ensure that the docs explicitly caution to keep the hash path suffix secret

Bug #791620 reported by John Dickinson
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Object Storage (swift)
Fix Released
Medium
Anne Gentle

Bug Description

Question #156307 on OpenStack Object Storage (swift) changed:
https://answers.launchpad.net/swift/+question/156307

Rostik Slipetskyy posted a new comment:
we caution deployers to keep it secret in the docs (...) The
hash_path_suffix should be kept as secret as an /etc/shadow file or the
secret key of a key pair.

I just rechecked the Administrator manual
(http://docs.openstack.org/cactus/openstack-object-storage/admin/os-
objectstorage-adminguide-cactus.pdf), and what I found with respect to
swift_hash_path_suffix was:

"# random unique string that can never change (DO NOT LOSE)"

Maybe I have missed other places where the necessity to keep
swift_hash_path_suffix secret were mentioned, but it might make sense to
indicate it in Admin manual and also at etc/swift.conf-sample from the
distribution. Just as a precaution measure.

Revision history for this message
Anne Gentle (annegentle) wrote :

I've changed the docs in openstack-manuals and you can also assign it to me to fix in Swift as well.

Changed in swift:
status: New → Confirmed
assignee: nobody → Anne Gentle (annegentle)
importance: Undecided → Medium
Revision history for this message
Samuel Merritt (torgomatic) wrote :

Commit a2ac5ef updated the text in swift.conf-sample to say:

# swift_hash_path_suffix is used as part of the hashing algorithm
# when determining data placement in the cluster. This value should
# remain secret and MUST NOT change once a cluster has been deployed.

Is this sufficient?

Revision history for this message
Samuel Merritt (torgomatic) wrote :

The fix has been deemed sufficient.

Changed in swift:
milestone: none → 1.7.5
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Related questions

Remote bug watches

Bug watches keep track of this bug in other bug trackers.