Bugzilla (bugzilla.redhat.com) will be under maintenance for infrastructure upgrades and will not be available on July 31st between 12:30 AM - 05:30 AM UTC. We appreciate your understanding and patience. You can follow status.redhat.com for details.
Bug 1879911 - (security) dont use the hardcoded passwords
Summary: (security) dont use the hardcoded passwords
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Console Kubevirt Plugin
Version: 4.6
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 4.6.0
Assignee: Gilad Lekner
QA Contact: Guohua Ouyang
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-09-17 10:42 UTC by Tomas Jelinek
Modified: 2020-10-27 16:42 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-10-27 16:41:54 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift console pull 6690 0 None closed Bug 1879911: (security) dont use the hardcoded passwords 2020-09-27 00:55:07 UTC
Github openshift console pull 6747 0 None open Bug 1879911: (security) dont use the hardcoded passwords 2020-09-25 09:40:49 UTC
Red Hat Product Errata RHBA-2020:4196 0 None None None 2020-10-27 16:42:10 UTC

Description Tomas Jelinek 2020-09-17 10:42:38 UTC
Description of problem:
common templates are using hardcoded passwords. Since 2.5 they will contain a parameter to generate them, but that relies on the "oc process" functionality.

After an offline discussion it has been decided to generate the password on the UI as well.

The specific behavior:

If the common-templates contains the cloud-init config, e.g. like:
#cloud-config
user: admin
password: <whatever>
chpasswd: {expire: False}
ssh_pwauth: True

than the UI needs to modify it before adding it to the cloud init section. It needs to take everything what is on the line after the "password: " and generate a password. The format needs to be
<four random characters>-<four random characters>-<four random characters>. So, something like this:
#cloud-config
user: admin
password: abcd-a41s-2342
chpasswd: {expire: False}
ssh_pwauth: True

Comment 4 errata-xmlrpc 2020-10-27 16:41:54 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Container Platform 4.6 GA Images), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4196


Note You need to log in before you can comment on or make changes to this bug.