As a part of investigating bug#1351275, it was noticed that some of the default permissions on files that contain passwords (such as stackrc files) in a Director deployment are more open than they should be. In particular, in the undercloud node:
/root/stackrc has root/root ownership and 600 permissions
/home/stack/stackrc has stack/stack ownership and 600 permissions
/home/stack/overcloudrc has stack/stack ownership and 664 permissions
/home/stack/undercloud-passwords.conf has stack/stack ownership and 664 permissions.
Items 1 and 2 are ok (600 permissions), but 3 and 4 should be locked down to 600. This is not a vulnerability since /home/stack defaults to 700 permissions, but it should still be hardened to prevent accidental exposure of passwords if the permissions of /home/stack change in the future.
Both reviews have merged in their respective upstreams. Fix for both was to chmod 0600 the files.
This was merged into python-tripleoclient and instack-undercloud.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHEA-2017:3462