#3956 [Security] Improve plain text password handling in code
Closed: cloned-to-github 3 years ago by pbrezina. Opened 5 years ago by huzaifas.

This is about:
https://labs.portcullis.co.uk/blog/an-offensive-introduction-to-active-directory-on-unix/

After some discussions i think we can make this better my using the following:

  1. Use PR_SET_DUMPABLE for pages which have passwords etc, to ensure
    that coredumps dont contain cleartext passwords.

  2. Use SGX when available
    https://en.wikipedia.org/wiki/Software_Guard_Extensions

  3. Lastly and more importantly fedora has explicit_bzero which you
    should use rather manually scrub memory. Please see
    https://www.gnu.org/software/libc/manual/html_node/Erasing-Sensitive-Data.html
    This is not optimized by the compiler.


Metadata Update from @atikhonov:
- Issue assigned to atikhonov

4 years ago

Commit 0a6fdec relates to this ticket

Commit 109c21e relates to this ticket

Commit ad1ae00 relates to this ticket

Commit 275e062 relates to this ticket

Commit 0165ef1 relates to this ticket

Commit f2245b5 relates to this ticket

  • master
    • 0a6fdec - LDAP: proper handling of master password
    • 109c21e - util/authtok: set destructor in sss_authtok_new()
    • ad1ae00 - db/sysdb_ops: proper zeroization of sensitive data
    • 275e062 - util/sha512_crypt_r: proper zeroization of sensitive data
    • 1f667ea - util/sha512_crypt_r: removed misleading comments
    • 78127ea - util/sha512_crypt_r: got rid of redundant mem align
    • be7f731 - util: fixed potential mem leak in s3crypt_gen_salt()
    • 0165ef1 - tools/sss_seed: proper zeroization of sensitive data
    • f2245b5 - util/memory: helper(s) to securely erase mem was reworked
    • b72c4fa - util/memory: sanitization

Alexey, did the patches fix this ticket? If yes, please close it.

Metadata Update from @pbrezina:
- Issue tagged with: Future milestone

4 years ago

Alexey, did the patches fix this ticket?

No. Only item (3) is partially addressed. Another question if we want (1) and (2) to be done.

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4930

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Metadata Update from @pbrezina:
- Issue close_status updated to: cloned-to-github
- Issue status updated to: Closed (was: Open)

3 years ago

Login to comment on this ticket.

Metadata