iscsiadm log shows passwords

[Walt Boring]

Hi,

I am wondering why screen-c-vol.log is displaying the CHAP secret.

Logs:

2015-04-16 16:04:23.288 7306 DEBUG oslo_concurrency.processutils [req-23c699df-7b21-48d2-ba14-d8ed06642050 ce8dccba9ccf48fb956060b3e54187a2 4ad219788df049e0b131e17f603d5faa - - -] CMD "sudo cinder-rootwrap /etc/cinder/rootwrap.conf iscsiadm -m node -T iqn.2015-04.acc1.tsm1:acc171fe6fc15fcc4bd4a841594b7876e3df -p 192.10.44.48:3260 --op update -n node.session.auth.password -v ***" returned: 0 in 0.088s execute /usr/local/lib/python2.7/dist-packages/oslo_concurrency/processutils.py:225

Above log hides the secret.

2015-04-16 16:04:23.290 7306 DEBUG cinder.brick.initiator.connector [req-23c699df-7b21-48d2-ba14-d8ed06642050 ce8dccba9ccf48fb956060b3e54187a2 4ad219788df049e0b131e17f603d5faa - - -] iscsiadm ('--op', 'update', '-n', 'node.session.auth.password', '-v', u'fakeauthgroupchapsecret'): stdout= stderr= _run_iscsiadm /opt/stack/cinder/cinder/brick/initiator/connector.py:455

However, this one does not hide the secret.

In addition, i find that the CHAP credentials are stored as plain string the database table (volumes).

I guess these are security risks in the current implementation. Any comments ?

Regards,
Yogesh
CloudByte Inc.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/174484

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/174485

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/174485
Committed: https://git.openstack.org/cgit/openstack/cinder/commit/?id=64d7923f3665ce5f40572980e1ea65b3c4df02b7
Submitter: Jenkins
Branch: master

commit 64d7923f3665ce5f40572980e1ea65b3c4df02b7
Author: Walter A. Boring IV <email address hidden>
Date: Thu Apr 16 10:44:10 2015 -0700

    Mask passwords with iscsiadm commands

    This patch adds the fix that exists in the nova
    libvirt volume code to use oslo_utils strutils
    to mask passwords that might show up in debug log
    messages.

    Change-Id: I5c321d6b2627f186ff3dfe64ee7ad71f27a95cf0
    Closes-Bug: 1445137

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/174484
Committed: https://git.openstack.org/cgit/openstack/os-brick/commit/?id=7ee5a43a7562ff6064a9e9d8fcbc8fcdbe4bba7f
Submitter: Jenkins
Branch: master

commit 7ee5a43a7562ff6064a9e9d8fcbc8fcdbe4bba7f
Author: Walter A. Boring IV <email address hidden>
Date: Thu Apr 16 10:42:47 2015 -0700

    Mask passwords with iscsiadm commands

    This patch adds the fix that exists in the nova
    libvirt volume code to use oslo_utils strutils
    to mask passwords that might show up in debug log
    messages.

    Change-Id: I632eb4d71588736ab21327824d0506c13f3933ae
    Closes-Bug: 1445137