Red Hat Bugzilla – Bug 744422
Leaks KDC password and master password via command line arguments
Last modified: 2011-12-06 13:42:38 EST
+++ This bug was initially created as a clone of Bug #744373 +++ ipa-server leaks KDC password and master password via command line arguments, in krbinstance.py --> (in both IPAv1 and IPAv2) the following code can be found class KrbInstance(service.Service): ... .. def __create_instance(self, replica=False): self.__template_file("/var/kerberos/krb5kdc/kdc.conf") self.__template_file("/etc/krb5.conf") self.__template_file("/usr/share/ipa/html/krb5.ini") self.__template_file("/usr/share/ipa/html/krb.con") self.__template_file("/usr/share/ipa/html/krbrealm.con") if not replica: #populate the directory with the realm structure args = ["kdb5_ldap_util", "-D", "uid=kdc,cn=sysaccounts,cn=etc,"+self.suffix, "-w", self.kdc_password, "create", "-s", "-P", self.master_password, "-r", self.realm, "-subtrees", self.suffix, "-sscope", "sub"] try: ipautil.run(args, nolog=(self.kdc_password, self.master_password)) except ipautil.CalledProcessError, e: print "Failed to populate the realm structure in kerberos", e so if the code under if not replica: gets executed the kdc_password and master_password will be leaked on the system (one should be able to use ps -ef to view the leaked password information). kdb5_ldap_util recommends against the use of -P and -w. I haven't verified this bug as I do not have a working copy of Fedora or RHEL to test on. --- Additional comment from dpal@redhat.com on 2011-10-08 11:22:20 EDT --- Upstream ticket: https://fedorahosted.org/freeipa/ticket/1948
*** Bug 745580 has been marked as a duplicate of this bug. ***
Fixed upstream: master: 0d823ddc4e5fa7f8bdecb590b4ebd129106b063f ipa-2-1: 7a5d906d03af6ee551036a841f71082fc66fa41b
Needs steps to reproduce/verify this bug.
Can by partly verified by code inspection: are we using the -P and -w options any more? Installing the server successfully confirms that the patch does not cause a regression. If Kerberos works at all with the resulting server then the patch is ok.
verified: <snip> def __create_instance(self, replica=False): self.__template_file("/var/kerberos/krb5kdc/kdc.conf", chmod=None) self.__template_file("/etc/krb5.conf") self.__template_file("/usr/share/ipa/html/krb5.ini") self.__template_file("/usr/share/ipa/html/krb.con") self.__template_file("/usr/share/ipa/html/krbrealm.con") if not replica: #populate the directory with the realm structure args = ["kdb5_ldap_util", "-D", "uid=kdc,cn=sysaccounts,cn=etc,"+self.suffix, "create", "-s", "-r", self.realm, "-subtrees", self.suffix, "-sscope", "sub"] dialogue = ( # Password for "uid=kdc,cn=sysaccounts,cn=etc,...": self.kdc_password + '\n', # Enter KDC database master key: self.master_password + '\n', # Re-enter KDC database master key to verify: self.master_password + '\n', ) try: ipautil.run(args, nolog=(self.kdc_password, self.master_password), stdin=''.join(dialogue)) except ipautil.CalledProcessError, e: print "Failed to populate the realm structure in kerberos", e </snip> version: ipa-server-2.1.3-3.el6.x86_64
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: Cause: When the IPA server is being installed ipa-server-install call kdb5_ldap_util to populate the directory with realm info. It passes a Kerberos master database password and Kerberos directory password as its parameters. Consequence: Any user listing all running processes during IPA server installation may be able to catch these passwords Fix: kdb5_ldap_util interactive mode is used to pass the passwords rather that CLI parameters Result: Passwords are not visible in process listing during IPA server installation so that no user can catch them
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2011-1533.html