New password for fuel user saved after changing in bash history

Bug #1462343 reported by Egor Kotko on 2015-06-05
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Fuel for OpenStack
High
Sylwester Brzeczkowski
7.0.x
High
Sylwester Brzeczkowski
8.0.x
High
Sylwester Brzeczkowski

Bug Description

{"build_id": "2015-05-24_15-51-50", "build_number": "462", "release_versions": {"2014.2.2-6.1": {"VERSION": {"build_id": "2015-05-24_15-51-50", "build_number": "462", "api": "1.0", "fuel-library_sha": "889c2534ceadf8afd5d1540c1cadbd913c0c8c14", "nailgun_sha": "76441596e4fe6420cc7819427662fa244e150177", "feature_groups": ["mirantis"], "openstack_version": "2014.2.2-6.1", "production": "docker", "python-fuelclient_sha": "e19f1b65792f84c4a18b5a9473f85ef3ba172fce", "astute_sha": "0bd72c72369e743376864e8e8dabfe873d40450a", "fuel-ostf_sha": "9a5f55602c260d6c840c8333d8f32ec8cfa65c1f", "release": "6.1", "fuelmain_sha": "5c8ebddf64ea93000af2de3ccdb4aa8bb766ce93"}}}, "auth_required": true, "api": "1.0", "fuel-library_sha": "889c2534ceadf8afd5d1540c1cadbd913c0c8c14", "nailgun_sha": "76441596e4fe6420cc7819427662fa244e150177", "feature_groups": ["mirantis"], "openstack_version": "2014.2.2-6.1", "production": "docker", "python-fuelclient_sha": "e19f1b65792f84c4a18b5a9473f85ef3ba172fce", "astute_sha": "0bd72c72369e743376864e8e8dabfe873d40450a", "fuel-ostf_sha": "9a5f55602c260d6c840c8333d8f32ec8cfa65c1f", "release": "6.1", "fuelmain_sha": "5c8ebddf64ea93000af2de3ccdb4aa8bb766ce93"}

New password for fuel user saved after changing in bash history.
http://paste.openstack.org/show/265842/

And it is require input new password each time when necessary to execute commands:
http://paste.openstack.org/show/265843/

Dmitry Pyzhov (dpyzhov) wrote :

There should be an option to provide a password interactively

Changed in fuel:
importance: Low → Medium
status: New → Confirmed

The correct way to deal with this is to implement passwd like way of changing password. Otherwise, everyone who can see the process list on a node can see this new password. As fast workaround we can simply prevent bash from writing command history.

HISTCONTROL
              A colon-separated list of values controlling how commands are saved on the history list. If the
              list of values includes ignorespace, lines which begin with a space character are not saved in the
              history list. A value of ignoredups causes lines matching the previous history entry to not be
              saved. A value of ignoreboth is shorthand for ignorespace and ignoredups. A value of erasedups
              causes all previous lines matching the current line to be removed from the history list before that
              line is saved. Any value not in the above list is ignored. If HISTCONTROL is unset, or does not
              include a valid value, all lines read by the shell parser are saved on the history list, subject to
              the value of HISTIGNORE. The second and subsequent lines of a multi-line compound command are not
              tested, and are added to the history regardless of the value of HISTCONTROL.

tags: added: feature-security
Changed in fuel:
importance: Medium → High
Changed in fuel:
assignee: Fuel Python Team (fuel-python) → Sylwester Brzeczkowski (sbrzeczkowski)

Fix proposed to branch: master
Review: https://review.openstack.org/209909

Changed in fuel:
status: Confirmed → In Progress
Changed in fuel:
assignee: Sylwester Brzeczkowski (sbrzeczkowski) → Maciej Kwiek (maciej-iai)

Reviewed: https://review.openstack.org/209909
Committed: https://git.openstack.org/cgit/stackforge/python-fuelclient/commit/?id=62c569281c6300af6c291fc6dc4627b60e92bdff
Submitter: Jenkins
Branch: master

commit 62c569281c6300af6c291fc6dc4627b60e92bdff
Author: Sylwester Brzeczkowski <email address hidden>
Date: Thu Aug 6 14:18:45 2015 +0200

    Change user passwd in CLI using interacive prompt

    `fuel user change-password` now asks for password in interactive
    prompt in unix `passwd` style, which is secure
    comparing with passing new password as an argument to CLI.
    Also tests added.

    Change-Id: I88fd38e8bd0bb96dd9b596aa44fa3f7721ee6431
    Closes-Bug: 1462343

Changed in fuel:
status: In Progress → Fix Committed
Vladimir Khlyunev (vkhlyunev) wrote :

ISO #287

[root@nailgun ~]# fuel user --help
...
  -h, --help show this help message and exit
  --newpass NEWPASS, --new-pass NEWPASS
                        new_password
  --change-password Change user password. WARNING: This method of changing the password is dangerous - it may be saved in bash history.

The help message contains misleading warning - main goal of --change-password is to prevent saving new password in bash history but the help message tells our otherwise. We should move this warning to --newpass.

Changed in fuel:
status: Fix Committed → Confirmed
Changed in fuel:
assignee: Maciej Kwiek (maciej-iai) → Sylwester Brzeczkowski (sbrzeczkowski)

Fix proposed to branch: master
Review: https://review.openstack.org/221279

Changed in fuel:
status: Confirmed → In Progress

Reviewed: https://review.openstack.org/221279
Committed: https://git.openstack.org/cgit/stackforge/python-fuelclient/commit/?id=a29d92a5cafecf5a0a202f7700ccd4368c5f740f
Submitter: Jenkins
Branch: master

commit a29d92a5cafecf5a0a202f7700ccd4368c5f740f
Author: Sylwester Brzeczkowski <email address hidden>
Date: Tue Sep 8 14:32:11 2015 +0200

    Change warning message in change password help

    Warning message was applied to wrong argument - fixed.

    Change-Id: I2375f8b8bd0fbc3a543f532211353ac195124221
    Closes-Bug: #1462343

Changed in fuel:
status: In Progress → Fix Committed

Reviewed: https://review.openstack.org/221288
Committed: https://git.openstack.org/cgit/stackforge/python-fuelclient/commit/?id=2864459e27b0510a0f7aedac6cdf27901ef5c481
Submitter: Jenkins
Branch: stable/7.0

commit 2864459e27b0510a0f7aedac6cdf27901ef5c481
Author: Sylwester Brzeczkowski <email address hidden>
Date: Tue Sep 8 14:32:11 2015 +0200

    Change warning message in change password help

    Warning message was applied to wrong argument - fixed.

    Change-Id: I2375f8b8bd0fbc3a543f532211353ac195124221
    Closes-Bug: #1462343
    (cherry picked from commit a29d92a5cafecf5a0a202f7700ccd4368c5f740f)

Peter Zhurba (pzhurba) on 2015-09-11
tags: added: on-verification
Peter Zhurba (pzhurba) wrote :

Steps to verify

[root@nailgun ~]# fuel user --help
usage: fuel user [-h] [--newpass NEWPASS] [--change-password]

optional arguments:
  -h, --help show this help message and exit
  --newpass NEWPASS, --new-pass NEWPASS
                        WARNING: This method of changing the password is dangerous - it may be saved in bash history.
  --change-password Change user password using interactive prompt

Examples:

 To change user password:
            fuel user change-password

[root@nailgun ~]# fuel user --newpass pirat
[root@nailgun ~]# fuel user --new-pass pirat1
[root@nailgun ~]# fuel user --new pirat1
usage: fuel user [-h] [--newpass NEWPASS] [--change-password]
fuel user: error: ambiguous option: --new could match --newpass, --new-pass
[root@nailgun ~]# fuel user --change-password
Changing password for Fuel User.
New Password:
Retype new Password:
Passwords are not the same.
[root@nailgun ~]# cat /etc/fuel/release_versions/2015.1.0-7.0.yaml
VERSION:
  feature_groups:
    - mirantis
  production: "docker"
  release: "7.0"
  openstack_version: "2015.1.0-7.0"
  api: "1.0"
  build_number: "289"

tags: removed: on-verification
tags: added: on-verification
Sergey Novikov (snovikov) wrote :

Verified on
VERSION:
  feature_groups:
    - mirantis
  production: "docker"
  release: "8.0"
  openstack_version: "2015.1.0-8.0"
  api: "1.0"
  build_number: "108"
  build_id: "108"
  fuel-nailgun_sha: "ec56b54491ecb0182f66e675f549825abc1a96ee"
  python-fuelclient_sha: "286939d3be220828f52e73b65928ed39662e1853"
  fuel-agent_sha: "e881f0dabd09af4be4f3e22768b02fe76278e20e"
  fuel-nailgun-agent_sha: "d66f188a1832a9c23b04884a14ef00fc5605ec6d"
  astute_sha: "0f753467a3f16e4d46e7e9f1979905fb178e4d5b"
  fuel-library_sha: "acfcfd289ca454585687b6ff9651b53e4ffaf0cd"
  fuel-ostf_sha: "37c5d6113408a29cabe0f416fe99cf20e2bca318"
  fuelmain_sha: "8e5e75302b2534fd38e4b41b795957111ac75543"

tags: removed: on-verification
Dmitry Pyzhov (dpyzhov) on 2015-10-22
tags: added: area-python
Dmitry Pyzhov (dpyzhov) on 2015-11-30
Changed in fuel:
milestone: 7.0 → 8.0
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers