James Laska of Red Hat reports: Aeolus Configserver stores passwords in a plain/text world-readable log file. Version-Release number of selected component (if applicable): * aeolus-configserver-0.4.11-1.el6cf.noarch How reproducible: Steps to Reproduce: 1. Setup a configserver and connect it to conductor 2. Launch applications that rely on <parameter> with <value type="password"> <parameter name="KATELLO_PASS"> <value type="password">jlaska</value> </parameter> 3. Inspect /var/log/aeolus-configserver/configserver.log after launching instances Actual results: 1. The logfile is world readable > # ll /var/log/aeolus-configserver/configserver.log > -rw-r--r--. 1 aeolus aeolus 23611 Nov 1 12:43 /var/log/aeolus-configserver/configserver.log 2. The password is displayed in the logfile > I, [2012-11-01T07:51:06.875595 #1886] INFO -- : services: #<OrderedHash {"RHEL_PRODUCT_CERT"=>{}, "KATELLO_REGISTER"=>{"RELEASEVER"=>"5.7", "YUM_REMOTE_INSTALL"=>"mc vte", "SSH_TUNNEL_GOFER_PORT"=>"5674", "KATELLO_PASS"=>"jlaska", "KATELLO_ORG"=>"redhat", "JENKINS_SSH_KEY_LOCATION"=>"None", "IMPORT_GPG_BETA_KEY"=>"True", "SSH_TUNNEL_KATELLO_PORT"=>"1443", "AUTO_SUBSCRIBE"=>"True", "ACTIVATION_KEY"=>"None", "RHEL_PRODUCT_CERT_TASK"=>"RHEL_PRODUCT_CERT", "JENKINS_SSH_DIR"=>"/root/.ssh", "KATELLO_ENV"=>"Dev", "SSH_TUNNEL_IP"=>"10.198.37.67", "DISABLE_RHUI"=>"True", "KATELLO_USER"=>"jlaska", "SSH_TUNNEL_ENABLED"=>"Auto", "YUM_LOCAL_INSTALL"=>"emacs", "KATELLO_PORT"=>"443", "KATELLO_HOST"=>"qeblade41.rhq.lab.eng.bos.redhat.com"}}> > I, [2012-11-01T09:02:55.129272 #1886] INFO -- : services: #<OrderedHash {"RHEL_PRODUCT_CERT"=>{}, "KATELLO_REGISTER"=>{"RELEASEVER"=>"5.7", "YUM_REMOTE_INSTALL"=>"mc vte", "SSH_TUNNEL_GOFER_PORT"=>"5674", "KATELLO_PASS"=>"jlaska", "KATELLO_ORG"=>"redhat", "JENKINS_SSH_KEY_LOCATION"=>"None", "IMPORT_GPG_BETA_KEY"=>"True", "SSH_TUNNEL_KATELLO_PORT"=>"1443", "AUTO_SUBSCRIBE"=>"True", "ACTIVATION_KEY"=>"None", "RHEL_PRODUCT_CERT_TASK"=>"RHEL_PRODUCT_CERT", "JENKINS_SSH_DIR"=>"/root/.ssh", "KATELLO_ENV"=>"Dev", "SSH_TUNNEL_IP"=>"10.198.37.67", "DISABLE_RHUI"=>"True", "KATELLO_USER"=>"jlaska", "SSH_TUNNEL_ENABLED"=>"Auto", "YUM_LOCAL_INSTALL"=>"emacs", "KATELLO_PORT"=>"443", "KATELLO_HOST"=>"qeblade41.rhq.lab.eng.bos.redhat.com"}}> > I, [2012-11-01T09:02:55.940862 #1886] INFO -- : services: #<OrderedHash {"RHEL_PRODUCT_CERT"=>{}, "KATELLO_REGISTER"=>{"RELEASEVER"=>"5.7", "YUM_REMOTE_INSTALL"=>"mc vte", "SSH_TUNNEL_GOFER_PORT"=>"5674", "KATELLO_PASS"=>"jlaska", "KATELLO_ORG"=>"redhat", "JENKINS_SSH_KEY_LOCATION"=>"None", "IMPORT_GPG_BETA_KEY"=>"True", "SSH_TUNNEL_KATELLO_PORT"=>"1443", "AUTO_SUBSCRIBE"=>"True", "ACTIVATION_KEY"=>"None", "RHEL_PRODUCT_CERT_TASK"=>"RHEL_PRODUCT_CERT", "JENKINS_SSH_DIR"=>"/root/.ssh", "KATELLO_ENV"=>"Dev", "SSH_TUNNEL_IP"=>"10.198.37.67", "DISABLE_RHUI"=>"True", "KATELLO_USER"=>"jlaska", "SSH_TUNNEL_ENABLED"=>"Auto", "YUM_LOCAL_INSTALL"=>"emacs", "KATELLO_PORT"=>"443", "KATELLO_HOST"=>"qeblade41.rhq.lab.eng.bos.redhat.com"}}> > I, [2012-11-01T09:20:09.888861 #1886] INFO -- : services: #<OrderedHash {"RHEL_PRODUCT_CERT"=>{}, "KATELLO_REGISTER"=>{"RELEASEVER"=>"5.7", "YUM_REMOTE_INSTALL"=>"mc vte", "SSH_TUNNEL_GOFER_PORT"=>"5674", "KATELLO_PASS"=>"jlaska", "KATELLO_ORG"=>"redhat", "JENKINS_SSH_KEY_LOCATION"=>"None", "IMPORT_GPG_BETA_KEY"=>"True", "SSH_TUNNEL_KATELLO_PORT"=>"1443", "AUTO_SUBSCRIBE"=>"True", "ACTIVATION_KEY"=>"None", "RHEL_PRODUCT_CERT_TASK"=>"RHEL_PRODUCT_CERT", "JENKINS_SSH_DIR"=>"/root/.ssh", "KATELLO_ENV"=>"Dev", "SSH_TUNNEL_IP"=>"10.198.37.67", "DISABLE_RHUI"=>"True", "KATELLO_USER"=>"jlaska", "SSH_TUNNEL_ENABLED"=>"Auto", "YUM_LOCAL_INSTALL"=>"emacs", "KATELLO_PORT"=>"443", "KATELLO_HOST"=>"qeblade41.rhq.lab.eng.bos.redhat.com"}}> > I, [2012-11-01T12:14:59.012779 #1886] INFO -- : services: #<OrderedHash {"RHEL_PRODUCT_CERT"=>{}, "KATELLO_REGISTER"=>{"RELEASEVER"=>"Auto", "YUM_REMOTE_INSTALL"=>"mc vte", "SSH_TUNNEL_GOFER_PORT"=>"5674", "KATELLO_PASS"=>"Redhat@1234", "KATELLO_ORG"=>"redhat", "JENKINS_SSH_KEY_LOCATION"=>"None", "IMPORT_GPG_BETA_KEY"=>"True", "SSH_TUNNEL_KATELLO_PORT"=>"1443", "AUTO_SUBSCRIBE"=>"True", "ACTIVATION_KEY"=>"None", "RHEL_PRODUCT_CERT_TASK"=>"RHEL_PRODUCT_CERT", "JENKINS_SSH_DIR"=>"/root/.ssh", "KATELLO_ENV"=>"Dev", "SSH_TUNNEL_IP"=>"10.198.37.67", "DISABLE_RHUI"=>"True", "KATELLO_USER"=>"admin", "SSH_TUNNEL_ENABLED"=>"Auto", "YUM_LOCAL_INSTALL"=>"emacs", "KATELLO_PORT"=>"443", "KATELLO_HOST"=>"qeblade40.rhq.lab.eng.bos.redhat.com"}}> > I, [2012-11-01T12:43:46.211550 #1886] INFO -- : services: #<OrderedHash {"RHEL_PRODUCT_CERT"=>{}, "KATELLO_REGISTER"=>{"RELEASEVER"=>"Auto", "YUM_REMOTE_INSTALL"=>"mc vte", "SSH_TUNNEL_GOFER_PORT"=>"5674", "KATELLO_PASS"=>"admin", "KATELLO_ORG"=>"redhat", "JENKINS_SSH_KEY_LOCATION"=>"None", "IMPORT_GPG_BETA_KEY"=>"True", "SSH_TUNNEL_KATELLO_PORT"=>"1443", "AUTO_SUBSCRIBE"=>"True", "ACTIVATION_KEY"=>"None", "RHEL_PRODUCT_CERT_TASK"=>"RHEL_PRODUCT_CERT", "JENKINS_SSH_DIR"=>"/root/.ssh", "KATELLO_ENV"=>"Dev", "SSH_TUNNEL_IP"=>"10.198.37.67", "DISABLE_RHUI"=>"True", "KATELLO_USER"=>"admin", "SSH_TUNNEL_ENABLED"=>"Auto", "YUM_LOCAL_INSTALL"=>"emacs", "KATELLO_PORT"=>"443", "KATELLO_HOST"=>"qeblade41.rhq.lab.eng.bos.redhat.com"}}> Expected results: 1. The configserver log should not be world-readable 2. <parameters> with a <value> of type="password" should be obfuscated when displayed in a logfile. Additional info:
Acknowledgements: This issue was discovered by James Laska of Red Hat.
#1 is addressed: ll /var/log/aeolus-configserver/configserver.log -rw-------. 1 aeolus aeolus 282 Feb 19 11:34 /var/log/aeolus-configserver/configserver.log
Using 'aeolus-configserver-0.4.12-3.el6cf.noarch', when launching applications that require service orchestration, I'm no longer seeing passwords exposed in the configserver.log > # grep -rin pass /var/log/aeolus-configserver > # Marking this as VERIFIED based on comment#2 and comment#3
This issue has been addressed in following products: CloudForms for RHEL 6 Via RHSA-2013:0545 https://rhn.redhat.com/errata/RHSA-2013-0545.html
The Red Hat Security Response Team has rated this issue as having low security impact in CloudForms 1.1. This issue is not currently planned to be addressed in future updates.