Bug 1332892
| Summary: | Automatic provisioning of engine db keeps password in answer file if dwh is installed | |||
|---|---|---|---|---|
| Product: | [oVirt] ovirt-engine-dwh | Reporter: | Yedidyah Bar David <didi> | |
| Component: | Setup | Assignee: | Yedidyah Bar David <didi> | |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Lukas Svaty <lsvaty> | |
| Severity: | high | Docs Contact: | ||
| Priority: | medium | |||
| Version: | 3.6.5 | CC: | bugs, pstehlik, sbonazzo, sradco, ylavi | |
| Target Milestone: | ovirt-4.1.0-alpha | Keywords: | ZStream | |
| Target Release: | 4.1.0 | Flags: | rule-engine:
ovirt-4.1+
rule-engine: planning_ack+ rule-engine: devel_ack+ pstehlik: testing_ack+ |
|
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | integration | |||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | 1133621 | |||
| : | 1351668 (view as bug list) | Environment: | ||
| Last Closed: | 2017-02-01 14:44:18 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | Integration | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1351668, 1361536, 1390631 | |||
|
Description
Yedidyah Bar David
2016-05-04 10:02:33 UTC
This bug happens because the fix [1] wasn't applied to dwh, which had a copy [2] of the relevant part of the code done before the fix was introduced. IMO we should stop duplicating such constants with comments "sync with XXX" without any tool/process to actually sync them. Either move all such constants to common packages that all use and do not need to copy, or create some automatic tool to verify that they are indeed synced. [1] https://gerrit.ovirt.org/#/q/I3fb9d2c10d3809c68430084f6212eaa191d5ca21,n,z [2] https://gerrit.ovirt.org/27516 I'd like to point out that there is no direct security issue here. If a user chooses manual provisioning, and inputs creds, including a password, these creds will be written to the answer file, by design. In the past, the password was always written, but if automatic provisioning was selected, a next run with the generated answer file ignored the password (thus creating a new random one). We then decided to stop ignoring the password, but also do not write it - so that if a user manually edits the answer file to use a specific password, it will be used. The only security issue is that a user might expect to get a newly-generated random password for each run that uses the generated answer file, which is what happens if it was generated with only the engine installed. If DWH is installed too, the file will include the password, so next runs will create a user with the same password. This is easy to notice, and fix, by deleting the relevant line from the answer file. I mainly opened this bug as a reminder to do comment 1 above - stop having duplicate constants scattered around. Doing this is likely to solve more unknown bugs, and preventing future ones. oVirt 4.0 beta has been released, moving to RC milestone. oVirt 4.0 beta has been released, moving to RC milestone. 58918 is for reports, pushed it just in case. Fix is in dwh, moving bug there. tested in ovirt-engine-dwh-setup-4.0.2-1.el7ev.noarch after engine setup with configured answer file with set up password: [root@ls-40 ~]# grep pass /var/lib/ovirt-engine/setup/answers/20160729134536-setup.conf OVESETUP_DWH_DB/password=str:mydbpassword Target release should be placed once a package build is known to fix a issue. Since this bug is not modified, the target version has been reset. Please use target milestone to plan a fix for a oVirt release. (In reply to Lukas Svaty from comment #6) > tested in ovirt-engine-dwh-setup-4.0.2-1.el7ev.noarch > > after engine setup with configured answer file with set up password: > > [root@ls-40 ~]# grep pass > /var/lib/ovirt-engine/setup/answers/20160729134536-setup.conf > OVESETUP_DWH_DB/password=str:mydbpassword Above is indication for bug 1351668, not for current bug. Current bug is about OVESETUP_DB/password. removing blocking tracker for 4.0 as this one is on 4.1 target release verified in ovirt-engine-dwh-setup-4.1.0-1.el7ev.noarch |