security service password is stored in plaintext
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
OpenStack Shared File Systems Service (Manila) |
Triaged
|
Wishlist
|
Felipe Rodrigues |
Bug Description
Hi,
I want to get your opinion on the password field of security services.
I know I can protect security_
Additionally it can be visible at share server backend details. I can protect that, too.
But manila admins and anyone with database access can see the password in plaintext.
Do you see it feasible to use a key manager (like barbican) to store the password in an encrypted fashion?
By the way: we already guide our human users to give the technical user, who authenticates with that password, as few permissions as possible, but sometimes you find domain admin or the human user's personal credentials in there, oops. Such people have to be protected from themselves.
Thanks,
Maurice
Changed in manila: | |
status: | New → Triaged |
Changed in manila: | |
assignee: | nobody → Felipe Rodrigues (felipefutty) |
I've added this to the Train PTG planning etherpad.
One idea would be to use oslo config Castellan support [2] to hold an encryption key in a vault and then we could use that to AES encrypt/decrypt the service user password when it is stored in the DB.
[1] https:/ /etherpad. openstack. org/p/manila- denver- train-ptg- planning
[2] http:// lists.openstack .org/pipermail/ openstack- discuss/ 2019-March/ 003409. html