Uploaded image for project: 'Couchbase Server'
  1. Couchbase Server
  2. MB-8704

cbcollect_info output should not contain clear text password

    XMLWordPrintable

Details

    • Bug
    • Resolution: Duplicate
    • Critical
    • 2.2.0
    • 2.1.0
    • ns_server, tools
    • Security Level: Public

    Description

      At present cbcollect_info the output contains clear text of password. This is a potential security hole for cluster. Here are some examples that contain the clear text password:

      (The password in the examples is couchbase)

      couchbase.log: {creds,[{"Administrator",[

      {password,"couchbase"}

      ]}]}]},
      diag.log:['curl', '-sS', '-u', 'Administrator:couchbase', 'http://127.0.0.1:8091/diag?noLogs=1']
      diag.log: {creds,[{"Administrator",[

      {password,'filtered-out'}]}]}]},
      diag.log: {creds,[{"Administrator",[{password,'filtered-out'}

      ]}]}]},
      diag.log: {creds,[{"Administrator",[

      {password,'filtered-out'}]}]}]},
      diag.log: {creds,[{"Administrator",[{password,'filtered-out'}

      ]}]}]},

      The diag.log is trying to filter out the clear text password. But the password is still showing in the curl command.

      Attachments

        Issue Links

          No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

              alkondratenko Aleksey Kondratenko (Inactive)
              larry Larry Liu [X] (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Gerrit Reviews

                  There are no open Gerrit changes

                  PagerDuty