Bug 1411405 - Harden default permissions on files containing passwords
Summary: Harden default permissions on files containing passwords
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: python-tripleoclient
Version: unspecified
Hardware: Unspecified
OS: Unspecified
Target Milestone: Upstream M3
: 12.0 (Pike)
Assignee: RHOS Maint
QA Contact: Prasanth Anbalagan
Depends On:
TreeView+ depends on / blocked
Reported: 2017-01-09 16:12 UTC by Nathan Kinder
Modified: 2018-03-19 14:04 UTC (History)
11 users (show)

Fixed In Version: python-tripleoclient-7.1.1-0.20170616130648.6030cd1.el7ost
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2017-12-13 21:00:46 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
OpenStack gerrit 446071 0 None None None 2017-03-15 17:36:55 UTC
OpenStack gerrit 446083 0 None None None 2017-03-15 17:37:21 UTC
Red Hat Product Errata RHEA-2017:3462 0 normal SHIPPED_LIVE Red Hat OpenStack Platform 12.0 Enhancement Advisory 2018-02-16 01:43:25 UTC

Description Nathan Kinder 2017-01-09 16:12:29 UTC
As a part of investigating bug#1351275, it was noticed that some of the default permissions on files that contain passwords (such as stackrc files) in a Director deployment are more open than they should be.  In particular, in the undercloud node:

/root/stackrc has root/root ownership and 600 permissions
/home/stack/stackrc has stack/stack ownership and 600 permissions
/home/stack/overcloudrc has stack/stack ownership and 664 permissions
/home/stack/undercloud-passwords.conf has stack/stack ownership and 664 permissions.

Items 1 and 2 are ok (600 permissions), but 3 and 4 should be locked down to 600.  This is not a vulnerability since /home/stack defaults to 700 permissions, but it should still be hardened to prevent accidental exposure of passwords if the permissions of /home/stack change in the future.

Comment 1 Rob Crittenden 2017-03-16 17:38:42 UTC
Both reviews have merged in their respective upstreams. Fix for both was to chmod 0600 the files.

This was merged into python-tripleoclient and instack-undercloud.

Comment 7 errata-xmlrpc 2017-12-13 21:00:46 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.