yahoo-eng-team team mailing list archive
-
yahoo-eng-team team
-
Mailing list archive
-
Message #18047
[Bug 1004114] Re: Password logging
We should write an OSSN for this so people are aware of the fact that
passwords for users will be logged in Horizon if debug logging is
enabled. Now that a keystoneclient patch has been merged, we will soon
have a release that doesn't log passwords anymore. We should recommend
using the newer keystoneclient as soon as it's available.
** Also affects: ossn
Importance: Undecided
Status: New
** Changed in: ossn
Importance: Undecided => Medium
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1004114
Title:
Password logging
Status in OpenStack Dashboard (Horizon):
Fix Released
Status in OpenStack Identity (Keystone):
Fix Released
Status in OpenStack Security Notes:
New
Status in Python client library for Keystone:
Fix Committed
Bug description:
When the log level is set to DEBUG, keystoneclient's full-request
logging mechanism kicks in, exposing plaintext passwords, etc.
This bug is mostly out of the scope of Horizon, however Horizon can
also be more secure in this regard. We should make sure that wherever
we *are* handling sensitive data we use Django's error report
filtering mechanisms so they don't appear in tracebacks, etc.
(https://docs.djangoproject.com/en/dev/howto/error-reporting
/#filtering-error-reports)
Keystone may also want to look at respecting such annotations in their
logging mechanism, i.e. if Django were properly annotating these data
objects, keystoneclient could check for those annotations and properly
sanitize the log output.
If not this exact mechanism, then something similar would be wise.
For the time being, it's also worth documenting in both projects that
a log level of DEBUG will log passwords in plain text.
To manage notifications about this bug go to:
https://bugs.launchpad.net/horizon/+bug/1004114/+subscriptions