Fuel for OpenStack

plain text passwords in cloud-init templates

Bug #1553236 reported by Alexander Gordeev
256
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Fuel for OpenStack
Fix Committed
High
Anil Shashikumar Belur
Fuel for OpenStack 9.0
6.1.x
Invalid
High
MOS Maintenance
Fuel for OpenStack 6.1-updates
7.0.x
Invalid
High
MOS Maintenance
Fuel for OpenStack 7.0-updates
8.0.x
Invalid
High
MOS Maintenance
Fuel for OpenStack 8.0-updates

Bug Description

Detailed bug description:

for some technical reasons we have had plain text passwords stored into cloud-init templates

https://github.com/openstack/fuel-agent/blob/master/cloud-init-templates/cloud_config_ubuntu.jinja2#L10

for security reason, those passwords should be put into cloud-init config templates encrypted by crypt (3)

Steps to reproduce:
deploy any node, take a look at cloud-init configs. (it's a 20M partition, iso9660

Expected results:
cloud-init configs shouldn't contain plain text passwords.

Actual result:
plain text passwords in clod-init configs

Reproducibility:
every time

Description of the environment:
fuel master/9.0

Revision history for this message
Alexander Gordeev (a-gordeev) wrote :

the fix depends on https://review.openstack.org/#/c/277353

Alexander Kislitsky (akislitsky)
tags: added: area-python
Changed in fuel:
importance: Undecided → High
status: New → Confirmed
Revision history for this message
Anil Shashikumar Belur (askb23) wrote :

Hi, I would like to help on this issue, If no one else if presently working.

Changed in fuel:
assignee: Fuel Python Team (fuel-python) → Anil Shashikumar Belur (askb23)
Revision history for this message
Anil Shashikumar Belur (askb23) wrote :

The cloud-config uses a `plain_text_passwd: {{ user.password }}` which creates a security issues. So based on the changes being worked on in https://review.openstack.org/#/c/277353. The cloud-config file, need to be replace plain text with a hash value of password `passwd: {{ user.password }}`. Please confirm ?

Revision history for this message
Alexander Gordeev (a-gordeev) wrote :

Anil, no, but you're on the right way.

the idea is to switch to `hashed_password` property instead of plain text password.

https://review.openstack.org/#/c/277353/14/fuel_agent/objects/users.py@32

therefore,

the cloud-config file needs plain text password to be replaced with a hashed value of password, ie: `passwd: {{ user.hashed_password }}`.

then `passwd` value will be passed to `useradd` cli tool

https://github.com/number5/cloud-init/blob/0.7.5/cloudinit/distros/__init__.py#L317

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to fuel-agent (master)

Fix proposed to branch: master
Review: https://review.openstack.org/294540

Changed in fuel:
status: Confirmed → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to fuel-agent (master)

Reviewed: https://review.openstack.org/294540
Committed: https://git.openstack.org/cgit/openstack/fuel-agent/commit/?id=2c93034a2b7c8b3d8111ac3dc9aca8792d177046
Submitter: Jenkins
Branch: master

commit 2c93034a2b7c8b3d8111ac3dc9aca8792d177046
Author: Anil Belur <email address hidden>
Date: Fri Mar 18 17:12:54 2016 +0530

    Fixes #1553236 - remove plain text passwords in cloud-init templates

    The cloud-config uses a `plain_text_passwd: {{ user.password }}` which
    could create potential security issues.

    Therefore the cloud-config file, requires the 'plain text password'
    replaced with a 'hashed password'.

    Closes-bug: #1553236
    Change-Id: Ic0c5992b5302f84819498ccd311cf19224142fa5
    Signed-off-by: Anil Belur <email address hidden>

Changed in fuel:
status: In Progress → Fix Committed
Revision history for this message
Adam Heczko (aheczko-mirantis) wrote :

Does this bug affects also previous Fuel versions? 8.0, 7.0, 6.1, 6.0? Thanks.

tags: added: feature-security
Revision history for this message
Rodion Tikunov (rtikunov) wrote :

MOS <=8.0 does not have this option in cloud-init config.
So closed as Invalid.

To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.