Skip to content

Commit dd0b863

Browse files
YLChen-007cyl-authDaanHooglandabh1sarsureshanaparti
authored
sensitive information leak to log (#12018)
* sensitive information leak to log * Update agent/src/main/java/com/cloud/agent/resource/consoleproxy/ConsoleProxyResource.java * Update core/src/main/java/com/cloud/storage/template/HttpTemplateDownloader.java * Update engine/schema/src/main/java/com/cloud/upgrade/DatabaseCreator.java * Update plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalDnsmasqResource.java * Update plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalDnsmasqResource.java * Update plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalKickStartPxeResource.java * Update plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalPingPxeResource.java * Update plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalPingPxeResource.java * Update plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalPingPxeResource.java * Update utils/src/main/java/com/cloud/utils/UriUtils.java Co-authored-by: dahn <daan.hoogland@gmail.com> * Update plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalKickStartPxeResource.java Co-authored-by: Abhisar Sinha <63767682+abh1sar@users.noreply.github.com> * Sync with 4.20 and fix conflict in BaremetalPingPxeResource * Apply suggestions from code review Co-authored-by: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com> --------- Co-authored-by: chenyoulong20g@ict.ac.cn <chenyoulong20g@ict.ac.cn> Co-authored-by: dahn <daan.hoogland@gmail.com> Co-authored-by: dahn <daan@onecht.net> Co-authored-by: Abhisar Sinha <63767682+abh1sar@users.noreply.github.com> Co-authored-by: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
1 parent c0b5358 commit dd0b863

File tree

5 files changed

+17
-13
lines changed

5 files changed

+17
-13
lines changed

‎agent/src/main/java/com/cloud/agent/resource/consoleproxy/ConsoleProxyResource.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -331,7 +331,7 @@ private void launchConsoleProxy(final byte[] ksBits, final String ksPassword, fi
331331
final Object resource = this;
332332
logger.info("Building class loader for com.cloud.consoleproxy.ConsoleProxy");
333333
if (consoleProxyMain == null) {
334-
logger.info("Running com.cloud.consoleproxy.ConsoleProxy with encryptor password={}", encryptorPassword);
334+
logger.info("Running com.cloud.consoleproxy.ConsoleProxy");
335335
consoleProxyMain = new Thread(new ManagedContextRunnable() {
336336
@Override
337337
protected void runInContext() {

‎plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalDnsmasqResource.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,10 +46,10 @@ public boolean configure(String name, Map<String, Object> params) throws Configu
4646
com.trilead.ssh2.Connection sshConnection = null;
4747
try {
4848
super.configure(name, params);
49-
logger.debug(String.format("Trying to connect to DHCP server(IP=%1$s, username=%2$s, password=%3$s)", _ip, _username, _password));
49+
logger.debug(String.format("Trying to connect to DHCP server(IP=%1$s, username=%2$s", _ip, _username));
5050
sshConnection = SSHCmdHelper.acquireAuthorizedConnection(_ip, _username, _password);
5151
if (sshConnection == null) {
52-
throw new ConfigurationException(String.format("Cannot connect to DHCP server(IP=%1$s, username=%2$s, password=%3$s", _ip, _username, _password));
52+
throw new ConfigurationException(String.format("Cannot connect to DHCP server(IP=%1$s, username=%2$s", _ip, _username));
5353
}
5454

5555
if (!SSHCmdHelper.sshExecuteCmd(sshConnection, "[ -f '/usr/sbin/dnsmasq' ]")) {

‎plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalKickStartPxeResource.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -130,8 +130,8 @@ private Answer execute(VmDataCommand cmd) {
130130

131131
sshConnection.connect(null, 60000, 60000);
132132
if (!sshConnection.authenticateWithPassword(_username, _password)) {
133-
logger.debug("SSH Failed to authenticate");
134-
throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s, password=%3$s", _ip, _username, _password));
133+
logger.debug("SSH Failed to authenticate with user {} credentials", _username);
134+
throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s", _ip, _username));
135135
}
136136

137137
String script = String.format("python /usr/bin/baremetal_user_data.py '%s'", arg);
@@ -167,7 +167,7 @@ private Answer execute(PrepareKickstartPxeServerCommand cmd) {
167167
sshConnection.connect(null, 60000, 60000);
168168
if (!sshConnection.authenticateWithPassword(_username, _password)) {
169169
logger.debug("SSH Failed to authenticate");
170-
throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s, password=%3$s", _ip, _username, _password));
170+
throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s", _ip, _username));
171171
}
172172

173173
String copyTo = String.format("%s/%s", _tftpDir, cmd.getTemplateUuid());

‎plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalPingPxeResource.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ public boolean configure(String name, Map<String, Object> params) throws Configu
101101
sshConnection.connect(null, 60000, 60000);
102102
if (!sshConnection.authenticateWithPassword(_username, _password)) {
103103
logger.debug("SSH Failed to authenticate");
104-
throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s, password=%3$s", _ip, _username, "******"));
104+
throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s, password=******", _ip, _username));
105105
}
106106

107107
String cmd = String.format("[ -f /%1$s/pxelinux.0 ] && [ -f /%2$s/kernel ] && [ -f /%3$s/initrd.gz ] ", _tftpDir, _tftpDir, _tftpDir);
@@ -150,8 +150,8 @@ protected PreparePxeServerAnswer execute(PreparePxeServerCommand cmd) {
150150
try {
151151
sshConnection.connect(null, 60000, 60000);
152152
if (!sshConnection.authenticateWithPassword(_username, _password)) {
153-
logger.debug("SSH Failed to authenticate");
154-
throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s, password=%3$s", _ip, _username, _password));
153+
logger.debug("SSH Failed to authenticate with user {} credentials", _username);
154+
throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s", _ip, _username));
155155
}
156156

157157
String script =
@@ -179,7 +179,7 @@ protected Answer execute(PrepareCreateTemplateCommand cmd) {
179179
sshConnection.connect(null, 60000, 60000);
180180
if (!sshConnection.authenticateWithPassword(_username, _password)) {
181181
logger.debug("SSH Failed to authenticate");
182-
throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s, password=%3$s", _ip, _username, _password));
182+
throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s", _ip, _username));
183183
}
184184

185185
String script =
@@ -237,7 +237,7 @@ private Answer execute(VmDataCommand cmd) {
237237
sshConnection.connect(null, 60000, 60000);
238238
if (!sshConnection.authenticateWithPassword(_username, _password)) {
239239
logger.debug("SSH Failed to authenticate");
240-
throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s, password=%3$s", _ip, _username, _password));
240+
throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s", _ip, _username));
241241
}
242242

243243
String script = String.format("python /usr/bin/baremetal_user_data.py '%s'", arg);

‎utils/src/main/java/com/cloud/utils/UriUtils.java‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -500,8 +500,12 @@ public static InputStream getInputStreamFromUrl(String url, String user, String
500500
if ((user != null) && (password != null)) {
501501
httpclient.getParams().setAuthenticationPreemptive(true);
502502
Credentials defaultcreds = new UsernamePasswordCredentials(user, password);
503-
httpclient.getState().setCredentials(new AuthScope(hostAndPort.first(), hostAndPort.second(), AuthScope.ANY_REALM), defaultcreds);
504-
LOGGER.info("Added username=" + user + ", password=" + password + "for host " + hostAndPort.first() + ":" + hostAndPort.second());
503+
httpclient.getState().setCredentials(
504+
new AuthScope(hostAndPort.first(), hostAndPort.second(), AuthScope.ANY_REALM), defaultcreds);
505+
LOGGER.info("Added username={} along with password for host {}:{}"
506+
, user
507+
, hostAndPort.first()
508+
, hostAndPort.second());
505509
}
506510
// Execute the method.
507511
GetMethod method = new GetMethod(url);

0 commit comments

Comments
 (0)