yahoo-eng-team team mailing list archive

[Dolph Mathews <1443598@xxxxxxxxxxxxxxxxxx>]

https://review.openstack.org/#/c/173034/

** Changed in: keystone
   Importance: Undecided => High

** Tags added: juno-backport-potential

** Tags added: icehouse-backport-potential kilo-backport-potential

** Also affects: keystone/icehouse
   Importance: Undecided
       Status: New

** Also affects: keystone/juno
   Importance: Undecided
       Status: New

** Also affects: keystone/kilo
   Importance: Undecided
       Status: New

** Changed in: keystone/kilo
   Importance: Undecided => High

** Changed in: keystone/icehouse
   Importance: Undecided => High

** Changed in: keystone/juno
       Status: New => Triaged

** Changed in: keystone/kilo
       Status: New => Triaged

** Changed in: keystone/icehouse
       Status: New => Triaged

** Changed in: keystone/juno
   Importance: Undecided => High

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1443598

Title:
  backend_argument containing a password leaked in logs

Status in OpenStack Identity (Keystone):
  In Progress
Status in Keystone icehouse series:
  Triaged
Status in Keystone juno series:
  Triaged
Status in Keystone kilo series:
  Triaged

Bug description:
  The keystone.conf has an option backend_argument to set various
  options for the caching backend.  As documented, some of the potential
  values can contain a password.

  Snippet from
  http://docs.openstack.org/developer/keystone/developing.html#dogpile-
  cache-based-mongodb-nosql-backend

  [cache]
  # Global cache functionality toggle.
  enabled = True

  # Referring to specific cache backend
  backend = keystone.cache.mongo

  # Backend specific configuration arguments
  backend_argument = db_hosts:localhost:27017
  backend_argument = db_name:ks_cache
  backend_argument = cache_collection:cache
  backend_argument = username:test_user
  backend_argument = password:test_password

  As a result, passwords can be leaked to the keystone logs since the
  config options is not marked secret.

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1443598/+subscriptions