#1948 Leaks KDC password and master password via command line arguments
Closed: Fixed None Opened 10 years ago by dpal.

Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=744373 [[BR]]
RHEL: https://bugzilla.redhat.com/show_bug.cgi?id=744422

ipa-server leaks KDC password and master password via command line arguments, 
in krbinstance.py --> (in both IPAv1 and IPAv2) 
the following code can be found

class KrbInstance(service.Service):

    def __create_instance(self, replica=False):

        if not replica:
            #populate the directory with the realm structure
            args = ["kdb5_ldap_util", "-D", "uid=kdc,cn=sysaccounts,cn=etc,"+self.suffix, "-w", self.kdc_password, "create", "-s", "-P", self.master_password, "-r", self.realm, "-subtrees", self.suffix, "-sscope", "sub"]
                ipautil.run(args, nolog=(self.kdc_password, self.master_password))
            except ipautil.CalledProcessError, e:
                print "Failed to populate the realm structure in kerberos", e

so if the code under 
        if not replica:
gets executed the kdc_password and master_password will be leaked on the system (one should be able to use ps -ef to view the leaked  password information).

kdb5_ldap_util recommends against the use of -P and -w.
I haven't verified this bug as I do not have a working copy of Fedora or RHEL to test on.

I closed RHEL BZ 745580 as duplicate to 744422 - it has been already cloned for RHEL.

Metadata Update from @dpal:
- Issue assigned to jcholast
- Issue set to the milestone: FreeIPA 2.1.3 (bug fixing)

5 years ago

Login to comment on this ticket.