Hide Forgot
Description of problem: When user uses weak password like 'dump', 'Environment', 'engine' for database role or engine admin, in setup log all occurrence (even if it's not a password) are substituted with **FILTERED**. The password then can be guessed. based on https://bugzilla.redhat.com/show_bug.cgi?id=1105507#c2 I run into this problem when I wanted to install engine on remote DB server and the engine-setup says ATTENTION Manual action required. Please create database for ovirt-engine use. Use the following commands as an example: create role engine with login encrypted password 'engine'; so I copied the statement and run it in psql. Then I had in log something like this: 2016-10-13 09:38:17 DEBUG otopi.context context._executeMethod:128 Stage setup METHOD otopi.plugins.ovirt_**FILTERED**_common.ovirt_**FILTERED**_dwh.core.misc.Plugin._setup 2016-10-13 09:38:17 DEBUG otopi.plugins.ovirt_**FILTERED**_common.ovirt_**FILTERED**_dwh.core.misc misc._setup:65 dwh version: ovirt-**FILTERED**-dwh-4.0.2 (4.0.2) 2016-10-13 09:38:17 DEBUG otopi.context context.dumpEnvironment:760 ENVIRONMENT DUMP - BEGIN 2016-10-13 09:38:17 DEBUG otopi.context context.dumpEnvironment:770 ENV OVESETUP_CORE/setupAttributesModules=list:'[<module 'ovirt_**FILTERED**_setup.constants' from '/usr/share/ovirt-**FILTERED**/setup/ovirt_**FILTERED**_setup/constants.pyc'>, <module 'ovirt_**FILTERED**_setup.**FILTERED**.constants' from '/usr/share/ovirt-**FILTERED**/setup/ovirt_**FILTERED**_setup/**FILTERED**/constants.pyc'>, <module 'ovirt_**FILTERED**_setup.**FILTERED**_common.constants' from '/usr/share/ovirt-**FILTERED**/setup/ovirt_**FILTERED**_setup/**FILTERED**_common/constants.pyc'>, <module 'ovirt_**FILTERED**_setup.dwh.constants' from '/usr/share/ovirt-**FILTERED**/setup/ovirt_**FILTERED**_setup/dwh/constants.pyc'>]' Closing this as WONTFIX because the logs can see only root is not a solution. Why then are the passwords filtered at all? Version-Release number of selected component (if applicable): otopi-1.5.2-1.el7ev.noarch Actual results: all occurrence of the string is substituted Expected results: engine-setup doesn't allow passwords that can match some words
(In reply to Lucie Leistnerova from comment #0) > Actual results: all occurrence of the string is substituted > > Expected results: engine-setup doesn't allow passwords that can match some > words 1. These two are not contradicting. You can, if you wish, require both "Only occurrences of passwords as such should be substituted" and your current expected results. Already discussed in the linked bug 1105507. 2. engine-setup currently already emits: [WARNING] Password is weak: {reason} Did you get such a warning? If not, that might be a bug. 3. If you did, do you really claim we should forbid such passwords, instead of just warn against them? If so, then I personally disagree - I think we should not police our users, the warning should really be enough. 4. If you are disturbed by this for your own use, and/or want a simple recommendation you can give others, then I suggest this: for real production use, use a real password. For testing/etc., where security is not important, still use something unlikely to appear in the logs. E.g. instead of 'engine', use 'engine123' (and don't use this for other things, such as your hostname :-)). Bottom line: I suggest to close wontfix. If you disagree, please get PM agreement. Thanks!
Closing wontfix according to comment #1 and email discussion.
Warning for weak password is shown by engine-setup for the admin password, so that's OK. If you enter credentials for remote databases there is no such warning.
(In reply to Lucie Leistnerova from comment #3) > Warning for weak password is shown by engine-setup for the admin password, > so that's OK. If you enter credentials for remote databases there is no such > warning. Dropping the suggestion to use engine as password in this case
(In reply to Sandro Bonazzola from comment #4) > (In reply to Lucie Leistnerova from comment #3) > > Warning for weak password is shown by engine-setup for the admin password, > > so that's OK. If you enter credentials for remote databases there is no such > > warning. > > Dropping the suggestion to use engine as password in this case Changing summary line accordingly.
text in engine-setup for remote DB is OK verified in ovirt-engine-4.1.0-0.2.master.20161204231323.gite9669ad.el7.centos.noarch