Bug 1599633

Summary:	Horizon SECRET_KEY should be 64 charecters as per upstream documentation
Product:	Red Hat OpenStack	Reporter:	Eduard Barrera <ebarrera>
Component:	openstack-tripleo-heat-templates	Assignee:	RHOS Maint <rhos-maint>
Status:	CLOSED ERRATA	QA Contact:	Gurenko Alex <agurenko>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	14.0 (Rocky)	CC:	athomas, jrist, mariel, mburns, mrunge, rdopiera, sbaubeau, scollier, srevivo, tvignaud
Target Milestone:	---	Keywords:	Triaged, ZStream
Target Release:	14.0 (Rocky)
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openstack-tripleo-heat-templates-9.2.1-0.20190119154863.el7ost	Doc Type:	Enhancement
Doc Text:	This enhancement improves security by increasing the auto-generated SECRET_KEY to 64 characters	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-03-18 13:03:09 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Eduard Barrera 2018-07-10 09:02:05 UTC

Description of problem:

Currently horizon SECRET_KEY is 10 characters long:

"""
https://github.com/openstack/tripleo-heat-templates/blob/master/overcloud.j2.yaml#L320

  HorizonSecret:
    type: OS::TripleO::RandomString
    properties:
length: 10
"""

but upstream documentation says that it should be 64:

https://docs.openstack.org/security-guide/dashboard/secret-key.html

"""
The dashboard depends on a shared SECRET_KEY setting for some security functions. The secret key should be a randomly generated string at least 64 characters long, which must be shared across all active dashboard instances. Compromise of this key may allow a remote attacker to execute arbitrary code. Rotating this key invalidates existing user sessions and caching. Do not commit this key to public repositories.
"""


Expected results:


Additional info:

Comment 8 errata-xmlrpc 2019-03-18 13:03:09 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:0446