Bug 781505
| Summary: | Pulp's api is left open on an installed system with default username and password | ||
|---|---|---|---|
| Product: | Red Hat Satellite | Reporter: | Justin Sherrill <jsherril> |
| Component: | API | Assignee: | Lukas Zapletal <lzap> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Garik Khachikyan <gkhachik> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.0.0 | CC: | bkearney, gkhachik, hbrock, jason.dobies, mkoci |
| Target Milestone: | Unspecified | Keywords: | Triaged |
| Target Release: | Unused | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2012-08-22 18:19:35 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 747354 | ||
|
Description
Justin Sherrill
2012-01-13 15:54:13 UTC
I'm not sure I follow. We have the following web apps: /pulp/api - Our REST APIs, used for doing anything to Pulp. That uses the admin username/password. /pulp/repos - Just the yum repositories exposed by Pulp. Open to the world unless you're using Pulp's repo authentication. /pulp/gpg - Holds GPG keys for its repositories. 99% sure this is open to the world. /pulp/ks - Exposes full base channels for those that have a kickstart tree contained within, needed so we can have it over HTTP (not HTTPS) since kickstart has problems with HTTPS. There is no security on these repositories, they are public to anyone (I mention this also as an FYI in case you never knew and thought this was an issue). We can't shut off /pulp/api because, well, you won't be able to do anything to Pulp if we do. I'd suggest changing the password as part of the Katello installation process. I have no idea what the Katello installer does, but at some point I'm guessing it does a sanity check to make sure Pulp is running (we have a ping service). I'd add in a call there to generate a random password and use the Pulp APIs to change it. For what it's worth, here's how RHUI handles it (admittedly, not a perfect comparison): - We tell users the default user is admin/admin - When they start the RHUI Manager and are prompted for that, we warn them they will likely want to change that - RHUI Manager uses the Pulp APIs to change the password to one provided by the user If I'm totally missing what you're getting at with this bug, ping me and we can chat about it. So this bug deals more with a katello's installation and configuration of pulp than pulp itself. We dont' want to 'turn off' /api either since katello needs it. Ideally since initially katello and pulp are all on the same box we dissallow access to /api from anything but localhost. Although since pulp requires SSL that depends on the hostname, i'm guessing that wouldn't work.... My point is that /api isn't needed by anything outside of the box that katello is running in, so in addition to changing the username, we should block that off (since any service that isn't needed remotely should not be accessible remotely). For V1, at a minimum we should change the password, ideally it wouldn't be accessible externally. Randomizing the password. 4cca4df 781505 - randomize default admin password for Pulp Also creating low priority bug for Pulp to disable user authentication. Katello does not need it and it could improve security: https://bugzilla.redhat.com/show_bug.cgi?id=798219 Lukas, any scenario that could prove the bug-fix please? is it enough trying access curl -sk -uadmin:admin https://`hostname`/pulp/api/users and get rejected there? Yeah you can do that or yum install pulp-admin adn then: pulp-admin auth login --username .... --pass ... Should fail now with admin/admin. # VERIFIED
great! doing:
> pulp-admin auth login --username admin --password admin
error: operation failed: Invalid username or password
and all katello actions related with pulp still continue working fine, (promotions, sync, etc).
So seems we are protected now better :)
check against recent provided beta of CFSE.
|