Bug 989271 - Avoid logging sensitive details when using password based authentication
Summary: Avoid logging sensitive details when using password based authentication
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Beaker
Classification: Retired
Component: web UI
Version: develop
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: 0.14
Assignee: Dan Callaghan
QA Contact: tools-bugs
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-07-29 00:48 UTC by Nick Coghlan
Modified: 2018-02-06 00:41 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-08-09 03:23:48 UTC
Embargoed:

Attachments (Terms of Use)

Description Nick Coghlan 2013-07-29 00:48:41 UTC 
In Beaker 0.13 and earlier, the server-debug logs need to be treated as containing sensitive data, as they record such data when clients use password based authentication (rather than Kerberos ticket based authorisation).

This has been fixed for 0.14 (see http://gerrit.beaker-project.org/#/c/2101/) to avoid capturing the unneeded sensitive details.
Comment 2 xjia 2013-07-29 03:13:40 UTC 
Verify:
server-debug.log:Jul 27 03:39:27 beaker-devel beaker-server[14185]: bkr.server.xmlrpccontroller DEBUG Time: 0:00:00.000122 auth.renew_session

Version:
beaker-server-0.13.2-1.git.81.54e9513.el6eng.noarch
beaker-0.13.2-1.git.72.7543e3e.el6.noarch
beaker-server-redhat-0.1.14-1.git.3.ff982cb.el6.noarch
Comment 3 Dan Callaghan 2013-08-09 03:23:48 UTC 
Beaker 0.14.1 has been released.
Note You need to log in before you can comment on or make changes to this bug.