Password is exposed in the log file

[Kanagaraj Manickam]

heat-keystone-setup-domain is logging the password to the log file. This defect is filed to remove the logging statement as its security concerns

[Tristan Cacqueray (tristan-cacqueray)]

The OSSA task is set to incomplete pending additional details from security reviewer. Also please note that while this bug is marked private security, you'll want to attach fix on this Launchpad bug report if you prefer to keep this under cover. The process is described here: https://wiki.openstack.org/wiki/VulnerabilityManagement

Does this leak happen in debug mode, or is it all the time ?

[Steven Hardy (shardy)]

> Does this leak happen in debug mode, or is it all the time ?

It's only debug level logging

[Steven Hardy (shardy)]

Since this only happens at debug level I don't think this is really a serious security concern (AFAIK many projects log potentially sensitive developer level information at debug level, but the expectation AIUI is that production environments would not log at debug level?).

Also given the nature of this tool, I'm not clear it would even ever end up logged to any log file (it's run once during heat install, and the logger is likely to just write to the terminal not any file).

That said, I'm fine with removing the logging as we don't really need it.

[Jeremy Stanley (fungi)]

Removing the advisory task and tagging this as a security hardening/strengthening measure.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/103842
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=35cf2f7a3beb6ac5fd198aa6ce1cdb492a099cf2
Submitter: Jenkins
Branch: master

commit 35cf2f7a3beb6ac5fd198aa6ce1cdb492a099cf2
Author: Kanagaraj Manickam <email address hidden>
Date: Tue Jul 1 16:34:21 2014 +0530

    Don't expose password in heat-keystone-setup-domain logs

    heat-keystone-setup-domain is logging
    the password to the log file. This patch
    removes the logging as it's security concerns

    Change-Id: I0f017a9c114ac60ea9f5e0df012334ead8cb434a
    Closes-bug: #1336225