Bug 1201586 - Directory Server Admin Console: plaintext password logged in debug mode
Summary: Directory Server Admin Console: plaintext password logged in debug mode
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Directory Server
Classification: Red Hat
Component: Directory Console
Version: 10.0
Hardware: Unspecified
OS: Unspecified
high
medium
Target Milestone: DS10.0
: ---
Assignee: Noriko Hosoi
QA Contact: Viktor Ashirov
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-03-13 01:44 UTC by Viktor Ashirov
Modified: 2020-09-13 21:21 UTC (History)
2 users (show)

Fixed In Version: idm-console-framework-1.1.13-1.el7dsrv
Doc Type: Bug Fix
Doc Text:
Launching redhat-idm-console with the debug option "-D INTEGER" dumps the debug info onto the screen, which includes clear text passwords. The password potion is now masked.
Clone Of:
Environment:
Last Closed: 2015-06-12 01:04:18 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github 389ds 389-ds-base issues 1465 0 None None None 2020-09-13 21:21:59 UTC
Red Hat Product Errata RHBA-2015:1094 0 normal SHIPPED_LIVE Red Hat Directory Server bug fix and enhancement update 2015-06-12 05:02:14 UTC

Description Viktor Ashirov 2015-03-13 01:44:22 UTC
Description of problem:
When the console is running in Debug mode, it logs passwords in plain text when admin logs in console, creates a user with a password, etc.
By default we should mask passwords.

Version-Release number of selected component (if applicable):
idm-console-framework-1.1.9-1.el7dsrv.noarch
redhat-idm-console-10.0.0-1.el7dsrv.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Run redhat-idm-console -D -f console.log 
2. Log in console with your credentials. Open DS console, create a user with a password, change admin password.
3. Check console.log for passwords that were used in [2].

Actual results:
Using console as admin user: 
DSAdmin.initialize(): _removed=false info=ConsoleInfo(rhel7ds.brq.redhat.com, 389, cn=Directory Manager, Secret123, o=NetscapeRoot) _info=null
DSAdmin.select(): _removed=false viewInstance=com.netscape.management.client.topology.TopologyResourcePage[,1,22,1899x923,invalid,layout=java.awt.BorderLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=] _info=ConsoleInfo(rhel7ds.brq.redhat.com, 389, cn=Directory Manager, Secret123, o=NetscapeRoot)
DSAdmin.run: begin for server ConsoleInfo(rhel7ds.brq.redhat.com, 389, cn=Directory Manager, Secret123, dc=example,dc=com)
CGIReportTask.exec(): username=cn=Directory Manager password=Secret123
ReplicationTool.verifyDM: authDN = <cn=Directory Manager>, authPassword = <Secret123>

Creating a user: 
	attributes={userpassword=LDAPAttribute {type='userpassword', values='Secret12345'}, uid=LDAPAttribute {type='uid', values='tuser'}, givenname=LDAPAttribute {type='givenname', values='test'}, objectclass=LDAPAttribute {type='objectclass', values='top,person,organizationalPerson,inetorgperson'}, sn=LDAPAttribute {type='sn', values='user'}, cn=LDAPAttribute {type='cn', values='test user'}}


Expected results:
Passwords should be masked with (preferably) fixed number of symbols such as asterisks, so the length and content of the password would be unknown.

Comment 1 Noriko Hosoi 2015-03-16 18:23:41 UTC
Upstream ticket:
https://fedorahosted.org/389/ticket/48134

Comment 3 Viktor Ashirov 2015-05-14 09:28:12 UTC
Build tested: idm-console-framework-1.1.12-1.el7dsrv.noarch

$ grep Secret123 console.log 
DSAdmin.initialize(): _removed=false info=ConsoleInfo(rhel7ds.brq.redhat.com, 389, cn=Directory ***password***, Secret123, o=NetscapeRoot) _info=null
DSAdmin.select(): _removed=false viewInstance=com.netscape.management.client.topology.TopologyResourcePage[,1,22,1899x923,invalid,layout=java.awt.BorderLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=] _info=ConsoleInfo(rhel7ds.brq.redhat.com, 389, cn=Directory ***password***, Secret123, o=NetscapeRoot)
DSAdmin.run: begin for server ConsoleInfo(rhel7ds.brq.redhat.com, 389, cn=Directory ***password***, Secret123, dc=example,dc=com)

For some reason "Manager" in "cn=Directory Manager" was masked, but not the password.

Comment 4 Noriko Hosoi 2015-05-14 22:36:38 UTC
Thank you for finding this, Viktor.

My bad... I usually login to Console as "admin", which one word.  I stupidly assumed the login user (dn) has no space in it... :p

Comment 5 Viktor Ashirov 2015-05-15 00:05:19 UTC
Build tested: idm-console-framework-1.1.13-1.el7dsrv

$ grep -c Secret123 console.log 
0

Thank you, Noriko, for fixing it so fast :) 
Marking as VERIFIED.

Comment 7 errata-xmlrpc 2015-06-12 01:04:18 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2015:1094


Note You need to log in before you can comment on or make changes to this bug.