Bug 1230393

Summary:	katello-installer saves the password in cleartext
Product:	Red Hat Satellite	Reporter:	Alexander Rydekull <arydekul>
Component:	Installation	Assignee:	Chris Roberts <chrobert>
Status:	CLOSED WONTFIX	QA Contact:	Katello QA List <katello-qa-list>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	6.0.8	CC:	bkearney, chrobert, cwelton, inecas, jpazdziora, mmccune, stbenjam
Target Milestone:	Unspecified	Keywords:	ReleaseNotes, Triaged
Target Release:	Unused
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-08-30 13:51:03 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1190823

Description Alexander Rydekull 2015-06-10 19:32:26 UTC

Description of problem:
Passwords should not be saved in cleartext. When you run katello-installer, it saves the cleartext password.

Not only that, every time you run katello-installer successfully after that it gets echoed back. 

Really bad practice.

Version-Release number of selected component (if applicable):
6.0

How reproducible:
Always

Steps to Reproduce:
1. katello-installer --foreman-admin-password=redhat
2. katello-installer --capsule-tftp=true
3. Look at your password being displayed.

Actual results:
You see the password printed in clear text.

Expected results:
The same output, but without the password.


Additional info:

Comment 1 RHEL Program Management 2015-06-10 19:32:35 UTC

Since this issue was entered in Red Hat Bugzilla, the release flag has been
set to ? to ensure that it is properly evaluated for this release.

Comment 3 David O'Brien 2015-08-19 06:20:07 UTC

Is this actually rel note material?
What sort of doc text would be suitable?

thanks

Comment 7 David O'Brien 2016-04-18 00:48:20 UTC

Reset docs contact <> daobrien

Comment 10 Stephen Benjamin 2016-08-19 14:23:39 UTC

Chris, do note the echoing back on subsequent runs is solved already in BZ1125414.  

My personal opinion is WONTFIX on saving in clear text, due to the nature of the installer it'd be quite complicated to avoid this.  Change the password from the default after installation is the only way to avoid the saved password being the correct one. The installer saves a variety of other confidential info too like oauth tokens which are just as useful as the admin password, but all this stuff is only readable by the root user.

Comment 11 Chris Roberts 2016-08-30 13:51:03 UTC

Stephen,

I agree lets close this one out since the subsequent runs is already solved. 

Moving to wontfix based on your suggestions.