| Summary: | trace args debug logging must be more restrictive | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Noriko Hosoi <nhosoi> | |
| Component: | 389-ds-base | Assignee: | Noriko Hosoi <nhosoi> | |
| Status: | CLOSED ERRATA | QA Contact: | Viktor Ashirov <vashirov> | |
| Severity: | urgent | Docs Contact: | ||
| Priority: | urgent | |||
| Version: | 7.3 | CC: | arubin, enewland, mkolaja, mreynolds, msauton, nkinder, rmeggins, spichugi, tlavigne | |
| Target Milestone: | rc | Keywords: | ZStream | |
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | All | |||
| Whiteboard: | ||||
| Fixed In Version: | 389-ds-base-1.3.6.1-3.el7 | Doc Type: | Bug Fix | |
| Doc Text: |
Previously, when the "Trace function calls" option was enabled in the "nsslapd-errorlog-level" parameter, all attributes were logged into the Directory Server's error log file including attributes containing sensitive information. A patch has been applied to filter out values of sensitive attributes. As a result, sensitive information are no longer written to the log files.
|
Story Points: | --- | |
| Clone Of: | ||||
| : | 1390343 (view as bug list) | Environment: | ||
| Last Closed: | 2017-08-01 21:12:24 UTC | Type: | --- | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Bug Depends On: | ||||
| Bug Blocks: | 1390343 | |||
|
Description
Noriko Hosoi
2016-10-21 20:11:38 UTC
GSS Approved Z-Stream Hello Marcel, The devel freeze date for RHEL-7.3.z batch 1 is approaching (November 1). Could you please give an approval and clone this bug for rhel-7.3.z? Thanks! --noriko Build tested: 389-ds-base-1.3.6.1-14.el7.x86_64 Verification steps: [1] Set up MMR. [2] Add a user entry, - uid=tuser,dc=example,dc=com [root@qeos-204 dirsrvtests]# ldapsearch -h localhost -p 39001 -D "cn=directory manager" -w password -b "uid=tuser,dc=example,dc=com" dn: uid=tuser,dc=example,dc=com cn: tuser objectClass: inetorgperson objectClass: organizationalPerson objectClass: person objectClass: top sn: tuser mail: tuser uid: tuser userPassword:: e1NTSEE1MTJ9eHNlaVEwaUtSNVAxVmNYZjltUWNHN1Y2OThWeExpZnFMS0tZM1d STUE4b2M0clZ0NmpJSng2b3h4aVE1cmp0YnNEUEFxSVl0dzJRRk9IUmc5MDRVbE11dVRFd1lQMXJC [3] Enable the trace level error log on both masters. 1 — Trace function calls. Logs a message when the server enters and exits a function. 4 — Heavy trace output debugging. 16384 — default [root@qeos-204 dirsrvtests]# ldapmodify -h localhost -p 39001 -D "cn=directory manager" -w password dn: cn=config changetype: modify replace: nsslapd-errorlog-level nsslapd-errorlog-level: 16389 modifying entry "cn=config" [root@qeos-204 dirsrvtests]# ldapmodify -h localhost -p 39002 -D "cn=directory manager" -w password dn: cn=config changetype: modify replace: nsslapd-errorlog-level nsslapd-errorlog-level: 16389 modifying entry "cn=config" [4] Modify the userPassword of the user entry, uid=tuser,dc=example,dc=com [root@qeos-204 dirsrvtests]# ldapmodify -h localhost -p 39001 -D "cn=directory manager" -w password dn: uid=tuser,dc=example,dc=com changetype: modify delete: userpassword modifying entry "uid=tuser,dc=example,dc=com" dn: uid=tuser,dc=example,dc=com changetype: modify add: userpassword userpassword: newpass modifying entry "uid=tuser,dc=example,dc=com" dn: uid=tuser,dc=example,dc=com changetype: modify replace: userpassword userpassword: newnewpass modifying entry "uid=tuser,dc=example,dc=com" [5] Grep the error log with "unhashed#user#password" as well as the password string. [0 root@qeos-204 upstream]# grep "unhashed#user#password" /var/log/dirsrv/slapd-master_2/errors [21/May/2017:16:39:31.794060320 -0400] - DEBUG - entry_apply_mod_wsi - add: unhashed#user#password [21/May/2017:16:39:41.517960057 -0400] - DEBUG - entry_apply_mod_wsi - replace: unhashed#user#password [0 root@qeos-204 upstream]# grep "unhashed#user#password" /var/log/dirsrv/slapd-master_1/errors [21/May/2017:16:39:32.047200740 -0400] - DEBUG - do_modify - add: unhashed#user#password [21/May/2017:16:39:32.078091921 -0400] - DEBUG - entry_apply_mod_wsi - add: unhashed#user#password [21/May/2017:16:39:41.663889158 -0400] - DEBUG - do_modify - replace: unhashed#user#password [21/May/2017:16:39:41.691572968 -0400] - DEBUG - entry_apply_mod_wsi - replace: unhashed#user#password Results: Plain password value wasn't found in the logs. Marking as verified. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2086 |