Bug 744373 - Leaks KDC password and master password via command line arguments
Summary: Leaks KDC password and master password via command line arguments
Keywords:
Status: CLOSED NEXTRELEASE
Alias: None
Product: freeIPA
Classification: Retired
Component: ipa-server
Version: 2.1
Hardware: All
OS: Unspecified
unspecified
medium
Target Milestone: ---
Assignee: Rob Crittenden
QA Contact: Chandrasekar Kannan
URL:
Whiteboard:
Depends On:
Blocks: 744422 745580
TreeView+ depends on / blocked
 
Reported: 2011-10-08 06:17 UTC by David
Modified: 2015-01-04 23:51 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 744422 745580 (view as bug list)
Environment:
Last Closed: 2011-10-12 18:39:43 UTC
Embargoed:


Attachments (Terms of Use)

Description David 2011-10-08 06:17:33 UTC
ipa-server leaks KDC password and master password via command line arguments, 
in krbinstance.py --> (in both IPAv1 and IPAv2) 
the following code can be found 

class KrbInstance(service.Service):
...
..

    def __create_instance(self, replica=False):
        self.__template_file("/var/kerberos/krb5kdc/kdc.conf")
        self.__template_file("/etc/krb5.conf")
        self.__template_file("/usr/share/ipa/html/krb5.ini")
        self.__template_file("/usr/share/ipa/html/krb.con")
        self.__template_file("/usr/share/ipa/html/krbrealm.con")

        if not replica:
            #populate the directory with the realm structure
            args = ["kdb5_ldap_util", "-D", "uid=kdc,cn=sysaccounts,cn=etc,"+self.suffix, "-w", self.kdc_password, "create", "-s", "-P", self.master_password, "-r", self.realm, "-subtrees", self.suffix, "-sscope", "sub"]
            try:
                ipautil.run(args, nolog=(self.kdc_password, self.master_password))
            except ipautil.CalledProcessError, e:
                print "Failed to populate the realm structure in kerberos", e


so if the code under 
        if not replica:
gets executed the kdc_password and master_password will be leaked on the system (one should be able to use ps -ef to view the leaked  password information).

kdb5_ldap_util recommends against the use of -P and -w.
I haven't verified this bug as I do not have a working copy of Fedora or RHEL to test on.

Comment 1 Dmitri Pal 2011-10-08 15:22:20 UTC
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/1948

Comment 2 Rob Crittenden 2011-10-12 18:39:43 UTC
Fixed upstream

master: 0d823ddc4e5fa7f8bdecb590b4ebd129106b063f

ipa-2-1: 7a5d906d03af6ee551036a841f71082fc66fa41b


Note You need to log in before you can comment on or make changes to this bug.