----- Original Message ----- > From: "Alon Bar-Lev" <alonbl(a)redhat.com&gt; > To: "engine-devel" <engine-devel(a)ovirt.org&gt; > Cc: "Yair Zaslavsky" <yzaslavs(a)redhat.com&gt;, "Eli Mesika" < emesika(a)redhat.com&gt;, "Juan Hernandez" <jhernand(a)redhat.com&gt; > Sent: Tuesday, April 30, 2013 10:41:20 PM > Subject: Dropping encryption of database password > > Hello, > > Currently we store database password encrypted using > org.picketbox.datasource.security.SecureIdentityLoginModule. > > This is reverse encryption with common knowledge shared secret. > > Using encryption with common knowledge shared secret is close to void > protection. > > So far we also stored the password as plain text at > /etc/ovirt-engine/.pgpass, this is going to be removed as no component > actually uses the .pgpass, however we do need to store non-java specific > password in for utilities. > > In master (aiming to 3.3), we store the database connection details in own > file /etc/ovirt-engine/engine.conf.d/50-setup-database.conf owned by ovirt > user and not world readable. > > I would like to use the same 50-setup-database.conf to store plain text > password and remove the java specific reversible encrypted password usage. > > Bottom line... > 1. We drop the .pgpass file. > 2. We store database connection information in > /etc/ovirt-engine/engine.conf.d/<file> that is readable only by ovirt usage. > 3. We drop the java specific reversible encryption in favor of plain text. > > Thoughts? I see no problem in the .pgpass , only root can access it (it has 0600 mode , if it doesn't it is ignored by PG) Apart from that , this is the standard way used by PG so why not using it , AFAIK this is considered safe & secured > Alon > _______________________________________________ Engine-devel mailing list Engine-devel(a)ovirt.org http://lists.ovirt.org/mailman/listinfo/engine-devel

From: "Eli Mesika" <emesika(a)redhat.com&gt; To: "Alon Bar-Lev" <alonbl(a)redhat.com&gt; Cc: "engine-devel" <engine-devel(a)ovirt.org&gt;, "Yair Zaslavsky" <yzaslavs(a)redhat.com&gt;, "Juan Hernandez" <jhernand(a)redhat.com&gt; Sent: Wednesday, May 1, 2013 3:45:06 AM Subject: Re: Dropping encryption of database password ----- Original Message ----- > From: "Alon Bar-Lev" <alonbl(a)redhat.com&gt; > To: "engine-devel" <engine-devel(a)ovirt.org&gt; > Cc: "Yair Zaslavsky" <yzaslavs(a)redhat.com&gt;, "Eli Mesika" > <emesika(a)redhat.com&gt;, "Juan Hernandez" <jhernand(a)redhat.com&gt; > Sent: Tuesday, April 30, 2013 10:41:20 PM > Subject: Dropping encryption of database password > > Hello, > > Currently we store database password encrypted using > org.picketbox.datasource.security.SecureIdentityLoginModule. > > This is reverse encryption with common knowledge shared secret. > > Using encryption with common knowledge shared secret is close to void > protection. > > So far we also stored the password as plain text at > /etc/ovirt-engine/.pgpass, this is going to be removed as no component > actually uses the .pgpass, however we do need to store non-java specific > password in for utilities. > > In master (aiming to 3.3), we store the database connection details in own > file /etc/ovirt-engine/engine.conf.d/50-setup-database.conf owned by ovirt > user and not world readable. > > I would like to use the same 50-setup-database.conf to store plain text > password and remove the java specific reversible encrypted password usage. > > Bottom line... > 1. We drop the .pgpass file. > 2. We store database connection information in > /etc/ovirt-engine/engine.conf.d/<file> that is readable only by ovirt > usage. > 3. We drop the java specific reversible encryption in favor of plain text. > > Thoughts? I see no problem in the .pgpass , only root can access it (it has 0600 mode , if it doesn't it is ignored by PG) Apart from that , this is the standard way used by PG so why not using it , AFAIK this is considered safe & secured

> Alon >

> > In another words you are for storing password as plain text.... :) If the file is protected , I don't mind that the password is in plain text...

> > > > > > > In another words you are for storing password as plain text.... :) > > > > If the file is protected , I don't mind that the password is in plain > > text... > > > > Hi all, Hello, > Itamar pointed me at this thread. I'm part of the Red Hat Product Security > Team, we exist to help various projects and products with security needs > (such as advice in this instance). > > I can't really comment on this without understanding some of the background > (sorry for not being up to speed, I don't have time to research this > today and I'm away tomorrow so my replies may be slow). > > Can you explain to me what the passwords in question are used for? The password of the user used to access the database.

Thank you. This is what I wrote in my initial post. The only users who should access this password is ovirt user and root user. Regards, Alon Bar-Lev. > >

From: "Alon Bar-Lev" <alonbl(a)redhat.com&gt; To: "Keith Robertson" <kroberts(a)redhat.com&gt; Cc: "Juan Hernandez" <jhernand(a)redhat.com&gt;, "engine-devel" <engine-devel(a)ovirt.org&gt;, "pmatouse" <pmatouse(a)redhat.com&gt; Sent: Wednesday, May 1, 2013 9:40:13 PM Subject: Re: [Engine-devel] Dropping encryption of database password ----- Original Message ----- > From: "Keith Robertson" <kroberts(a)redhat.com&gt; > To: "Alon Bar-Lev" <alonbl(a)redhat.com&gt; > Cc: "Josh Bressers" <bressers(a)redhat.com&gt;, "Juan Hernandez" > <jhernand(a)redhat.com&gt;, "engine-devel" > <engine-devel(a)ovirt.org&gt;, "pmatouse" <pmatouse(a)redhat.com&gt;, "Sandro > Bonazzola" <sbonazzo(a)redhat.com&gt; > Sent: Wednesday, May 1, 2013 9:31:15 PM > Subject: Re: [Engine-devel] Dropping encryption of database password > > On 05/01/2013 02:16 PM, Alon Bar-Lev wrote: > > Thank you. > > This is what I wrote in my initial post. > > The only users who should access this password is ovirt user and root > > user. > > > > Regards, > > Alon Bar-Lev. > > > >> > > Alon, > I agree with the desire to store the PW in plaintext and in a > non-obfuscated manner. In this case, obfuscation really doesn't gain > anything. > > I would suggest; however, that the migration to plaintext be coordinated > with a simultaneous patch to the the Log Collector. It does have a > dependency on the current architecture. > > Keith > Hi, As far as I know it reads the plain text from .pgpass, we need to modify it to search within the alternate format as well.

Thanks, Alon _______________________________________________ Engine-devel mailing list Engine-devel(a)ovirt.org http://lists.ovirt.org/mailman/listinfo/engine-devel

From: "Alon Bar-Lev" <alonbl(a)redhat.com&gt; To: "Eli Mesika" <emesika(a)redhat.com&gt; Cc: "Keith Robertson" <kroberts(a)redhat.com&gt;, "Juan Hernandez" <jhernand(a)redhat.com&gt;, "engine-devel" <engine-devel(a)ovirt.org&gt;, "pmatouse" <pmatouse(a)redhat.com&gt; Sent: Sunday, May 5, 2013 10:17:28 AM Subject: Re: [Engine-devel] Dropping encryption of database password ----- Original Message ----- > From: "Eli Mesika" <emesika(a)redhat.com&gt; > To: "Keith Robertson" <kroberts(a)redhat.com&gt;, "Alon Bar-Lev" > <alonbl(a)redhat.com&gt;, "Juan Hernandez" > <jhernand(a)redhat.com&gt; > Cc: "engine-devel" <engine-devel(a)ovirt.org&gt;, "pmatouse" > <pmatouse(a)redhat.com&gt; > Sent: Sunday, May 5, 2013 10:13:59 AM > Subject: Re: [Engine-devel] Dropping encryption of database password > > > > ----- Original Message ----- > > From: "Alon Bar-Lev" <alonbl(a)redhat.com&gt; > > To: "Keith Robertson" <kroberts(a)redhat.com&gt; > > Cc: "Juan Hernandez" <jhernand(a)redhat.com&gt;, "engine-devel" > > <engine-devel(a)ovirt.org&gt;, "pmatouse" <pmatouse(a)redhat.com&gt; > > Sent: Wednesday, May 1, 2013 9:40:13 PM > > Subject: Re: [Engine-devel] Dropping encryption of database password > > > > > > > > ----- Original Message ----- > > > From: "Keith Robertson" <kroberts(a)redhat.com&gt; > > > To: "Alon Bar-Lev" <alonbl(a)redhat.com&gt; > > > Cc: "Josh Bressers" <bressers(a)redhat.com&gt;, "Juan Hernandez" > > > <jhernand(a)redhat.com&gt;, "engine-devel" > > > <engine-devel(a)ovirt.org&gt;, "pmatouse" <pmatouse(a)redhat.com&gt;, "Sandro > > > Bonazzola" <sbonazzo(a)redhat.com&gt; > > > Sent: Wednesday, May 1, 2013 9:31:15 PM > > > Subject: Re: [Engine-devel] Dropping encryption of database password > > > > > > On 05/01/2013 02:16 PM, Alon Bar-Lev wrote: > > > > Thank you. > > > > This is what I wrote in my initial post. > > > > The only users who should access this password is ovirt user and root > > > > user. > > > > > > > > Regards, > > > > Alon Bar-Lev. > > > > > > > >> > > > > Alon, > > > I agree with the desire to store the PW in plaintext and in a > > > non-obfuscated manner. In this case, obfuscation really doesn't gain > > > anything. > > > > > > I would suggest; however, that the migration to plaintext be > > > coordinated > > > with a simultaneous patch to the the Log Collector. It does have a > > > dependency on the current architecture. > > > > > > Keith > > > > > > > Hi, > > > > As far as I know it reads the plain text from .pgpass, we need to modify > > it > > to search within the alternate format as well. > > We are using the original .pgpass file that is in 0600 mode ( have access > only to root) > If the file does not have this mode , it is ignored by Postgres > I see no security issue in that ... > > Please see details in > http://www.postgresql.org/docs/9.0/static/libpq-pgpass.html I am going to drop the .pgpass file in favor of other configuration file and produce .pgpass on will. This is because: 1. The proprietary format of .pgpass is not friendly to parsing. 2. It does not hold the SSL setting. 3. It does not hold the SSL host validation setting. 4. It will be more difficult to modify user password. This file is also 0600 owned by engine but in key=value format, so no change as far as security is concerned.

Thanks! Alon. > > > > > > > Thanks, > > Alon > > _______________________________________________ > > Engine-devel mailing list > > Engine-devel(a)ovirt.org > > http://lists.ovirt.org/mailman/listinfo/engine-devel > > >

Hello, Currently we store database password encrypted using org.picketbox.datasource.security.SecureIdentityLoginModule. This is reverse encryption with common knowledge shared secret. Using encryption with common knowledge shared secret is close to void protection. So far we also stored the password as plain text at /etc/ovirt-engine/.pgpass, this is going to be removed as no component actually uses the .pgpass, however we do need to store non-java specific password in for utilities. In master (aiming to 3.3), we store the database connection details in own file /etc/ovirt-engine/engine.conf.d/50-setup-database.conf owned by ovirt user and not world readable. I would like to use the same 50-setup-database.conf to store plain text password and remove the java specific reversible encrypted password usage. Bottom line... 1. We drop the .pgpass file. 2. We store database connection information in /etc/ovirt-engine/engine.conf.d/<file> that is readable only by ovirt usage. 3. We drop the java specific reversible encryption in favor of plain text.