Uploaded image for project: 'Satellite'
  1. Satellite
  2. SAT-30137

Password from HTTP(S) proxy Setting is logged in plaintext to production.log

XMLWordPrintable

    • Enhancement
    • Hide
      .`http_proxy` encrypts URL credentials

      With this update, URL-embedded credentials, for example, `\https://user:password@proxy.example.com`, are automatically encrypted in the `http_proxy` setting.
      By preventing the exposure of sensitive authentication information in plain text, this update enhances security and prevents credential exposure while maintaining functionality.
      Show
      .`http_proxy` encrypts URL credentials With this update, URL-embedded credentials, for example, `\ https://user: password@proxy.example.com `, are automatically encrypted in the `http_proxy` setting. By preventing the exposure of sensitive authentication information in plain text, this update enhances security and prevents credential exposure while maintaining functionality.
    • Done
    • Manual

      Description of problem:
      When specifying credentials in HTTP(S) Proxy in Satellite Settings, the password can be logged in plaintext into `production.log`. While the logfile is accessible by `root` and `foreman` users only, it is still a door to a security problem (currently, sosreport collects the file without redacting the password; I will fix that).

      It is worth obfuscating the password directly in the logfile.
       

      How reproducible:
      100%

       

      Is this issue a regression from an earlier version:
      Probably not.

       

      Steps to Reproduce:

      1. WebUI -> Settings -> HTTP(S) Proxy -> put there e.g. `https://USER:SECRETPASSWORD@squid-server:3128` (where `squid-server` is an address of your proxy)

      2. Update the value anyhow (to see other log entry with password)

      3. open WebUI -> Content -> Subscriptions (or any other page that triggers an outgoing request)

      Actual behavior:
      1. and 2. and 3. subsequently trigger logs:

      2024-12-12T15:27:03 [I|aud|68392978] Setting (7) create event on value --- https://USER:SECRETPASSWORD@localhost:443
      2024-12-12T16:15:59 [I|aud|e44a4430] Setting (7) update event on value --- https://USER:SECRETPASSWORD@localhost:443, --- https://USER:SECRETPASSWORD@pmoravec-rhel9:3128
      2024-12-12T16:16:21 [I|app|d6afc88a] (RestClient) Proxying request to subscription.rhsm.redhat.com via https://USER:SECRETPASSWORD@pmoravec-rhel9:3128
      

      Expected behavior:
      No password present in the logfile.

      Business Impact / Additional info:

      The customer also sees logs like:

      8d25bf63 | ..., --- http://USER:PASSWORD@1.2.3.4:8080
      

      that I am unable to reproduce. Anyway I assume the fix will be generic enough to ensure any logging of the proxy URL will have credentials obfuscated.

              rh-ee-nalfassi Nofar Alfassi
              rhn-support-pmoravec Pavel Moravec
              Gaurav Talreja Gaurav Talreja
              Jan Fiala Jan Fiala
              Shimon Shtein Shimon Shtein
              Votes:
              0 Vote for this issue
              Watchers:
              11 Start watching this issue

                Created:
                Updated:
                Resolved: