OpenStack module collects secrets about sos HOT 7 CLOSED

What other secrets could there be here that we need to handle?

from sos.

Some passwords may go to the logs as well, if the verbosity is set high enough.

from sos.

Ugh.. I'm not sure without more detail whether to consider that as an application bug or not. I think it's hard to justify logging authentication secrets without an extremely good reason (like: you're debugging the use of those secrets but that should really be a developer/build option not a config setting).

But if that's the way it is we probably still need to cope with it - as long as the secrets are easily substitutable we can handle that.

from sos.

/etc/keystone/keystonce.conf which contains:
[keystone_authtoken]
...
admin_password = servicepass

[keystone_authtoken] section is not in keystone.conf but in
/etc/nova/nova.conf
/etc/glance/glance-*.conf
/etc/cinder/cinder.conf
/etc/quantum/quantum.conf

Privacy-sensitive parameters in keystone.conf are:
[DEFAULT]
admin_token = XXXXXXXXXXXX
[sql]
connection = mysql://keystone:XXXXXX@localhost/keystone
[ldap]
password = XXXXXXXX

from sos.

Some passwords may go to the logs as well, if the verbosity is set high enough.

Please file bugs, passwords should never be logged!

from sos.

[keystone_authtoken] section is not in keystone.conf but in
/etc/nova/nova.conf
/etc/glance/glance-*.conf
/etc/cinder/cinder.conf
/etc/quantum/quantum.conf

Whats the details on these files as far as keystone_authtoken is concerned?

from sos.

fixed in 6c5f4a9

from sos.