Bug 744373
| Summary: | Leaks KDC password and master password via command line arguments | |||
|---|---|---|---|---|
| Product: | [Retired] freeIPA | Reporter: | David <disclosure> | |
| Component: | ipa-server | Assignee: | Rob Crittenden <rcritten> | |
| Status: | CLOSED NEXTRELEASE | QA Contact: | Chandrasekar Kannan <ckannan> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 2.1 | CC: | benl, dpal, jgalipea | |
| Target Milestone: | --- | |||
| Target Release: | --- | |||
| Hardware: | All | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 744422 745580 (view as bug list) | Environment: | ||
| Last Closed: | 2011-10-12 18:39:43 UTC | Type: | --- | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 744422, 745580 | |||
Upstream ticket: https://fedorahosted.org/freeipa/ticket/1948 Fixed upstream master: 0d823ddc4e5fa7f8bdecb590b4ebd129106b063f ipa-2-1: 7a5d906d03af6ee551036a841f71082fc66fa41b |
ipa-server leaks KDC password and master password via command line arguments, in krbinstance.py --> (in both IPAv1 and IPAv2) the following code can be found class KrbInstance(service.Service): ... .. def __create_instance(self, replica=False): self.__template_file("/var/kerberos/krb5kdc/kdc.conf") self.__template_file("/etc/krb5.conf") self.__template_file("/usr/share/ipa/html/krb5.ini") self.__template_file("/usr/share/ipa/html/krb.con") self.__template_file("/usr/share/ipa/html/krbrealm.con") if not replica: #populate the directory with the realm structure args = ["kdb5_ldap_util", "-D", "uid=kdc,cn=sysaccounts,cn=etc,"+self.suffix, "-w", self.kdc_password, "create", "-s", "-P", self.master_password, "-r", self.realm, "-subtrees", self.suffix, "-sscope", "sub"] try: ipautil.run(args, nolog=(self.kdc_password, self.master_password)) except ipautil.CalledProcessError, e: print "Failed to populate the realm structure in kerberos", e so if the code under if not replica: gets executed the kdc_password and master_password will be leaked on the system (one should be able to use ps -ef to view the leaked password information). kdb5_ldap_util recommends against the use of -P and -w. I haven't verified this bug as I do not have a working copy of Fedora or RHEL to test on.