| 2016-11-02 16:22:06 |
Derek Higgins |
description |
When getting node details, in most drivers the password/keys are masked to prevent them being displayed to the console and appearing in logs
When using the ssh power driver this isn't the case, on a development environment where virtual nodes are being used, the ssh private keys are logged in various places at various debug levels and when running "ironic node-show <uuid>" e.g.
$ ironic --debug node-show baremetal-0 2> /tmp/t
+------------------------+-----------------------------------------------------------------------+
| Property | Value |
+------------------------+-----------------------------------------------------------------------+
| chassis_uuid | |
| clean_step | {} |
| console_enabled | False |
| created_at | 2016-11-02T14:31:34+00:00 |
| driver | pxe_ssh |
| driver_info | {u'ssh_username': u'root', u'deploy_kernel': |
| | u'b6e8a5e6-90d0-4471-bc00-363db8d7705f', u'deploy_ramdisk': |
| | u'2b280e67-d3a0-42f6-b95b-417a5417eb2f', u'ssh_key_contents': u'----- |
| | BEGIN RSA PRIVATE KEY----- |
| | ............................................. |
| | ............................................. |
| | ............................................. |
| | ..........Removed for bug report............. |
| | ............................................. |
| | ............................................. |
| | ............................................. |
| | -----END RSA PRIVATE KEY-----', u'ssh_virt_type': |
| | u'virsh', u'ssh_address': u'192.168.XX.XX'} |
| driver_internal_info | {} |
| extra | {} |
| inspection_finished_at | None |
| inspection_started_at | None |
| instance_info | {} |
| instance_uuid | None |
| last_error | None |
| maintenance | False |
| maintenance_reason | None |
| name | baremetal-0 |
| network_interface | |
| power_state | power off |
| properties | {u'memory_mb': u'6144', u'cpu_arch': u'x86_64', u'local_gb': u'41', |
| | u'cpus': u'1', u'capabilities': u'boot_option:local'} |
| provision_state | available |
| provision_updated_at | 2016-11-02T14:32:07+00:00 |
| raid_config | |
| reservation | None |
| resource_class | |
| target_power_state | None |
| target_provision_state | None |
| target_raid_config | |
| updated_at | 2016-11-02T14:32:07+00:00 |
| uuid | 9a7b89d5-51c4-4017-8f63-6b0505a58242 |
+------------------------+-----------------------------------------------------------------------+
Flagging this as a security vulnerability as a precaution, but I'd imagine it doesn't need to be kept private as it would only effect development environments and its already reported publicly here
https://bugzilla.redhat.com/show_bug.cgi?id=1346089 |
When getting node details, in most drivers the password/keys are masked to prevent them being displayed to the console and appearing in logs
When using the ssh power driver this isn't the case, on a development environment where virtual nodes are being used, the ssh private keys are logged in various places at various debug levels and when running "ironic node-show <uuid>" e.g.
$ ironic node-show baremetal-0
+------------------------+-----------------------------------------------------------------------+
| Property | Value |
+------------------------+-----------------------------------------------------------------------+
| chassis_uuid | |
| clean_step | {} |
| console_enabled | False |
| created_at | 2016-11-02T14:31:34+00:00 |
| driver | pxe_ssh |
| driver_info | {u'ssh_username': u'root', u'deploy_kernel': |
| | u'b6e8a5e6-90d0-4471-bc00-363db8d7705f', u'deploy_ramdisk': |
| | u'2b280e67-d3a0-42f6-b95b-417a5417eb2f', u'ssh_key_contents': u'----- |
| | BEGIN RSA PRIVATE KEY----- |
| | ............................................. |
| | ............................................. |
| | ............................................. |
| | ..........Removed for bug report............. |
| | ............................................. |
| | ............................................. |
| | ............................................. |
| | -----END RSA PRIVATE KEY-----', u'ssh_virt_type': |
| | u'virsh', u'ssh_address': u'192.168.XX.XX'} |
| driver_internal_info | {} |
| extra | {} |
| inspection_finished_at | None |
| inspection_started_at | None |
| instance_info | {} |
| instance_uuid | None |
| last_error | None |
| maintenance | False |
| maintenance_reason | None |
| name | baremetal-0 |
| network_interface | |
| power_state | power off |
| properties | {u'memory_mb': u'6144', u'cpu_arch': u'x86_64', u'local_gb': u'41', |
| | u'cpus': u'1', u'capabilities': u'boot_option:local'} |
| provision_state | available |
| provision_updated_at | 2016-11-02T14:32:07+00:00 |
| raid_config | |
| reservation | None |
| resource_class | |
| target_power_state | None |
| target_provision_state | None |
| target_raid_config | |
| updated_at | 2016-11-02T14:32:07+00:00 |
| uuid | 9a7b89d5-51c4-4017-8f63-6b0505a58242 |
+------------------------+-----------------------------------------------------------------------+
Flagging this as a security vulnerability as a precaution, but I'd imagine it doesn't need to be kept private as it would only effect development environments and its already reported publicly here
https://bugzilla.redhat.com/show_bug.cgi?id=1346089 |
|
