Bug 1411405

Summary: Harden default permissions on files containing passwords
Product: Red Hat OpenStack Reporter: Nathan Kinder <nkinder>
Component: python-tripleoclientAssignee: RHOS Maint <rhos-maint>
Status: CLOSED ERRATA QA Contact: Prasanth Anbalagan <panbalag>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: unspecifiedCC: alee, dbecker, fduthill, hbrock, jslagle, kbasil, mburns, morazi, rcritten, rhel-osp-director-maint, tvignaud
Target Milestone: Upstream M3Keywords: Triaged
Target Release: 12.0 (Pike)   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: python-tripleoclient-7.1.1-0.20170616130648.6030cd1.el7ost Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-12-13 21:00:46 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Nathan Kinder 2017-01-09 16:12:29 UTC
As a part of investigating bug#1351275, it was noticed that some of the default permissions on files that contain passwords (such as stackrc files) in a Director deployment are more open than they should be.  In particular, in the undercloud node:

/root/stackrc has root/root ownership and 600 permissions
/home/stack/stackrc has stack/stack ownership and 600 permissions
/home/stack/overcloudrc has stack/stack ownership and 664 permissions
/home/stack/undercloud-passwords.conf has stack/stack ownership and 664 permissions.

Items 1 and 2 are ok (600 permissions), but 3 and 4 should be locked down to 600.  This is not a vulnerability since /home/stack defaults to 700 permissions, but it should still be hardened to prevent accidental exposure of passwords if the permissions of /home/stack change in the future.

Comment 1 Rob Crittenden 2017-03-16 17:38:42 UTC
Both reviews have merged in their respective upstreams. Fix for both was to chmod 0600 the files.

This was merged into python-tripleoclient and instack-undercloud.

Comment 7 errata-xmlrpc 2017-12-13 21:00:46 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:3462