Bug 971235

Summary:	Ovirt log show the SAM ProxyPassword in plaintext
Product:	Red Hat Enterprise Linux 6	Reporter:	wanghui <huiwa>
Component:	ovirt-node	Assignee:	Joey Boggs <jboggs>
Status:	CLOSED ERRATA	QA Contact:	Virtualization Bugs <virt-bugs>
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	6.6	CC:	acathrow, bsarathy, cpelland, cshao, fdeutsch, gouyang, hadong, huiwa, jbiddle, jboggs, leiwang, mburns, ovirt-maint, pmatouse, rbarry, yaniwang, ycui, zdover
Target Milestone:	rc	Keywords:	Regression, ZStream
Target Release:	6.6
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ovirt-node-3.0.1-18.el6_5.1	Doc Type:	Bug Fix
Doc Text:	Previously, the ovirt log showed SAM proxy passwords as plain text. Now, passwords are masked in the log.	Story Points:	---
Clone Of:
Clones:	1064278 (view as bug list)		Environment:
Last Closed:	2014-02-17 14:55:43 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Comment 15 cshao 2014-02-07 06:12:21 UTC

Test version:
rhev-hypervisor6-6.5-20140120.0.auto1032.el6.devel.iso
ovirt-node-3.0.1-999.0.20140205151425git4b2452c.el6.noarch

Test steps:
1. Clear install RHEV-H.
2. Configure network with dhcp.
3. On the Red Hat Network page, regist using "SAM" mode and ProxySever.
4. Check in ovirt-node.log file

Test result:
The password of the ProxyServer show as plaintext. But I met 1051514(ASSIGNED), so I will double check after bug 1051514 is fixed.

========================================================
2014-02-07 06:06:53,746       INFO ['/usr/sbin/subscription-manager', 'register', '--username', 'admin', '--password', 'XXXXXXX', '--proxyuser', 'Rhevh', '--proxypassword', 'XXXXXXX', '--force', '--autosubscribe']

Comment 16 Fabian Deutsch 2014-02-08 12:51:47 UTC

Chen,

(In reply to shaochen from comment #15)
...
> Test result:
> The password of the ProxyServer show as plaintext. But I met
                                  ^^^^^^^^^^^^^^^^^
Do you actually mean here that it is NOT shown as plaintext?

> 1051514(ASSIGNED), so I will double check after bug 1051514 is fixed.
>
> ========================================================
> 2014-02-07 06:06:53,746       INFO ['/usr/sbin/subscription-manager',
> 'register', '--username', 'admin', '--password', 'XXXXXXX', '--proxyuser',
> 'Rhevh', '--proxypassword', 'XXXXXXX', '--force', '--autosubscribe']

Comment 17 cshao 2014-02-10 02:34:09 UTC

(In reply to Fabian Deutsch from comment #16)
> Chen,
> 
> (In reply to shaochen from comment #15)
> ...
> > Test result:
> > The password of the ProxyServer show as plaintext. But I met
>                                   ^^^^^^^^^^^^^^^^^
> Do you actually mean here that it is NOT shown as plaintext?

Oh, it is a typo, the password of proxy show as 'XXXXXXX' but not plaintext. so the bug is fixed with rhev-hypervisor6-6.5-20140120.0.auto1032.el6.devel.iso.

> 
> > 1051514(ASSIGNED), so I will double check after bug 1051514 is fixed.
> >
> > ========================================================
> > 2014-02-07 06:06:53,746       INFO ['/usr/sbin/subscription-manager',
> > 'register', '--username', 'admin', '--password', 'XXXXXXX', '--proxyuser',
> > 'Rhevh', '--proxypassword', 'XXXXXXX', '--force', '--autosubscribe']

Comment 20 wanghui 2014-02-12 06:03:30 UTC

Test version:
rhevh-6.5-20140211.1.iso
ovirt-node-3.0.1-18.el6_5.4.noarch

Test step:
1. Clear install RHEV-H.
2. Configure network with dhcp.
3. On the Red Hat Network page, regist using "Subscription Asset Manager" mode and ProxySever.
4. Check in ovirt.log, ovirt-node.log,rhsm.log file.

Test result:
1. After step4, it only save the register detail info in ovirt-node.log as the follows.
==============================================================================
2014-02-12 05:54:53,534       INFO ['subscription-manager', 'config', '--server.proxy_password', 'XXXXXXX']
2014-02-12 05:54:53,708       INFO Registering to RHN account.....
2014-02-12 05:54:53,720       INFO ['/usr/sbin/subscription-manager', 'register', '--username', 'admin', '--password', 'XXXXXXX', '--name', 'huiwa-test-2', '--proxyuser', 'rhevh', '--proxypassword', 'XXXXXXX', '--force', '--autosubscribe']
==============================================================================

So this bug is fixed in ovirt-node-3.0.1-18.el6_5.4.noarch. It now saves the proxypasword as "XXXXXXX".

I will change the status to Verified when the status is ON_QA.

Thanks
Hui Wang

Comment 21 wanghui 2014-02-14 02:40:22 UTC

Test version:
rhev-hypervisor6-6.5-20140212.1.el6ev.noarch.rpm
ovirt-node-3.0.1-18.el6_5.6.noarch

Test step:
1. Clear install RHEV-H.
2. Configure network with dhcp.
3. On the Red Hat Network page, regist using "Subscription Asset Manager" mode and ProxySever.
4. Check in ovirt.log, ovirt-node.log,rhsm.log file.

Test result:
1. After step4, it only save the register detail info in ovirt-node.log as the follows.
==============================================================================
2014-02-14 02:33:13,430       INFO ['subscription-manager', 'config', '--server.proxy_password', 'XXXXXXX']
2014-02-14 02:33:13,611       INFO Registering to RHN account.....
2014-02-14 02:33:13,623       INFO ['/usr/sbin/subscription-manager', 'register', '--username', 'admin', '--password', 'XXXXXXX', '--name', 'test', '--proxyuser', 'rhevh', '--proxypassword', 'XXXXXXX', '--force', '--autosubscribe']
==============================================================================

So this bug is fixed in ovirt-node-3.0.1-18.el6_5.6.noarch. It now saves the proxypasword as "XXXXXXX".Change the status from ON_QA to Verified.

Comment 23 errata-xmlrpc 2014-02-17 14:55:43 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-0182.html