Secure Site Recommendations does not discuss LOGGING settings

[Matt Fischer]

The Secure Site Recommendations (http://docs.openstack.org/developer/horizon/topics/deployment.html#secure-site-recommendations) does not mention anything about the LOGGING section. One specific issue that should be covered is that if you ship the example config file, it will log the keystone requests as DEBUG and that will log plaintext passwords. This is very dangerous.

[Julie Pichon (jpichon)]

Currently this is mentioned in http://docs.openstack.org/developer/horizon/topics/deployment.html#logging on the same page , but I agree the Keystone client logging passwords in plain text is a big issue (if you want to add your thoughts about this on bug 1004114 feel free to, as the Keystone client patch to fix this is currently abandoned). I think it would be good to change our default LOGGING dictionary to set the keystone client logger to INFO by default.

[Matt Fischer (mfisch)]

Let's change the default to Info and perhaps also the example too? I know that when people write things like puppet modules they rely on the example file to form a basis for the template and I just started a fix to modify the Puppet default to Info as well.

I'll also bring this up to the keystone team.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/102969

[OpenStack Infra (hudson-openstack)]

Change abandoned by David Lyle (<email address hidden>) on branch: master
Review: https://review.openstack.org/102969
Reason: No updates since June. If this is still being worked on restore the review and rebase.

[Akihiro Motoki (amotoki)]

As of 2021, keystoneauth1 is used to communicate back-end services. keystoneauth1 handles the underlying http connections and is in charge of DEBUG logging. It no longer records credentials like user password. token ID is still logged but token is ephemeral so I think this issue has been addressed.