You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by "CodeBleu (via GitHub)" <gi...@apache.org> on 2024/08/09 17:02:23 UTC
[I] Password in plaintext in management and access logs [cloudstack]
CodeBleu opened a new issue, #9512:
URL: https://github.com/apache/cloudstack/issues/9512
<!--
Verify first that your issue/request is not already reported on GitHub.
Also test if the latest release and main branch are affected too.
Always add information AFTER of these HTML comments, but no need to delete the comments.
-->
##### ISSUE TYPE
<!-- Pick one below and delete the rest -->
* Bug Report
##### COMPONENT NAME
<!--
Categorize the issue, e.g. API, VR, VPN, UI, etc.
-->
~~~
Logs
~~~
##### CLOUDSTACK VERSION
<!--
New line separated list of affected versions, commit ID for issues on main branch.
-->
~~~
4.19.1.0, 4.18.1.0
~~~
##### CONFIGURATION
<!--
Information about the configuration if relevant, e.g. basic network, advanced networking, etc. N/A otherwise
-->
##### OS / ENVIRONMENT
<!--
Information about the environment if relevant, N/A otherwise
-->
##### SUMMARY
<!-- Explain the problem/feature briefly -->
Password and sensitive information are shown in plaintext in the management and access logs on the management server.
##### STEPS TO REPRODUCE
<!--
For bugs, show exactly how to reproduce the problem, using a minimal test-case. Use Screenshots if accurate.
For new features, show how the feature would be used.
-->
<!-- Paste example playbooks or commands between quotes below -->
~~~
Looking in log files.
~~~
<!-- You can also paste gist.github.com links for larger files -->
##### EXPECTED RESULTS
<!-- What did you expect to happen when running the steps above? -->
~~~
No sensitive passwords or secrets in logs
~~~
##### ACTUAL RESULTS
<!-- What actually happened? -->
<!-- Paste verbatim command output between quotes below -->
~~~
/var/log/cloudstack/management/access.log:1077542308:10.30.0.61 - - [09/Aug/2024:16:42:01 +0000] "GET /client/api?account=joe-again-1286&apiKey=<apikey>&command=addVpnUser&domainid=c91a0528-377b-48aa-9c7b-2c7ead68200d&password=TOPSECRETPASSWORD&response=json&username=seantest2&signature=Ek%2BC7EGsrmNi0ONFL%2BxJBJxSGe0%3D HTTP/1.1" 200 115 "-" "GuzzleHttp/7" 86
/var/log/cloudstack/management/management-server.log:122775505:{u'vpn_users': [{u'add': True, u'password': u'TOPSECRETPASSWORD', u'user': u'seantest2'}], u'type': u'vpnuserlist', u'delete_from_processed_cache': False}
~~~
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Password in plaintext in management and access logs [cloudstack]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on issue #9512:
URL: https://github.com/apache/cloudstack/issues/9512#issuecomment-2278372243
Thanks for opening your first issue here! Be sure to follow the issue template!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Password in plaintext in management and access logs [cloudstack]
Posted by "rajujith (via GitHub)" <gi...@apache.org>.
rajujith commented on issue #9512:
URL: https://github.com/apache/cloudstack/issues/9512#issuecomment-2283112517
It is best to send credentials in a POST.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Password in plaintext in management and access logs [cloudstack]
Posted by "rohityadavcloud (via GitHub)" <gi...@apache.org>.
rohityadavcloud closed issue #9512: Password in plaintext in management and access logs
URL: https://github.com/apache/cloudstack/issues/9512
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Password in plaintext in management and access logs [cloudstack]
Posted by "CodeBleu (via GitHub)" <gi...@apache.org>.
CodeBleu commented on issue #9512:
URL: https://github.com/apache/cloudstack/issues/9512#issuecomment-2308394979
> > Depending on what that says, I'm not sure if that is an acceptable solution for me, because I want to see the `access.log`, but I don't want to see the passwords in it.
>
> in that case it is not acceptable for you and you'll need to sanitise the access log somehow.
But It makes more sense ( from a security perspective ) to not have the passwords/secrets hit the log in the first place. Sanitizing it after the fact is kinda pointless.
@rohityadavcloud @weizhouapache Can you please look into removing or obfuscating password information that is making it to access.log or any log for that matter from the actual code and not a retro solution or access.log > /dev/null ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Password in plaintext in management and access logs [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on issue #9512:
URL: https://github.com/apache/cloudstack/issues/9512#issuecomment-2309580958
> > > Depending on what that says, I'm not sure if that is an acceptable solution for me, because I want to see the `access.log`, but I don't want to see the passwords in it.
> >
> >
> > in that case it is not acceptable for you and you'll need to sanitise the access log somehow.
>
> But It makes more sense ( from a security perspective ) to not have the passwords/secrets hit the log in the first place. Sanitizing it after the fact is kinda pointless.
>
> @rohityadavcloud @weizhouapache Can you please look into removing or obfuscating password information that is making it to access.log or any log for that matter from the actual code and not a retro solution or access.log > /dev/null ?
it looks like all credentials in access.log are plain text.
ACS uses `NCSARequestLog` class to log request logs. I am not sure if it is possible to hide some information
If not , then need to look for another solution.
at this moment, I think you have to make a decision @CodeBleu
since the API calls are also saved in apilog.log and management-server.log, maybe you can just redirect access.log to /dev/null
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Password in plaintext in management and access logs [cloudstack]
Posted by "CodeBleu (via GitHub)" <gi...@apache.org>.
CodeBleu commented on issue #9512:
URL: https://github.com/apache/cloudstack/issues/9512#issuecomment-2305893457
> the first issue with `access.log` has been discussed before users can redirect the file access.log to /dev/null as suggested by @DaanHoogland
>
> the second issue (vpn user password are displayed in management-server.log) seems to only impact vpn user. I was able to reproduce the issue. it may not deserve a security release. I will have a look
>
> cc @rohityadavcloud @DaanHoogland @sureshanaparti
@DaanHoogland do you have the link to what @weizhouapache is talking about for the `access.log` to /dev/null?
Depending on what that says, I'm not sure if that is an acceptable solution for me, because I want to see the `access.log`, but I don't want to see the passwords in it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Password in plaintext in management and access logs [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on issue #9512:
URL: https://github.com/apache/cloudstack/issues/9512#issuecomment-2304177764
the first issue with `access.log` has been discussed before
users can redirect the file access.log to /dev/null as suggested by @DaanHoogland
the second issue (vpn user password are displayed in management-server.log) seems to only impact vpn user.
I was able to reproduce the issue. it may not deserve a security release.
I will have a look
cc @rohityadavcloud @DaanHoogland @sureshanaparti
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Password in plaintext in management and access logs [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on issue #9512:
URL: https://github.com/apache/cloudstack/issues/9512#issuecomment-2306576650
> Depending on what that says, I'm not sure if that is an acceptable solution for me, because I want to see the `access.log`, but I don't want to see the passwords in it.
in that case it is not acceptable for you and you'll need to sanitise the access log somehow.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Password in plaintext in management and access logs [cloudstack]
Posted by "rohityadavcloud (via GitHub)" <gi...@apache.org>.
rohityadavcloud commented on issue #9512:
URL: https://github.com/apache/cloudstack/issues/9512#issuecomment-2328019254
Fixed by https://github.com/apache/cloudstack/pull/9568
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Password in plaintext in management and access logs [cloudstack]
Posted by "CodeBleu (via GitHub)" <gi...@apache.org>.
CodeBleu commented on issue #9512:
URL: https://github.com/apache/cloudstack/issues/9512#issuecomment-2289056186
@rohityadavcloud Is there anyway this can be bumped up to a release sooner than 4.20.0.0? Being that this is a Security and Auditing issue, It would be nice to have this resolved sooner than later.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org