Description of problem: When using the REST API, if a user mistakenly sends the login credentials in the query string (not in the request body), the user/password is logged on RHV-M logs: - /var/log/httpd/ovirt-requests-log - /var/log/httpd/ssl_access_log - /var/log/httpd/ssl_request_log Anything we can do in the default config to prevent this? Version-Release number of selected component (if applicable): rhvm-4.3.3.7-0.1.el7.noarch httpd-2.4.6-89.el7_6.x86_64 Steps to Reproduce: A. In query string (password logged) $ curl --cacert /etc/pki/ovirt-engine/apache-ca.pem \ -X POST \ -H 'Content-Type:application/x-www-form-urlencoded' \ -H 'Accept: application/json' \ 'https://<RHV-M FQDN>/ovirt-engine/sso/oauth/token?grant_type=password&username=admin@internal&password=redhat&scope=ovirt-app-api' [29/May/2019:10:59:20 +1000] 10.64.24.30 "Correlation-Id: -" "Duration: 97090us" "POST /ovirt-engine/sso/oauth/token?grant_type=password&username=admin@internal&password=redhat&scope=ovirt-app-api HTTP/1.1" 310 B. In body (password not logged) # curl --cacert /etc/pki/ovirt-engine/apache-ca.pem \ -X POST \ -H 'Content-Type:application/x-www-form-urlencoded' \ -H 'Accept: application/json' \ -d 'grant_type=password&scope=ovirt-appapi&username=admin%40internal&password=redhat' \ 'https://<RHV-M FQDN>/ovirt-engine/sso/oauth/token' [29/May/2019:10:59:33 +1000] 10.64.24.30 "Correlation-Id: -" "Duration: 89662us" "POST /ovirt-engine/sso/oauth/token HTTP/1.1" 172
sync2jira
WARN: Bug status (ON_QA) wasn't changed but the folowing should be fixed: [Found non-acked flags: '{}', ] For more info please contact: rhv-devops: Bug status (ON_QA) wasn't changed but the folowing should be fixed: [Found non-acked flags: '{}', ] For more info please contact: rhv-devops
Verified on: httpd-2.4.6-90.el7.x86_64 ovirt-engine-4.4.0-0.20.master.el7.noarch Steps: 1. # curl -X GET -H 'All-content: true' -H "Accept: application/json" --insecure https://<engine-fqdn>/ovirt-engine/sso/oauth/token?grant_type=password&username=admin@internal&password=<password>&scope=ovirt-app-api 2. Checked /var/log/httpd/ssl_access_log; /var/log/httpd/ovirt-requests-log; /var/log/httpd/ssl_request_log Results No password logged
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Important: RHV Manager (ovirt-engine) 4.4 security, bug fix, and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2020:3247