mysql root password in nova logs 644

[Pierre-Olivier Vauboin]

nova logs have file permission 644 by default and contain mysql root passwd

2011-06-30 08:32:15,607 DEBUG nova [-] sql_connection : mysql://root:azerty@172.17.128.13/nova from (pid=14641) serve /usr/lib/pymodules/python2.6/nova/service.py:287

cloud@cloud:~$ ls -al /var/log/nova/
total 89040
drwxr-xr-x 2 nova root 4096 2011-07-04 06:30 .
drwxr-xr-x 16 root root 4096 2011-07-04 06:30 ..
-rw-r--r-- 1 nova root 59854 2011-06-29 15:48 install.log
-rw-r--r-- 1 nova nogroup 31824 2011-07-04 13:52 nova-api.log
-rw-r--r-- 1 nova nogroup 0 2011-07-04 06:30 nova-compute.log
-rw-r--r-- 1 nova nogroup 59826 2011-06-29 15:48 nova-manage.log
-rw-r--r-- 1 nova nogroup 0 2011-07-04 06:30 nova-network.log
-rw-r--r-- 1 root root 300 2011-07-04 06:30 nova-objectstore.log
-rw-r--r-- 1 nova nogroup 105028 2011-07-04 17:51 nova-scheduler.log

[Thierry Carrez (ttx)]

We should probably have a list of sensitive flags that should not be dumped... or turn the logs 640.

Workaround is to run without --debug (--debug is not suitable in production anyway ?)

[Mohammed Naser (mnaser)]

I would say that you're not supposed to have debug on in a production environment where this is an issue. If debug is on, then you are in a controlled development environment that can blow up in seconds.

[Thierry Carrez (ttx)]

Hmm, the flag is actually called "verbose" and not "debug". So I still think we should fix that, but I agree it's not high-impact.