Bug 741677

Summary:	ipa-client-install --password=$PASSWORD will cause /var/log/ipaclient-install.log to contain the password.
Product:	Red Hat Enterprise Linux 6	Reporter:	Dmitri Pal <dpal>
Component:	ipa	Assignee:	Rob Crittenden <rcritten>
Status:	CLOSED ERRATA	QA Contact:	IDM QE LIST <seceng-idm-qe-list>
Severity:	unspecified	Docs Contact:
Priority:	high
Version:	6.1	CC:	jgalipea, mkosek, nsoman, rcritten
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-2.1.2-1.el6	Doc Type:	Bug Fix
Doc Text:	Cause: When ipa-client-install is run with --password option containing a bulk password for client enrollment, the password may be printed to IPA client install log in a plain-text format. Consequence: Any user that get access to this fail may read the password Fix: ipa-client-install does not log the bulk enrollment password Result: User with access to the log cannot retrieve the password	Story Points:	---
Clone Of:	739068	Environment:
Last Closed:	2011-12-06 18:32:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	739068
Bug Blocks:

Comment 1 Martin Kosek 2011-09-27 15:36:41 UTC

Fixed upstream:

master: 4487a9564b42cdedf6bb4a84134286a131583494
ipa-2-1: ad37727150abecb19a55fe7ae18bccb3a63052b9

Comment 3 Martin Kosek 2011-11-01 08:34:44 UTC

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause: When ipa-client-install is run with --password option containing a bulk password for client enrollment, the password may be printed to IPA client install log in a plain-text format.
Consequence: Any user that get access to this fail may read the password
Fix: ipa-client-install does not log the bulk enrollment password
Result: User with access to the log cannot retrieve the password

Comment 4 Namita Soman 2011-11-04 14:11:33 UTC

Verified using ipa-client-2.1.3-8.el6.x86_64 & ipa-server-2.1.3-8.el6.x86_64

added client as host, set its otp, then installed using cmd below:
#ipa-client-install --domain=testrelm --realm=TESTRELM --password=1234


ipaclient-install logs have it as:
2011-11-04 09:57:34,793 DEBUG args=/usr/sbin/ipa-join -s ipa-master.testrelm -b dc=testrelm -w XXXXXXXX

But from comments above - this should be verified using 5.7 client. Started beaker job to provision one.

Comment 5 Namita Soman 2011-11-04 15:54:00 UTC

Bug 739068 is for the 5.7 client. will update test results there for 5.7. 
marking this verified for 6.2

Comment 6 errata-xmlrpc 2011-12-06 18:32:51 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2011-1533.html