Bug 741677 – ipa-client-install --password=$PASSWORD will cause /var/log/ipaclient-install.log to contain the password.

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 741677 - ipa-client-install --password=$PASSWORD will cause /var/log/ipaclient-install.log to contain the password.

Summary:	ipa-client-install --password=$PASSWORD will cause /var/log/ipaclient-install...

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	ipa (Show other bugs)
Sub Component:
Version:	6.1
Hardware:	Unspecified Unspecified

Priority	high Severity unspecified
Target Milestone:	rc
Target Release:	---
Assigned To:	Rob Crittenden
QA Contact:	IDM QE LIST
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:	739068
Blocks:
	Show dependency tree / graph

Reported:	2011-09-27 10:54 EDT by Dmitri Pal
Modified:	2011-12-06 13:32 EST (History)
CC List:	4 users (show)

See Also:
Fixed In Version:	ipa-2.1.2-1.el6
Doc Type:	Bug Fix
Doc Text:	Cause: When ipa-client-install is run with --password option containing a bulk password for client enrollment, the password may be printed to IPA client install log in a plain-text format. Consequence: Any user that get access to this fail may read the password Fix: ipa-client-install does not log the bulk enrollment password Result: User with access to the log cannot retrieve the password
Story Points:	---
Clone Of:	739068
Environment:
Last Closed:	2011-12-06 13:32:51 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2011:1533	normal	SHIPPED_LIVE	Moderate: ipa security and bug fix update	2011-12-05 20:23:31 EST

Groups: None (edit)

Comment 1 Martin Kosek 2011-09-27 11:36:41 EDT

Fixed upstream:

master: 4487a9564b42cdedf6bb4a84134286a131583494
ipa-2-1: ad37727150abecb19a55fe7ae18bccb3a63052b9

Comment 3 Martin Kosek 2011-11-01 04:34:44 EDT

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause: When ipa-client-install is run with --password option containing a bulk password for client enrollment, the password may be printed to IPA client install log in a plain-text format.
Consequence: Any user that get access to this fail may read the password
Fix: ipa-client-install does not log the bulk enrollment password
Result: User with access to the log cannot retrieve the password

Comment 4 Namita Soman 2011-11-04 10:11:33 EDT

Verified using ipa-client-2.1.3-8.el6.x86_64 & ipa-server-2.1.3-8.el6.x86_64

added client as host, set its otp, then installed using cmd below:
#ipa-client-install --domain=testrelm --realm=TESTRELM --password=1234


ipaclient-install logs have it as:
2011-11-04 09:57:34,793 DEBUG args=/usr/sbin/ipa-join -s ipa-master.testrelm -b dc=testrelm -w XXXXXXXX

But from comments above - this should be verified using 5.7 client. Started beaker job to provision one.

Comment 5 Namita Soman 2011-11-04 11:54:00 EDT

Bug 739068 is for the 5.7 client. will update test results there for 5.7. 
marking this verified for 6.2

Comment 6 errata-xmlrpc 2011-12-06 13:32:51 EST

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2011-1533.html

Note You need to log in before you can comment on or make changes to this bug.