Configuration file node-agent.conf.yaml with etcd root password is readable for every account

[mbukatov]

Description

Configuration file /etc/tendrl/node-agent/node-agent.conf.yaml can now contain username and password for etcd admin access, but the file is still packaged as world readable.

Version

Latest snapshot build from master branch (it's part of upcoming 1.5.2 version):

tendrl-node-agent-1.5.2-20170916T041433.436cac0.noarch

Details

Details including steps to reproduce, actual results and expected results are the same as in Tendrl/monitoring-integration#125, the only difference is the name of affected package and configuration file.

# grep etcd_password /etc/tendrl/node-agent/node-agent.conf.yaml
etcd_password: twZONmWfcaSJayIlIzrQaNyBhusDVx
# ls -l /etc/tendrl/node-agent/node-agent.conf.yaml
-rw-r--r--. 1 root root 696 Sep 18 13:06 /etc/tendrl/node-agent/node-agent.conf.yaml
# rpm -qcV tendrl-node-agent
S.5....T.  c /etc/tendrl/node-agent/node-agent.conf.yaml

[r0h4n]

Fixed, let me know if needs more changes @mbukatov

[mbukatov]

@sidhax this seems like security related issue, with a proposed fix (now it's on me to verify it)

[mbukatov]

Checking tendrl-node-agent-1.5.2-20170922T094941.ced9876.noarch and it seems fixed:

# ls -l /etc/tendrl/node-agent/node-agent.conf.yaml
-rw-r-----. 1 root root 694 Sep 26 05:52 /etc/tendrl/node-agent/node-agent.conf.yaml
# rpm -qcV tendrl-node-agent
S.5....T.  c /etc/tendrl/node-agent/node-agent.conf.yaml