Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1257613

Summary: When authentication fails, python traceback is in the body of the response
Product: Red Hat Enterprise Linux 7 Reporter: Petr Vobornik <pvoborni>
Component: ipaAssignee: IPA Maintainers <ipa-maint>
Status: CLOSED CURRENTRELEASE QA Contact: Namita Soman <nsoman>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.2CC: ksiddiqu, mkosek, mstuchli, pviktori, rcritten
Target Milestone: rcKeywords: Tracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-09-23 13:46:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1117751    
Bug Blocks:    

Description Petr Vobornik 2015-08-27 12:57:26 UTC 
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/5239

When authentication on /ipa/session/login_password fails due to wrong password, the HTTP response body includes python traceback:

{{{
$ curl -Lksi -d 'user=admin&password=password' https://ipa.example.test/ipa/session/login_password
HTTP/1.1 401 Unauthorized
Date: Thu, 20 Aug 2015 09:01:12 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) mod_auth_gssapi/1.2.0 mod_nss/2.4.6 NSS/3.19.1 Basic ECC mod_wsgi/3.4 Python/2.7.5
X-IPA-Rejection-Reason: invalid-password
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8

<html>
<head>
<title>401 Unauthorized</title>
</head>
<body>
<h1>Invalid Authentication</h1>
<p>
<strong>[Thu Aug 20 05:01:12.231640 2015] [:warn] [pid 11562] mod_wsgi (pid=11562): Callback registration for signal 13 ignored.
[Thu Aug 20 05:01:12.234050 2015] [:warn] [pid 11562]   File "/usr/share/ipa/wsgi.py", line 49, in application
[Thu Aug 20 05:01:12.234069 2015] [:warn] [pid 11562]     return api.Backend.wsgi_dispatch(environ, start_response)
[Thu Aug 20 05:01:12.234077 2015] [:warn] [pid 11562]   File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 258, in __call__
[Thu Aug 20 05:01:12.234083 2015] [:warn] [pid 11562]     return self.route(environ, start_response)
[Thu Aug 20 05:01:12.234090 2015] [:warn] [pid 11562]   File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 270, in route
[Thu Aug 20 05:01:12.234096 2015] [:warn] [pid 11562]     return app(environ, start_response)
[Thu Aug 20 05:01:12.234102 2015] [:warn] [pid 11562]   File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 945, in __call__
[Thu Aug 20 05:01:12.234108 2015] [:warn] [pid 11562]     self.kinit(user, self.api.env.realm, password, ipa_ccache_name)
[Thu Aug 20 05:01:12.234115 2015] [:warn] [pid 11562]   File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 974, in kinit
[Thu Aug 20 05:01:12.234121 2015] [:warn] [pid 11562]     armor_ccache_name=armor_path)
[Thu Aug 20 05:01:12.234128 2015] [:warn] [pid 11562]   File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 1274, in kinit_password
[Thu Aug 20 05:01:12.234133 2015] [:warn] [pid 11562]     raiseonerr=False)
[Thu Aug 20 05:01:12.234140 2015] [:warn] [pid 11562]   File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 345, in run
[Thu Aug 20 05:01:12.234145 2015] [:warn] [pid 11562]     preexec_fn=preexec_fn)
[Thu Aug 20 05:01:12.234152 2015] [:warn] [pid 11562]   File "/usr/lib64/python2.7/subprocess.py", line 711, in __init__
[Thu Aug 20 05:01:12.234158 2015] [:warn] [pid 11562]     errread, errwrite)
[Thu Aug 20 05:01:12.234164 2015] [:warn] [pid 11562]   File "/usr/lib64/python2.7/subprocess.py", line 1279, in _execute_child
[Thu Aug 20 05:01:12.234170 2015] [:warn] [pid 11562]     signal.signal(signal.SIGPIPE, signal.SIG_DFL)
kinit: Preauthentication failed while getting initial credentials
</strong>
</p>
</body>
</html>
}}}

This is with ipa-python-4.2.0-4.el7.x86_64.
Comment 1 Petr Vobornik 2015-08-27 13:24:20 UTC 
This bug is present only in RHEL 7.x and not fedora. The cause of this bug is a combination of BZ 1257613 and WSGIRestrictSignal policy [1].

The reason for the difference is that Python 2.7 in Fedora doesn't contain backport of http://bugs.python.org/issue1652 

Issue in IPA is information leakage. It doesn't cause any functional issues.

Possible options to take:
1. set "WSGIRestrictSignal Off" in ipa.conf
2. "do something" with bug 1257613
3. filter out the traceback from received stderr
4. something different 


[1] https://code.google.com/p/modwsgi/wiki/ConfigurationDirectives#WSGIRestrictSignal
Comment 2 Petr Vobornik 2015-08-27 13:26:17 UTC 
In comment 1 by bug 1257613 I meant bug 1117751.
Comment 5 Petr Vobornik 2015-09-01 08:00:27 UTC 
Note that this affects any subprocess.Popen call which IPA uses in its API.
Comment 7 Martin Kosek 2015-09-23 13:46:04 UTC 
I checked the reproducer with python-2.7.5-33.el7.x86_64 and I no longer see the traceback. I think we can thus simply close the Bugzilla as it should be fixed in 7.2 GA.
Comment 8 Martin Kosek 2015-09-23 13:47:02 UTC 
Just for the record, this is the test output:

# curl -Lksi -d 'user=admin&password=password' https://`hostname`/ipa/session/login_password
HTTP/1.1 401 Unauthorized
Date: Wed, 23 Sep 2015 13:44:44 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) mod_auth_gssapi/1.3.1 mod_nss/2.4.6 NSS/3.19.1 Basic ECC mod_wsgi/3.4 Python/2.7.5
X-IPA-Rejection-Reason: invalid-password
Content-Length: 201
Content-Type: text/html; charset=utf-8

<html>
<head>
<title>401 Unauthorized</title>
</head>
<body>
<h1>Invalid Authentication</h1>
<p>
<strong>kinit: Preauthentication failed while getting initial credentials
</strong>
</p>
</body>
</html>[root@ipa ~]# rpm -q python
python-2.7.5-33.el7.x86_64

# rpm -q ipa-server python
ipa-server-4.2.0-11.el7.x86_64
python-2.7.5-33.el7.x86_64