Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=744373 [[BR]] RHEL: https://bugzilla.redhat.com/show_bug.cgi?id=744422
ipa-server leaks KDC password and master password via command line arguments, in krbinstance.py --> (in both IPAv1 and IPAv2) the following code can be found class KrbInstance(service.Service): ... .. def __create_instance(self, replica=False): self.__template_file("/var/kerberos/krb5kdc/kdc.conf") self.__template_file("/etc/krb5.conf") self.__template_file("/usr/share/ipa/html/krb5.ini") self.__template_file("/usr/share/ipa/html/krb.con") self.__template_file("/usr/share/ipa/html/krbrealm.con") if not replica: #populate the directory with the realm structure args = ["kdb5_ldap_util", "-D", "uid=kdc,cn=sysaccounts,cn=etc,"+self.suffix, "-w", self.kdc_password, "create", "-s", "-P", self.master_password, "-r", self.realm, "-subtrees", self.suffix, "-sscope", "sub"] try: ipautil.run(args, nolog=(self.kdc_password, self.master_password)) except ipautil.CalledProcessError, e: print "Failed to populate the realm structure in kerberos", e so if the code under if not replica: gets executed the kdc_password and master_password will be leaked on the system (one should be able to use ps -ef to view the leaked password information). kdb5_ldap_util recommends against the use of -P and -w. I haven't verified this bug as I do not have a working copy of Fedora or RHEL to test on.
master: 0d823dd
ipa-2-1: 7a5d906
RHEL bug https://bugzilla.redhat.com/show_bug.cgi?id=745580
I closed RHEL BZ 745580 as duplicate to 744422 - it has been already cloned for RHEL.
Metadata Update from @dpal: - Issue assigned to jcholast - Issue set to the milestone: FreeIPA 2.1.3 (bug fixing)
Login to comment on this ticket.