_64 mingw32-cfme-host-5.3.4.2-1.el6cf.x86_64 cfme-gemset-5.4.0.5-1.el6cf.x86_64 cfme-5.4.0.5-1.el6cf.x86_64 cfme-appliance-5.4.0.5-1.el6cf.x86_64 attached is a screen shot of the configuration. Password being logged in clear text is for the Trusted forest AD example2.com Created attachment 1054498 [details]
config
New commit detected on manageiq/master: https://github.com/ManageIQ/manageiq/commit/b597127dc95e71032c694f22fccf66a973a35944 commit b597127dc95e71032c694f22fccf66a973a35944 Author: Alberto Bellotti <abellott> AuthorDate: Tue Aug 18 09:40:50 2015 -0400 Commit: Alberto Bellotti <abellott> CommitDate: Wed Aug 19 19:01:45 2015 -0400 Fixes issue where password are logged with Audit events. When updating Trusted forest, the bind_pwd gets logged in clear text. The faulty logic was in build_audit_msg, where config data of array type wasn't being traversed. Leveraging the Rails ParameterFilter to do the magic for us. https://bugzilla.redhat.com/show_bug.cgi?id=1174458 app/controllers/application_controller.rb | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) New commit detected on manageiq/master: https://github.com/ManageIQ/manageiq/commit/d3102243c938968bb8332ef0101621af904d412a commit d3102243c938968bb8332ef0101621af904d412a Author: Alberto Bellotti <abellott> AuthorDate: Fri Aug 21 16:51:14 2015 -0400 Commit: Alberto Bellotti <abellott> CommitDate: Fri Aug 21 16:52:26 2015 -0400 PR Review Update Adding rspec for testing password filtering in config arrays. https://bugzilla.redhat.com/show_bug.cgi?id=1174458 spec/controllers/application_controller/build_audit_spec.rb | 9 +++++++++ 1 file changed, 9 insertions(+) Checked in the upstream appliance 2015-08-31 Excerpt from the log: [----] I, [2015-09-11T10:24:20.300659 #2884:f3398c] INFO -- : <AuditSuccess> MIQ(Common.settings_update_save) userid: [admin] - VMDB config updated (basedn:[] to [XXXXXXXX], bind_dn:[] to [XXXXXXXX], bind_pwd:[*] to [*], ldaphost:[[]] to [["XXXXXXXXXX"]], mode:[database] to [ldap], user_suffix:[] to [XXXXXXXXXX], ldap_role:[false] to [true], user_proxies:[[{}]] to [[{:ldaphost=>"asdfadsf", :ldapport=>"389", :basedn=>"ssd", :bind_dn=>"asdf", :bind_pwd=>"[FILTERED]"}]]) Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2015:2551 |