Configuration file /etc/tendrl/etcd.yml with etcd root password is readable for every account

[mbukatov]

Description

Configuration file /etc/tendrl/etcd.yml can now contain username and password for etcd admin access, but the file is still packaged as world readable.

Version

Latest snapshot build from master branch (it's part of upcoming 1.5.2 version):

tendrl-api-1.5.2-20170916T041838.48452aa.noarch

Details

Details including reproducer, actual and expected results are similar to Tendrl/monitoring-integration#125, which you can refer to for more details:

# grep :password: /etc/tendrl/etcd.yml
  :password: 'twZONmWfcaSJayIlIzrQaNyBhusDVx'
  :password: 'twZONmWfcaSJayIlIzrQaNyBhusDVx'
  :password: 'twZONmWfcaSJayIlIzrQaNyBhusDVx'
# rpm -qf /etc/tendrl/etcd.yml
tendrl-api-1.5.2-20170916T041838.48452aa.noarch
# ls -l /etc/tendrl/etcd.yml
-rw-r--r--. 1 root root 405 Sep 18 12:58 /etc/tendrl/etcd.yml
# rpm -qV tendrl-api
S.5....T.  c /etc/tendrl/etcd.yml

[mbukatov]

Package tendrl-api-1.5.2-20170921T125939.61d8945.noarch is still affected.

[mbukatov]

@sidhax this seems like security related issue

[anivargi]

@mbukatov we don't have support for username and password based etcd auth anymore, is this still relevant?

[mbukatov]

@anivargi that is true, the support for password authentication has been removed, but now I see an option to provide passphrase (I guess that it's a passphrase for the ssl private key, right?), so it seems to me that it is still relevant.

[TimothyAsirJeyasing]

It is fixed now, We can close this.