mirror of
https://github.com/xcat2/xcat-core.git
synced 2026-09-05 04:27:55 +00:00
Vinícius Ferrão
0d6929c427
Six modules wrote passwords to their own log and diagnostic messages, outside the daemon redaction pipeline. The z/VM plugin logged each smcli command line through printSyslog, with the disk read, write and multi passwords, the image password, the provision root password and the page volume parm disk password, passed the real disk passwords to checkSSH_Rc, which echoes the command to syslog and to the client on failure, and logged raw directory entries whose USER and MDISK statements carry the logon and disk passwords. The bmcconfig plugin logged the BMC password in its attribute report, in syslog and in the command response. The energy plugin logged the HCP password in a verbose message, and the CIM utilities dumped the whole HTTP request, with its basic authorization header, to the verbose callback. The PPC configuration module logged the HMC, FSP and BPA passwords in its verbose credential reports. Mask the passwords in the logged text. The executed commands keep the real values. The page volume log string is built by operand position, so a decoy value in another operand cannot divert the mask. The checkSSH_Rc calls receive the masked command string, as the routine documentation asks. Add redact_directory_entry to the z/VM utilities. The routine masks the USER, IDENTITY and IDENT logon password, the MDISK passwords after the access mode in the range form and in the DEVNO, V-DISK and T-DISK forms, the APPCPASS statement, and the keyword password assignments in the short and the full spelling. The match separators stay on one line, so a record without passwords never masks the record below it, and one or more comment stars do not hide a credential record from the rules. The COMMAND statement masks whole, because it can start any CP command with an inline password. Every directory query sink logs through it, and the clone loops redact the query output at the source, because the failure checker and the retained disk list reuse the text. The directory helpers keep their raw return value for the callers and hand a redacted copy to the failure checker. Every error branch that echoes a fetched record after the output check does so through the redactor, because a password can spell an error word and trip the check: the directory fetch, the mini disk keyword fetch, and the four disk list callers. The CIM dump masks the authorization header. The bmcconfig report now names the password state, set or missing, which the report needs for diagnosis.