As a part of investigating bug#1351275, it was noticed that some of the default permissions on files that contain passwords (such as stackrc files) in a Director deployment are more open than they should be. In particular, in the undercloud node: /root/stackrc has root/root ownership and 600 permissions /home/stack/stackrc has stack/stack ownership and 600 permissions /home/stack/overcloudrc has stack/stack ownership and 664 permissions /home/stack/undercloud-passwords.conf has stack/stack ownership and 664 permissions. Items 1 and 2 are ok (600 permissions), but 3 and 4 should be locked down to 600. This is not a vulnerability since /home/stack defaults to 700 permissions, but it should still be hardened to prevent accidental exposure of passwords if the permissions of /home/stack change in the future.
Both reviews have merged in their respective upstreams. Fix for both was to chmod 0600 the files. This was merged into python-tripleoclient and instack-undercloud.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2017:3462