Hide Forgot
If the logging level is set to debugging args the full mod apreations are logged, including prehashed data. This is only accessible in the error log, and cannot be triggered or used by an external client, but should be hardended
GSS Approved Z-Stream
Hello Marcel, The devel freeze date for RHEL-7.3.z batch 1 is approaching (November 1). Could you please give an approval and clone this bug for rhel-7.3.z? Thanks! --noriko
https://pagure.io/389-ds-base/issue/49009
Build tested: 389-ds-base-1.3.6.1-14.el7.x86_64 Verification steps: [1] Set up MMR. [2] Add a user entry, - uid=tuser,dc=example,dc=com [root@qeos-204 dirsrvtests]# ldapsearch -h localhost -p 39001 -D "cn=directory manager" -w password -b "uid=tuser,dc=example,dc=com" dn: uid=tuser,dc=example,dc=com cn: tuser objectClass: inetorgperson objectClass: organizationalPerson objectClass: person objectClass: top sn: tuser mail: tuser uid: tuser userPassword:: e1NTSEE1MTJ9eHNlaVEwaUtSNVAxVmNYZjltUWNHN1Y2OThWeExpZnFMS0tZM1d STUE4b2M0clZ0NmpJSng2b3h4aVE1cmp0YnNEUEFxSVl0dzJRRk9IUmc5MDRVbE11dVRFd1lQMXJC [3] Enable the trace level error log on both masters. 1 — Trace function calls. Logs a message when the server enters and exits a function. 4 — Heavy trace output debugging. 16384 — default [root@qeos-204 dirsrvtests]# ldapmodify -h localhost -p 39001 -D "cn=directory manager" -w password dn: cn=config changetype: modify replace: nsslapd-errorlog-level nsslapd-errorlog-level: 16389 modifying entry "cn=config" [root@qeos-204 dirsrvtests]# ldapmodify -h localhost -p 39002 -D "cn=directory manager" -w password dn: cn=config changetype: modify replace: nsslapd-errorlog-level nsslapd-errorlog-level: 16389 modifying entry "cn=config" [4] Modify the userPassword of the user entry, uid=tuser,dc=example,dc=com [root@qeos-204 dirsrvtests]# ldapmodify -h localhost -p 39001 -D "cn=directory manager" -w password dn: uid=tuser,dc=example,dc=com changetype: modify delete: userpassword modifying entry "uid=tuser,dc=example,dc=com" dn: uid=tuser,dc=example,dc=com changetype: modify add: userpassword userpassword: newpass modifying entry "uid=tuser,dc=example,dc=com" dn: uid=tuser,dc=example,dc=com changetype: modify replace: userpassword userpassword: newnewpass modifying entry "uid=tuser,dc=example,dc=com" [5] Grep the error log with "unhashed#user#password" as well as the password string. [0 root@qeos-204 upstream]# grep "unhashed#user#password" /var/log/dirsrv/slapd-master_2/errors [21/May/2017:16:39:31.794060320 -0400] - DEBUG - entry_apply_mod_wsi - add: unhashed#user#password [21/May/2017:16:39:41.517960057 -0400] - DEBUG - entry_apply_mod_wsi - replace: unhashed#user#password [0 root@qeos-204 upstream]# grep "unhashed#user#password" /var/log/dirsrv/slapd-master_1/errors [21/May/2017:16:39:32.047200740 -0400] - DEBUG - do_modify - add: unhashed#user#password [21/May/2017:16:39:32.078091921 -0400] - DEBUG - entry_apply_mod_wsi - add: unhashed#user#password [21/May/2017:16:39:41.663889158 -0400] - DEBUG - do_modify - replace: unhashed#user#password [21/May/2017:16:39:41.691572968 -0400] - DEBUG - entry_apply_mod_wsi - replace: unhashed#user#password Results: Plain password value wasn't found in the logs. Marking as verified.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2086