Hide Forgot
This bug is created as a clone of upstream ticket: https://fedorahosted.org/389/ticket/49009 If the logging level is set to debugging args the full mod apreations are logged, including prehashed data. This is only accessible in the error log, and cannot be triggered or used by an external client, but should be hardended
Build tested: 389-ds-base-1.2.11.15-85.el6.x86_64 Verification steps: [1] Set up MMR. [2] Add a user entry, - uid=tuser,dc=example,dc=com [root@qeos-66 dirsrvtests]# ldapsearch -h localhost -p 38941 -D "cn=directory manager" -w password -b "uid=tuser,dc=example,dc=com" dn: uid=tuser,dc=example,dc=com cn: tuser objectClass: inetorgperson objectClass: organizationalPerson objectClass: person objectClass: top sn: tuser mail: tuser uid: tuser userPassword:: e1NTSEF9NXVya1cwcmt4MEliTnBDR0FtVUlGdmMrZnpnakdpdFJOL3dkTlE9PQ= = [3] Enable the trace level error log on both masters. 1 — Trace function calls. Logs a message when the server enters and exits a function. 4 — Heavy trace output debugging. 16384 — default [root@qeos-66 dirsrvtests]# ldapmodify -h localhost -p 38941 -D "cn=directory manager" -w password dn: cn=config changetype: modify replace: nsslapd-errorlog-level nsslapd-errorlog-level: 16389 modifying entry "cn=config" [root@qeos-66 dirsrvtests]# ldapmodify -h localhost -p 38942 -D "cn=directory manager" -w password dn: cn=config changetype: modify replace: nsslapd-errorlog-level nsslapd-errorlog-level: 16389 modifying entry "cn=config" [4] Modify the userPassword of the user entry, uid=tuser,dc=example,dc=com [root@qeos-66 dirsrvtests]# ldapmodify -h localhost -p 38941 -D "cn=directory manager" -w password dn: uid=tuser,dc=example,dc=com changetype: modify delete: userpassword modifying entry "uid=tuser,dc=example,dc=com" dn: uid=tuser,dc=example,dc=com changetype: modify add: userpassword userpassword: newpass modifying entry "uid=tuser,dc=example,dc=com" dn: uid=tuser,dc=example,dc=com changetype: modify replace: userpassword userpassword: newnewpass modifying entry "uid=tuser,dc=example,dc=com" [5] Grep the error log with "unhashed#user#password" as well as the password string. [root@qeos-66 ds]# grep "unhashed#user#password" /var/log/dirsrv/slapd-master_2/errors [06/Dec/2016:12:42:21 -0500] - add: unhashed#user#password [06/Dec/2016:12:42:21 -0500] - add: unhashed#user#password [06/Dec/2016:12:42:21 -0500] - => index_addordel_values_ext_sv( "unhashed#user#password", 12 ) [06/Dec/2016:12:42:26 -0500] - replace: unhashed#user#password [06/Dec/2016:12:42:26 -0500] - replace: unhashed#user#password [06/Dec/2016:12:42:26 -0500] - removing entire attribute unhashed#user#password [06/Dec/2016:12:42:26 -0500] - => index_addordel_values_ext_sv( "unhashed#user#password", 12 ) [06/Dec/2016:12:42:26 -0500] - => index_addordel_values_ext_sv( "unhashed#user#password", 12 ) [root@qeos-66 ds]# grep "unhashed#user#password" /var/log/dirsrv/slapd-master_1/errors [06/Dec/2016:12:42:21 -0500] - add: unhashed#user#password [06/Dec/2016:12:42:21 -0500] - => index_addordel_values_ext_sv( "unhashed#user#password", 12 ) [06/Dec/2016:12:42:26 -0500] - replace: unhashed#user#password [06/Dec/2016:12:42:26 -0500] - removing entire attribute unhashed#user#password [06/Dec/2016:12:42:26 -0500] - => index_addordel_values_ext_sv( "unhashed#user#password", 12 ) [06/Dec/2016:12:42:26 -0500] - => index_addordel_values_ext_sv( "unhashed#user#password", 12 ) ce: unhashed#user#password There is no plain text password. Marking as VERIFIED.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2017-0667.html