Bug 766939

Summary:	security_token.rb should be regenerated on each install
Product:	Red Hat Satellite	Reporter:	Mike McCune <mmccune>
Component:	Packaging	Assignee:	Lukas Zapletal <lzap>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Katello QA List <katello-qa-list>
Severity:	high	Docs Contact:
Priority:	high
Version:	6.0.0	CC:	cwelton, lzap
Target Milestone:	Unspecified	Keywords:	Triaged
Target Release:	Unused
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-08-22 18:13:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	747354

Description Mike McCune 2011-12-12 20:14:35 UTC

copied from AC:

https://www.aeolusproject.org/redmine/issues/2660

This is used to sign session cookies. If all Conductor installations have the same key, it allows an attacker to modify or craft session cookies and then sign them so that the server will trust them.

FWIW, I sent a patch to solve this, but it's sparked some further discussion on the right way to tackle this: https://fedorahosted.org/pipermail/aeolus-devel/2011-October/006010.html


note there is a patch mentioned in above thread:

https://fedorahosted.org/pipermail/aeolus-devel/2011-October/006011.html

Comment 1 Lukas Zapletal 2011-12-13 12:12:27 UTC

I am not big fan of running rake task in the RPM post section. First of all its slow, second it can fail if any of our ruby dependencies does not match version.

So I am adding this:

sed -i "s/^Src::Application.config.secret_token = '.*'/Src::Application.config.secret_token = '$(</dev/urandom tr -dc A-Za-z0-9 | head -c128)'/" config/initializers/secret_token.rb

It also generates BASE64-like string instead of simple hexa string. This is more secure.

Comment 2 Lukas Zapletal 2011-12-13 12:50:44 UTC

1) I can confirm the string does not have to be hexa. It works with any 
(base64 etc) encoded string.

2) Rake use Bundler and we were facing many issues with incorrect 
dependencies (discussed on the ruby sig list). I tend not to use 
Bundler-based things in the RPM postun sections, because even when deps
would be incorrect, I would like to have the RPM to be properly 
installed. Therefore we generate the same using tr and sed tools.

http://git.fedorahosted.org/git/?p=katello.git;a=commitdiff;h=738bf1479390ba3d2df88ba24d43b9fbd118b160

It's also much faster.

3) Since the secret_token file is distributed, MD5 RPM validation fails.
I don't think this is an issue.

$ rpm -qV katello-common
5..T.....    /usr/share/katello/config/initializers/secret_token.rb


738bf14 766939 - security_token.rb should be regenerated on each install

Comment 4 Corey Welton 2012-02-08 14:10:42 UTC

QA Verified that this is getting regenerated.