[Bug]: The LDAP password is visible in plain text in logs #39035
Labels
Comments
Chifilly
added
0. Needs triage
|
Duplicate of #38461 |
|
Apologies. I did a search but must have missed it |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Bug description
In helping diagnose and troubleshoot #38902 I had to post logs of running some commands on my instance. I noticed when doing this that the LDAP password is shown in plain text in the
ldap_bindlog as below;{ "reqId": "1IAV3J2CIoke20M2s8OF", "level": 0, "time": "2023-06-27T12:45:02+00:00", "remoteAddr": "", "user": "--", "app": "user_ldap", "method": "", "url": "--", "message": "Calling LDAP function ldap_bind with parameters [{},\"cn=admin,ou=users,dc=nextcloud,dc=allsopp,dc=local\",\"<PLAINTEXT PASSWORD>\"]", "userAgent": "--", "version": "27.0.0.8", "data": { "app": "user_ldap" } }Steps to reproduce
NC_debug=true NC_loglevel=0 php -f occ dav:sync-system-addressbooknextcloud.logfile indataldap_bindlog lineExpected behavior
It gets run through the same process that causes other sensitive parameters to be replaced with
*** sensitive parameters replaced ***so the password isn't visible in plain textInstallation method
Community Docker image
Nextcloud Server version
27
Operating system
Debian/Ubuntu
PHP engine version
PHP 8.2
Web server
Apache (supported)
Database engine version
PostgreSQL
Is this bug present after an update or on a fresh install?
None
Are you using the Nextcloud Server Encryption module?
Encryption is Disabled
What user-backends are you using?
Configuration report
{ "system": { "htaccess.RewriteBase": "\/", "memcache.local": "\\OC\\Memcache\\APCu", "apps_paths": [ { "path": "\/var\/www\/html\/apps", "url": "\/apps", "writable": false }, { "path": "\/var\/www\/html\/custom_apps", "url": "\/custom_apps", "writable": true } ], "memcache.distributed": "\\OC\\Memcache\\Redis", "memcache.locking": "\\OC\\Memcache\\Redis", "redis": { "host": "***REMOVED SENSITIVE VALUE***", "password": "***REMOVED SENSITIVE VALUE***", "port": 6379 }, "instanceid": "***REMOVED SENSITIVE VALUE***", "passwordsalt": "***REMOVED SENSITIVE VALUE***", "secret": "***REMOVED SENSITIVE VALUE***", "trusted_domains": [ "***REDACTED***" ], "datadirectory": "***REMOVED SENSITIVE VALUE***", "dbtype": "pgsql", "version": "27.0.0.8", "overwrite.cli.url": "***REDACTED***", "dbname": "***REMOVED SENSITIVE VALUE***", "dbhost": "***REMOVED SENSITIVE VALUE***", "dbport": "", "dbtableprefix": "oc_", "dbuser": "***REMOVED SENSITIVE VALUE***", "dbpassword": "***REMOVED SENSITIVE VALUE***", "installed": true, "overwritehost": "***REDACTED***", "overwriteprotocol": "https", "loglevel": "0", "maintenance": false, "app_install_overwrite": [ "officeonline" ], "has_rebuilt_cache": true, "theme": "", "trusted_proxies": "***REMOVED SENSITIVE VALUE***", "mail_from_address": "***REMOVED SENSITIVE VALUE***", "mail_smtpmode": "smtp", "mail_sendmailmode": "smtp", "mail_domain": "***REMOVED SENSITIVE VALUE***", "mail_smtphost": "***REMOVED SENSITIVE VALUE***", "mail_smtpport": "587", "mail_smtpauth": 1, "mail_smtpname": "***REMOVED SENSITIVE VALUE***", "mail_smtppassword": "***REMOVED SENSITIVE VALUE***", "mail_smtpsecure": "ssl" } }List of activated Apps
Nextcloud Signing status
Nextcloud Logs
{ "reqId": "1IAV3J2CIoke20M2s8OF", "level": 0, "time": "2023-06-27T12:45:02+00:00", "remoteAddr": "", "user": "--", "app": "user_ldap", "method": "", "url": "--", "message": "Calling LDAP function ldap_bind with parameters [{},\"cn=admin,ou=users,dc=nextcloud,dc=allsopp,dc=local\",\"<PLAINTEXT PASSWORD>\"]", "userAgent": "--", "version": "27.0.0.8", "data": { "app": "user_ldap" } }Additional info
No response
The text was updated successfully, but these errors were encountered: