apache
Password in plaintext in management and access logs
ISSUE TYPE
- Bug Report
COMPONENT NAME
Logs
CLOUDSTACK VERSION
4.19.1.0, 4.18.1.0
CONFIGURATION
OS / ENVIRONMENT
SUMMARY
Password and sensitive information are shown in plaintext in the management and access logs on the management server.
STEPS TO REPRODUCE
Looking in log files.
EXPECTED RESULTS
No sensitive passwords or secrets in logs
ACTUAL RESULTS
/var/log/cloudstack/management/access.log:1077542308:10.30.0.61 - - [09/Aug/2024:16:42:01 +0000] "GET /client/api?account=joe-again-1286&apiKey=<apikey>&command=addVpnUser&domainid=c91a0528-377b-48aa-9c7b-2c7ead68200d&password=TOPSECRETPASSWORD&response=json&username=seantest2&signature=Ek%2BC7EGsrmNi0ONFL%2BxJBJxSGe0%3D HTTP/1.1" 200 115 "-" "GuzzleHttp/7" 86
/var/log/cloudstack/management/management-server.log:122775505:{u'vpn_users': [{u'add': True, u'password': u'TOPSECRETPASSWORD', u'user': u'seantest2'}], u'type': u'vpnuserlist', u'delete_from_processed_cache': False}
Thanks for opening your first issue here! Be sure to follow the issue template!
![boring-cyborg[bot] avatar](https://avatars.githubusercontent.com/in/50386?v=4 "Published by a pub.dev verified publisher"){kind=small}
@rohityadavcloud Is there anyway this can be bumped up to a release sooner than 4.20.0.0? Being that this is a Security and Auditing issue, It would be nice to have this resolved sooner than later.
the first issue with access.log has been discussed before
users can redirect the file access.log to /dev/null as suggested by @DaanHoogland
the second issue (vpn user password are displayed in management-server.log) seems to only impact vpn user. I was able to reproduce the issue. it may not deserve a security release. I will have a look
cc @rohityadavcloud @DaanHoogland @sureshanaparti
the first issue with
access.loghas been discussed before users can redirect the file access.log to /dev/null as suggested by @DaanHooglandthe second issue (vpn user password are displayed in management-server.log) seems to only impact vpn user. I was able to reproduce the issue. it may not deserve a security release. I will have a look
cc @rohityadavcloud @DaanHoogland @sureshanaparti
@DaanHoogland do you have the link to what @weizhouapache is talking about for the access.log to /dev/null?
Depending on what that says, I'm not sure if that is an acceptable solution for me, because I want to see the access.log, but I don't want to see the passwords in it.
Depending on what that says, I'm not sure if that is an acceptable solution for me, because I want to see the
access.log, but I don't want to see the passwords in it.
in that case it is not acceptable for you and you'll need to sanitise the access log somehow.
Depending on what that says, I'm not sure if that is an acceptable solution for me, because I want to see the
access.log, but I don't want to see the passwords in it.in that case it is not acceptable for you and you'll need to sanitise the access log somehow.
But It makes more sense ( from a security perspective ) to not have the passwords/secrets hit the log in the first place. Sanitizing it after the fact is kinda pointless.
@rohityadavcloud @weizhouapache Can you please look into removing or obfuscating password information that is making it to access.log or any log for that matter from the actual code and not a retro solution or access.log > /dev/null ?
Depending on what that says, I'm not sure if that is an acceptable solution for me, because I want to see the
access.log, but I don't want to see the passwords in it.in that case it is not acceptable for you and you'll need to sanitise the access log somehow.
But It makes more sense ( from a security perspective ) to not have the passwords/secrets hit the log in the first place. Sanitizing it after the fact is kinda pointless.
@rohityadavcloud @weizhouapache Can you please look into removing or obfuscating password information that is making it to access.log or any log for that matter from the actual code and not a retro solution or access.log > /dev/null ?
it looks like all credentials in access.log are plain text.
ACS uses NCSARequestLog class to log request logs. I am not sure if it is possible to hide some information
If not , then need to look for another solution.
at this moment, I think you have to make a decision @CodeBleu since the API calls are also saved in apilog.log and management-server.log, maybe you can just redirect access.log to /dev/null
Fixed by https://github.com/apache/cloudstack/pull/9568 - pl review and reopen if necessary or something got missed.
