gluster
GlusterFS Logs Exposing Credentials at INFO Log Level
While working with GlusterFS, we observed that when the log level is set to INFO, sensitive information such as usernames and passwords (e.g., for volume mounts or authentication) are being written to the logs. This poses a security risk, especially in production environments where logs are collected and stored centrally for auditing or debugging.
Is it possible to either:
- Mask or redact sensitive fields (e.g., replace with ****)
- Provide a configuration option to disable logging of sensitive data entirely?
@vbellur mentions in https://github.com/gluster/glusterfs/issues/1137 the read-only nature of the logs is to mask these credentials from non root users, which i guess achieves this in some sense. My use case though required these logs to be collected and stored, and sometimes audited, and having these credentials in them is of some concern.
