Description of problem: When the system is binding with CloudForms we are seeing that the password is being logged in plain text. Version-Release number of selected component (if applicable): 5.6.0.6-beta2.5.20160511140943_ff75fb2 How reproducible: always Steps to Reproduce: 1. configure the authentication mode to LDAP 2. Specify BaseDN, Bind DN and Bind Password click validate and save. 3. Observe that in apache/ssl_access.log the password in logged in plain text Actual results: Bind dn Password logged as plain text in apache logs. Expected results: Password needs to be filtered/masked in the logs. Additional info: /var/www/miq/vmdb/log/apache/ssl_access.log: ./apache/ssl_access.log:10.13.129.33 - - [16/May/2016:14:58:37 -0400] "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT> HTTP/1.1" 200 97 ./apache/ssl_access.log:10.13.129.33 - - [16/May/2016:14:58:47 -0400] "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT> HTTP/1.1" 200 97 ./apache/ssl_access.log:10.13.129.33 - - [16/May/2016:14:58:47 -0400] "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT> HTTP/1.1" 200 97 ./apache/ssl_access.log:10.13.129.33 - - [16/May/2016:14:58:48 -0400] "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT> HTTP/1.1" 200 97 ./apache/ssl_access.log:10.13.129.33 - - [16/May/2016:14:58:48 -0400] "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT> HTTP/1.1" 200 97 ./apache/ssl_access.log:10.13.129.33 - - [16/May/2016:14:58:49 -0400] "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT> HTTP/1.1" 200 97 ./apache/ssl_access.log:10.13.129.33 - - [16/May/2016:14:58:49 -0400] "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT> HTTP/1.1" 200 97 ./apache/ssl_access.log:10.13.129.33 - - [16/May/2016:14:58:50 -0400] "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT> HTTP/1.1" 200 97 ./apache/ssl_access.log:10.13.129.33 - - [16/May/2016:14:58:50 -0400] "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT> HTTP/1.1" 200 97 ./apache/ssl_access.log:10.13.129.33 - - [16/May/2016:14:58:51 -0400] "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT> HTTP/1.1" 200 97 ./apache/ssl_access.log:10.13.129.33 - - [16/May/2016:14:58:52 -0400] "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT> HTTP/1.1" 200 97 ./apache/ssl_request.log:[16/May/2016:14:58:37 -0400] 10.13.129.33 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT>HTTP/1.1" 97 ./apache/ssl_request.log:[16/May/2016:14:58:47 -0400] 10.13.129.33 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT> HTTP/1.1" 97 ./apache/ssl_request.log:[16/May/2016:14:58:47 -0400] 10.13.129.33 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT> HTTP/1.1" 97 ./apache/ssl_request.log:[16/May/2016:14:58:48 -0400] 10.13.129.33 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT> HTTP/1.1" 97 ./apache/ssl_request.log:[16/May/2016:14:58:48 -0400] 10.13.129.33 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT> HTTP/1.1" 97 ./apache/ssl_request.log:[16/May/2016:14:58:49 -0400] 10.13.129.33 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT> HTTP/1.1" 97 ./apache/ssl_request.log:[16/May/2016:14:58:49 -0400] 10.13.129.33 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT> HTTP/1.1" 97 ./apache/ssl_request.log:[16/May/2016:14:58:50 -0400] 10.13.129.33 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT> HTTP/1.1" 97 ./apache/ssl_request.log:[16/May/2016:14:58:50 -0400] 10.13.129.33 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT> HTTP/1.1" 97 ./apache/ssl_request.log:[16/May/2016:14:58:51 -0400] 10.13.129.33 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT> HTTP/1.1" 97 ./apache/ssl_request.log:[16/May/2016:14:58:52 -0400] 10.13.129.33 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 "POST /ops/settings_form_field_changed/authentication?authentication_bind_pwd=<PLAIN-TEXT> HTTP/1.1" 97 ./preconfigure-logs/evm.log:[----] I, [2016-05-11T20:18:21.174536 #12260:7af990] INFO -- : :bind_pwd:
It appears the UI is generating the URL with an unencrypted password
https://github.com/ManageIQ/manageiq/pull/8833
verified in 5.6.0.8-rc1.20160524155303_f2a5a50. Issue not reproducible. [root@host-192-168-55-6 log]# grep -i bind_pwd apache/ssl_access.log [root@host-192-168-55-6 log]# Additional logs attached.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2016:1348