Bug 1256853
| Summary: | Clear text passwords in KRA install log | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Petr Vobornik <pvoborni> |
| Component: | ipa | Assignee: | IPA Maintainers <ipa-maint> |
| Status: | CLOSED ERRATA | QA Contact: | Namita Soman <nsoman> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.2 | CC: | edewata, ksiddiqu, pvoborni, rcritten, spoore |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | ipa-4.2.0-7.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-11-19 12:06:00 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Petr Vobornik
2015-08-25 15:24:03 UTC
Fixed upstream master: https://fedorahosted.org/freeipa/changeset/8676364ae8260a5894b0b0c2af8e81b10aeaba6b ipa-4-2: https://fedorahosted.org/freeipa/changeset/4e474c5a20b91d4eed75f514f801b40f1f291e65 Petr,
How can I confirm this?
I don't see a pki command similar to what's in the patches.
This is all I see:
[root@master log]# strings /var/log/ipaserver-kra-install.log|grep /usr/bin/pki
2015-08-27T21:02:20Z DEBUG args='/usr/bin/pki' '-d' '/etc/httpd/alias' '-C' '/etc/httpd/alias/pwdfile.txt' 'client-cert-show' 'ipaCert' '--client-cert' '/etc/httpd/alias/kra-agent.pem'
I do though see them in the pki-spawn logs:
[root@master pki]# grep /root/.dogtag/pki-tomcat/kra/password.conf pki-kra-spawn.20150827160105.log
'pki_client_password_conf': '/root/.dogtag/pki-tomcat/kra/password.conf',
2015-08-27 16:01:07 pkispawn : INFO ....... modifying '/root/.dogtag/pki-tomcat/kra/password.conf'
2015-08-27 16:01:07 pkispawn : DEBUG ........... chmod 660 /root/.dogtag/pki-tomcat/kra/password.conf
2015-08-27 16:01:07 pkispawn : DEBUG ........... chown 0:0 /root/.dogtag/pki-tomcat/kra/password.conf
2015-08-27 16:01:07 pkispawn : INFO ....... executing 'certutil -N -d /tmp/tmp-ZQWfT0 -f /root/.dogtag/pki-tomcat/kra/password.conf'
'pki_client_password_conf': '/root/.dogtag/pki-tomcat/kra/password.conf',
[root@master pki]# grep /root/.dogtag/pki-tomcat/kra/pkcs12_password.conf pki-kra-spawn.20150827160105.log
'pki_client_pkcs12_password_conf': '/root/.dogtag/pki-tomcat/kra/pkcs12_password.conf',
2015-08-27 16:01:07 pkispawn : INFO ....... modifying '/root/.dogtag/pki-tomcat/kra/pkcs12_password.conf'
2015-08-27 16:01:07 pkispawn : DEBUG ........... chmod 660 /root/.dogtag/pki-tomcat/kra/pkcs12_password.conf
2015-08-27 16:01:07 pkispawn : DEBUG ........... chown 17:17 /root/.dogtag/pki-tomcat/kra/pkcs12_password.conf
'pki_client_pkcs12_password_conf': '/root/.dogtag/pki-tomcat/kra/pkcs12_password.conf',
Is that all I should expect to see? Where/how was the password showing up? I'd like to eliminate that as a possiblility.
Thanks,
Scott
Before the fix there were several pki tool invocations with "-c <clear text password>" in ipaserver-kra-install.log (not pkispawn log). The fix replaces those invocations with "-C <password file>". Please note that this particular line is not affected by the fix because it's already using a password file: 2015-08-27T21:02:20Z DEBUG args='/usr/bin/pki' '-d' '/etc/httpd/alias' '-C' '/etc/httpd/alias/pwdfile.txt' 'client-cert-show' 'ipaCert' '--client-cert' '/etc/httpd/alias/kra-agent.pem' Also note that in bug #1258964 the other pki tool invocations will be replaced with direct LDAP modifications. To verify the fix you probably can execute this line instead: # strings /var/log/ipaserver-kra-install.log | grep <clear text password> Verified. Version :: ipa-server-4.2.0-8.el7.x86_64 Results :: [root@master log]# strings /var/log/ipaserver-kra-install.log | grep Secret123 [root@master log]# [root@master pki]# grep Secret123 pki-kra-spawn.* [root@master pki]# pwd /var/log/pki Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-2362.html |