It was discovered that openstack-puppet-modules as used by the Red Hat Enterprise Linux OpenStack Platform Installers would always use the default password of "CHANGEME" when deploying pcsd in HA environments.
Created pcs tracking bugs for this issue: Affects: fedora-all [bug 1201884]
*** Bug 1200322 has been marked as a duplicate of this bug. ***
The password in the module [1] is just a default that is should to be set by the puppet manifest (for example staypuft manifests) that uses the module. For example: class{ 'pacemaker': hacluster_pwd => 'newpassord' } Is there anything that you think it should be done at this level? [1] https://github.com/redhat-openstack/puppet-pacemaker/blob/master/manifests/params.pp#L3
the version of pacemaker we're currently using always use the default password, we have to bump the pacemaker module to this commit: https://github.com/radez/puppet-pacemaker/blob/5d91343c80f65b64be604f4a61558ff408c0f863/manifests/corosync.pp#L56
(In reply to Ivan Chavero from comment #4) > the version of pacemaker we're currently using always use the default > password, we have to bump the pacemaker module to this commit: > https://github.com/radez/puppet-pacemaker/blob/ > 5d91343c80f65b64be604f4a61558ff408c0f863/manifests/corosync.pp#L56 Thanks Ivan. Please leave this bug as NEW and work in the product specific trackers.
Acknowledgements: This issue was discovered by Alessandro Vozza of Red Hat.
Statement: Red Hat Product Security has rated this issue as having Important security impact, a future update will address the flaw. As a mitigation against this issue, any system deployed using the affected component should have the 'hacluster' password changed before being placed into production or on an untrusted network. An article with more detailed information is available to customers here: https://access.redhat.com/articles/1396123
This issue has been addressed in the following products: Openstack 6 Installer for RHEL 7 Via RHSA-2015:0791 https://rhn.redhat.com/errata/RHSA-2015-0791.html
This issue has been addressed in the following products: OpenStack 6 for RHEL 7 Via RHSA-2015:0789 https://rhn.redhat.com/errata/RHSA-2015-0789.html
This issue has been addressed in the following products: OpenStack Foreman for RHEL 6 Via RHSA-2015:0830 https://rhn.redhat.com/errata/RHSA-2015-0830.html
This issue has been addressed in the following products: OpenStack 5 for RHEL 6 Via RHSA-2015:0832 https://rhn.redhat.com/errata/RHSA-2015-0832.html
This issue has been addressed in the following products: OpenStack 5 for RHEL 7 Via RHSA-2015:0831 https://rhn.redhat.com/errata/RHSA-2015-0831.html