neutronclient debug logging includes keystone auth token

[Xu Han Peng]

neutronclient is logging the auth token in the nova logs. Since the logs are world-readable, this means anyone user on this system can see the auth token, which they can then use to get OpenStack administrator access.

[Wei Wang (damon-devops)]

This is similar one bug in keystone: bug #1004114

Dolph Mathews commited at this bug's patch: "why would a production environment have debug enabled?"

I think this bug maybe need reconsider.

[Matthew Edmonds (edmondsw)]

production environments wouldn't normally have debug enabled, but it may be enabled for debug purposes, e.g. when a problem has not been reproducible in a non-production environment. Also note that we should be conscious of security in non-production as well as production environments.

[Robert Clark (robert-clark)]

Limited security impact because it's client side but certainly an issue that needs to be fixed.

-Rob

[OpenStack Infra (hudson-openstack)]

Change abandoned by Xu Han Peng (<email address hidden>) on branch: master
Review: https://review.openstack.org/93866
Reason: Abandon this patch because X-Auth-Token has been replaced by "TOKEN_REDACTED"

by this keystone client patch:
 https://github.com/openstack/python-keystoneclient/commit/605577192d7158ecf40bd9a94b7cf3acc2ce1c95

[Xu Han Peng (xuhanp)]

Mark as fixed since X-Auth-Token has been replaced by "TOKEN_REDACTED" by this keystone client patch:
 https://github.com/openstack/python-keystoneclient/commit/605577192d7158ecf40bd9a94b7cf3acc2ce1c95