MaaS: RabbitMQ's maas_user password not set or used in 10.1.10

[Christy Mason]

During the 10.1.10 upgrade a maas_user is created in rabbit to replace the insecure credentials used in previous versions.

A maas_user is created and set to administrator correctly, and a password defined in the user variables text file. However, this password is not set for the rabbit user. Also, the remote playbook does not create rabbit checks that use this user and password so they fail. (I do see that the rabbit checks must be removed beforehand - the playbooks recreate checks that do not use these credentials.)

We were able to work around these issues during the maintenances by going into the rabbit containers, using rabbitmqctl to set the maas_user password, and editing the checks manually to include the -U and -p flags with the appropriate credentials.

[Matthew Thode (prometheanfire)]

does this occur only during upgrades or also fresh installs?

[Christy Mason (christy-mason)]

I have only had occasion to observe this during upgrades.

[Robb Romans (rromans)]

Does this have any relation to the changes made for this bug: https://bugs.launchpad.net/bugs/cve/2015-4708 ?

[Matthew Thode (prometheanfire)]

depends on if the maas user can log in with NO password or not I guess. Even then I suspect it'd be a separate CVE.

[Jesse Pretorius (jesse-pretorius)]

Setting Juno series target to "Won't Fix" as there will be no more adjustments going into the Juno branch unless they are Critical bugs.