Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2183357 - [Satellite 6] Ansible Satellite Collection repository (redhat.satellite.repositories) module logs credentials
Summary: [Satellite 6] Ansible Satellite Collection repository (redhat.satellite.repos...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Ansible Collection
Version: 6.12.0
Hardware: All
OS: Linux
medium
medium
Target Milestone: 6.14.0
Assignee: Evgeni Golov
QA Contact: Griffin Sullivan
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-03-30 22:59 UTC by jalviso
Modified: 2023-11-08 14:19 UTC (History)
5 users (show)

Fixed In Version: ansible-collection-redhat-satellite-3.11.0
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-11-08 14:19:08 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github theforeman foreman-ansible-modules pull 1581 0 None Merged don't log loop output in roles that can have sensitive data 2023-05-27 14:07:08 UTC
Github theforeman foreman-ansible-modules pull 1620 0 None open don't log repositories content when creating products 2023-06-02 08:44:11 UTC
Red Hat Issue Tracker SAT-16943 0 None None None 2023-04-04 05:51:14 UTC
Red Hat Product Errata RHSA-2023:6818 0 None None None 2023-11-08 14:19:27 UTC

Description jalviso 2023-03-30 22:59:12 UTC 
Description of problem:

Ansible Satellite Collection repository (redhat.satellite.repositories) module logs credentials. 

Version-Release number of selected component (if applicable):

redhat.satellite: 3.9.0 and 3.7.0

How reproducible: Always


Steps to Reproduce:
1. Install ansible-collection-redhat-satellite-3.7 or 3.9
2. Run the playbook with defined credentials, see example below:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- name: Setup AAP additional repos on Satellite
  hosts: localhost
  gather_facts: false

  vars:
    satellite_collections_redhat_url: https://console.redhat.com/api/automation-hub/content/540155-synclist/ 
    satellite_collections_redhat_requirements: |
      ---
      collections:
      - redhat.satellite
      
    aap_products:
      - name: Ansible
        repositories:
          - name: Red Hat Collections
            content_type: ansible_collection
            url: "{{ satellite_collections_redhat_url }}"
            ansible_collection_requirements: "{{ satellite_collections_redhat_requirements }}"
            upstream_username: "{{ cdn_username }}"
            upstream_password: "{{ cdn_password }}"


  roles:
    - role: redhat.satellite.repositories
      vars:
        satellite_server_url: https://satellite.example.com
        satellite_username: "admin"
        satellite_password: "password"
        satellite_organization: "gss"
        satellite_products: "{{ aap_products }}"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

It will add the ansible satellite collection to ansible_collection repository in Satellite.

Actual results:

redhat.satellite.repositories role (or repository module) logged to the output the password in cleartext in `upstream_password` field 

Expected results:

This value should be obfuscated to match other modules that routinely obfuscate password values.

Additional info:

Logging the password in cleartext is a security risk, it is affecting the usage of this module.
Comment 1 Griffin Sullivan 2023-05-26 15:53:35 UTC 
FailedQA on stream snap 15

redhat.satellite.repositories: Create Products step still logs `upstream_password` in plain text. Create Repositories step shows no logs and the product and repo are created successfully. I'm guessing we need to add the `no_log` line to https://github.com/theforeman/foreman-ansible-modules/blob/develop/roles/repositories/tasks/main.yml#L34

Steps:

1) Copy and run playbook above


Results:
PLAY [Setup AAP additional repos on Satellite] *************************************************************************************

TASK [redhat.satellite.repositories : Enable Red Hat Repositories] *****************************************************************
skipping: [localhost]

TASK [redhat.satellite.repositories : Enable Red Hat Repository Sets] **************************************************************
skipping: [localhost]

TASK [redhat.satellite.repositories : Create Products] *****************************************************************************
changed: [localhost] => (item={'name': 'Ansible', 'repositories': [{'name': 'Red Hat Collections', 'content_type': 'ansible_collection', 'url': 'https://console.redhat.com/api/automation-hub/content/540155-synclist/', 'ansible_collection_requirements': '---\ncollections:\n- redhat.satellite\n', 'upstream_username': '<username>', 'upstream_password': '<password>'}]})

TASK [redhat.satellite.repositories : Create Repositories] *************************************************************************
changed: [localhost] => (item=None)
changed: [localhost]

PLAY RECAP *************************************************************************************************************************
localhost                  : ok=2    changed=2    unreachable=0    failed=0    skipped=2    rescued=0    ignored=0
Comment 2 Griffin Sullivan 2023-07-05 19:16:56 UTC 
Verified on 6.14 snap 6

No credentials were logged when running the playbook.
Comment 5 errata-xmlrpc 2023-11-08 14:19:08 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: Satellite 6.14 security and bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2023:6818
Note You need to log in before you can comment on or make changes to this bug.