Bug 741677 - ipa-client-install --password=$PASSWORD will cause /var/log/ipaclient-install.log to contain the password.
Summary: ipa-client-install --password=$PASSWORD will cause /var/log/ipaclient-install...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: ipa
Version: 6.1
Hardware: Unspecified
OS: Unspecified
high
unspecified
Target Milestone: rc
: ---
Assignee: Rob Crittenden
QA Contact: IDM QE LIST
URL:
Whiteboard:
Depends On: 739068
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-09-27 14:54 UTC by Dmitri Pal
Modified: 2011-12-06 18:32 UTC (History)
4 users (show)

Fixed In Version: ipa-2.1.2-1.el6
Doc Type: Bug Fix
Doc Text:
Cause: When ipa-client-install is run with --password option containing a bulk password for client enrollment, the password may be printed to IPA client install log in a plain-text format. Consequence: Any user that get access to this fail may read the password Fix: ipa-client-install does not log the bulk enrollment password Result: User with access to the log cannot retrieve the password
Clone Of: 739068
Environment:
Last Closed: 2011-12-06 18:32:51 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:1533 normal SHIPPED_LIVE Moderate: ipa security and bug fix update 2011-12-06 01:23:31 UTC

Comment 1 Martin Kosek 2011-09-27 15:36:41 UTC 
Fixed upstream:

master: 4487a9564b42cdedf6bb4a84134286a131583494
ipa-2-1: ad37727150abecb19a55fe7ae18bccb3a63052b9
Comment 3 Martin Kosek 2011-11-01 08:34:44 UTC 
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause: When ipa-client-install is run with --password option containing a bulk password for client enrollment, the password may be printed to IPA client install log in a plain-text format.
Consequence: Any user that get access to this fail may read the password
Fix: ipa-client-install does not log the bulk enrollment password
Result: User with access to the log cannot retrieve the password
Comment 4 Namita Soman 2011-11-04 14:11:33 UTC 
Verified using ipa-client-2.1.3-8.el6.x86_64 & ipa-server-2.1.3-8.el6.x86_64

added client as host, set its otp, then installed using cmd below:
#ipa-client-install --domain=testrelm --realm=TESTRELM --password=1234


ipaclient-install logs have it as:
2011-11-04 09:57:34,793 DEBUG args=/usr/sbin/ipa-join -s ipa-master.testrelm -b dc=testrelm -w XXXXXXXX

But from comments above - this should be verified using 5.7 client. Started beaker job to provision one.
Comment 5 Namita Soman 2011-11-04 15:54:00 UTC 
Bug 739068 is for the 5.7 client. will update test results there for 5.7. 
marking this verified for 6.2
Comment 6 errata-xmlrpc 2011-12-06 18:32:51 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2011-1533.html
Note You need to log in before you can comment on or make changes to this bug.