[PATCH] Scrub VNC passwords from XenD log files

[PATCH] Scrub VNC passwords from XenD log files

[Daniel P. Berrange]

[-- Attachment #1: Type: text/plain, Size: 1574 bytes --]

The XendDomainInfo and XendConfig classes both log the guest VM config data
to the /var/log/xen/xend.log  in many places. Unfortunately the VNC passwords
are stored in plain text in the guest VM config files. So we end up with 
plain text passwords in the xend.log file

Now we can make /var/log/xen  mode 0700 to protect them from local users,
but it is very common when debugging issues to request that a user attach
the contents of /var/log/xen/xend.log to the bug report ticket, or emails
sent to mailing lists. This will obviously compromise any VNC passwords
to essentially the while world & his dog. What's more, Google will make 
it incredibly easy to search for these too.


There are a few potential approaches to this

 1. Remove all logging from xend.log
 2. Change default log level to only record WARN and higher, so DEBUG
    stuff is not recorded normally
 3. Scrub the passwords out of the data being logged
 4. Do nothing

I really don't like options 1 or 2, because the stuff XenD is logging is
actually incredibly helpful when debugging end user problems. 4 is not
really a viable option either. So we're left with 3.

Thus I am attaching a prototype patch which scrubs VNC passwords out of
the data being logged by XenD.

Regards,
Dan.
-- 
|=- Red Hat, Engineering, Emerging Technologies, Boston.  +1 978 392 2496 -=|
|=-           Perl modules: http://search.cpan.org/~danberr/              -=|
|=-               Projects: http://freshmeat.net/~danielpb/               -=|
|=-  GnuPG: 7D3B9505   F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505  -=| 

[-- Attachment #2: xen-3.0.4-scrub-passwords.patch --]
[-- Type: text/plain, Size: 5110 bytes --]

diff -r 7df4d8cfba3b tools/python/xen/xend/XendConfig.py
--- a/tools/python/xen/xend/XendConfig.py	Tue Dec 05 12:42:29 2006 +0000
+++ b/tools/python/xen/xend/XendConfig.py	Tue Dec 05 14:33:34 2006 -0500
@@ -41,6 +41,35 @@ def reverse_dict(adict):
 
 def bool0(v):
     return v != '0' and bool(v)
+
+# Recursively copy a data struct, scrubbing out VNC passwords.
+# Will scrub any dict entry with a key of 'vncpasswd' or any
+# 2-element list whose first member is 'vncpasswd'. It will
+# also scrub a string matching '(vncpasswd XYZ)'. Everything
+# else is no-op passthrough
+def scrub_password(data):
+    log.debug("Scrub " + str(type(data)))
+    if type(data) == dict or type(data) == XendConfig:
+        scrubbed = {}
+        for key in data.keys():
+            if key == "vncpasswd":
+                scrubbed[key] = "XXXXXXXX"
+            else:
+                scrubbed[key] = scrub_password(data[key])
+        return scrubbed
+    elif type(data) == list:
+        if len(data) == 2 and type(data[0]) == str and data[0] == 'vncpasswd':
+            return ['vncpasswd', 'XXXXXXXX']
+        else:
+            scrubbed = []
+            for entry in data:
+                scrubbed.append(scrub_password(entry))
+            return scrubbed
+    elif type(data) == str:
+        return re.sub(r'\(vncpasswd\s+[^\)]+\)','(vncpasswd XXXXXX)', data)
+    else:
+        return data
+
 
 # Mapping from XendConfig configuration keys to the old
 # legacy configuration keys that map directly.
@@ -269,7 +298,7 @@ class XendConfig(dict):
             # output from xc.domain_getinfo
             self._dominfo_to_xapi(dominfo)
 
-        log.debug('XendConfig.init: %s' % self)
+        log.debug('XendConfig.init: %s' % scrub_password(self))
 
         # validators go here
         self.validate()
diff -r 7df4d8cfba3b tools/python/xen/xend/XendDomainInfo.py
--- a/tools/python/xen/xend/XendDomainInfo.py	Tue Dec 05 12:42:29 2006 +0000
+++ b/tools/python/xen/xend/XendDomainInfo.py	Tue Dec 05 14:33:25 2006 -0500
@@ -40,6 +40,7 @@ from xen.xend import balloon, sxp, uuid,
 from xen.xend import balloon, sxp, uuid, image, arch
 from xen.xend import XendRoot, XendNode, XendConfig
 
+from xen.xend.XendConfig import scrub_password
 from xen.xend.XendBootloader import bootloader
 from xen.xend.XendError import XendError, VmError
 from xen.xend.XendDevices import XendDevices
@@ -148,7 +149,7 @@ def create(config):
     @raise VmError: Invalid configuration or failure to start.
     """
 
-    log.debug("XendDomainInfo.create(%s)", config)
+    log.debug("XendDomainInfo.create(%s)", scrub_password(config))
     vm = XendDomainInfo(XendConfig.XendConfig(sxp_obj = config))
     try:
         vm.start()
@@ -175,7 +176,7 @@ def recreate(info, priv):
     @raise XendError: Errors with configuration.
     """
 
-    log.debug("XendDomainInfo.recreate(%s)", info)
+    log.debug("XendDomainInfo.recreate(%s)", scrub_password(info))
 
     assert not info['dying']
 
@@ -257,7 +258,7 @@ def restore(config):
     @raise XendError: Errors with configuration.
     """
 
-    log.debug("XendDomainInfo.restore(%s)", config)
+    log.debug("XendDomainInfo.restore(%s)", scrub_password(config))
     vm = XendDomainInfo(XendConfig.XendConfig(sxp_obj = config),
                         resume = True)
     try:
@@ -280,7 +281,7 @@ def createDormant(domconfig):
     @raise XendError: Errors with configuration.    
     """
     
-    log.debug("XendDomainInfo.createDormant(%s)", domconfig)
+    log.debug("XendDomainInfo.createDormant(%s)", scrub_password(domconfig))
     
     # domid does not make sense for non-running domains.
     domconfig.pop('domid', None)
@@ -520,11 +521,11 @@ class XendDomainInfo:
         @param dev_config: device configuration
         @type  dev_config: SXP object (parsed config)
         """
-        log.debug("XendDomainInfo.device_create: %s" % dev_config)
+        log.debug("XendDomainInfo.device_create: %s" % scrub_password(dev_config))
         dev_type = sxp.name(dev_config)
         dev_uuid = self.info.device_add(dev_type, cfg_sxp = dev_config)
         dev_config_dict = self.info['devices'][dev_uuid][1]
-        log.debug("XendDomainInfo.device_create: %s" % dev_config_dict)
+        log.debug("XendDomainInfo.device_create: %s" % scrub_password(dev_config_dict))
         devid = self._createDevice(dev_type, dev_config_dict)
         self._waitForDevice(dev_type, devid)
         return self.getDeviceController(dev_type).sxpr(devid)
@@ -746,7 +747,7 @@ class XendDomainInfo:
 
         to_store.update(self._vcpuDomDetails())
 
-        log.debug("Storing domain details: %s", to_store)
+        log.debug("Storing domain details: %s", scrub_password(to_store))
 
         self._writeDom(to_store)
 
@@ -1661,7 +1662,7 @@ class XendDomainInfo:
         if not self._readVm('xend/restart_count'):
             to_store['xend/restart_count'] = str(0)
 
-        log.debug("Storing VM details: %s", to_store)
+        log.debug("Storing VM details: %s", scrub_password(to_store))
 
         self._writeVm(to_store)
         self._setVmPermissions()

[-- Attachment #3: Type: text/plain, Size: 138 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Re: [PATCH] Scrub VNC passwords from XenD log files

[Ewan Mellor]

On Tue, Dec 05, 2006 at 07:31:25PM +0000, Daniel P. Berrange wrote:

> The XendDomainInfo and XendConfig classes both log the guest VM config data
> to the /var/log/xen/xend.log  in many places. Unfortunately the VNC passwords
> are stored in plain text in the guest VM config files. So we end up with 
> plain text passwords in the xend.log file
> 
> Now we can make /var/log/xen  mode 0700 to protect them from local users,
> but it is very common when debugging issues to request that a user attach
> the contents of /var/log/xen/xend.log to the bug report ticket, or emails
> sent to mailing lists. This will obviously compromise any VNC passwords
> to essentially the while world & his dog. What's more, Google will make 
> it incredibly easy to search for these too.
> 
> 
> There are a few potential approaches to this
> 
>  1. Remove all logging from xend.log
>  2. Change default log level to only record WARN and higher, so DEBUG
>     stuff is not recorded normally
>  3. Scrub the passwords out of the data being logged
>  4. Do nothing
> 
> I really don't like options 1 or 2, because the stuff XenD is logging is
> actually incredibly helpful when debugging end user problems. 4 is not
> really a viable option either. So we're left with 3.
> 
> Thus I am attaching a prototype patch which scrubs VNC passwords out of
> the data being logged by XenD.

That looks good to me -- could I have a Signed-off-by line, so I can apply it?

Thanks,

Ewan.

Re: [PATCH] Scrub VNC passwords from XenD log files

[Daniel P. Berrange]

On Wed, Dec 06, 2006 at 12:25:20PM +0000, Ewan Mellor wrote:
> On Tue, Dec 05, 2006 at 07:31:25PM +0000, Daniel P. Berrange wrote:
> 
> > The XendDomainInfo and XendConfig classes both log the guest VM config data
> > to the /var/log/xen/xend.log  in many places. Unfortunately the VNC passwords
> > are stored in plain text in the guest VM config files. So we end up with 
> > plain text passwords in the xend.log file
> > 
> > Now we can make /var/log/xen  mode 0700 to protect them from local users,
> > but it is very common when debugging issues to request that a user attach
> > the contents of /var/log/xen/xend.log to the bug report ticket, or emails
> > sent to mailing lists. This will obviously compromise any VNC passwords
> > to essentially the while world & his dog. What's more, Google will make 
> > it incredibly easy to search for these too.
> > 
> > 
> > There are a few potential approaches to this
> > 
> >  1. Remove all logging from xend.log
> >  2. Change default log level to only record WARN and higher, so DEBUG
> >     stuff is not recorded normally
> >  3. Scrub the passwords out of the data being logged
> >  4. Do nothing
> > 
> > I really don't like options 1 or 2, because the stuff XenD is logging is
> > actually incredibly helpful when debugging end user problems. 4 is not
> > really a viable option either. So we're left with 3.
> > 
> > Thus I am attaching a prototype patch which scrubs VNC passwords out of
> > the data being logged by XenD.
> 
> That looks good to me -- could I have a Signed-off-by line, so I can apply it?

I didn't add the signed-off-by because the patch isn't finished - I really 
just wanted to see if people were amenable to this kind of approach before
doing more work on it. Since you like it, I'll finish it off shortly - there
just a couple more test cases I need to go through - suspend/restore & inactive
domains - to verify passwords are always scrubbed correctly. I'll post a final
version of the patch by the end of today if all goes to plan.

Regards,
Dan.
-- 
|=- Red Hat, Engineering, Emerging Technologies, Boston.  +1 978 392 2496 -=|
|=-           Perl modules: http://search.cpan.org/~danberr/              -=|
|=-               Projects: http://freshmeat.net/~danielpb/               -=|
|=-  GnuPG: 7D3B9505   F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505  -=| 

Re: [PATCH] Scrub VNC passwords from XenD log files

[Ewan Mellor]

On Wed, Dec 06, 2006 at 05:16:03PM +0000, Daniel P. Berrange wrote:

> I didn't add the signed-off-by because the patch isn't finished - I really 
> just wanted to see if people were amenable to this kind of approach before
> doing more work on it. Since you like it, I'll finish it off shortly - there
> just a couple more test cases I need to go through - suspend/restore & inactive
> domains - to verify passwords are always scrubbed correctly. I'll post a final
> version of the patch by the end of today if all goes to plan.

Great, thanks.  I think you're right that this is the best of all the
available options, fiddly though it is.  Perhaps we could write a final check
at the end of xm-test, to make sure that "vncpasswd" doesn't appear in the
logs anywhere -- that would make sure that this never regresses.

Ewan.

Re: [PATCH] Scrub VNC passwords from XenD log files

[Daniel P. Berrange]

[-- Attachment #1: Type: text/plain, Size: 1550 bytes --]

On Wed, Dec 06, 2006 at 05:24:36PM +0000, Ewan Mellor wrote:
> On Wed, Dec 06, 2006 at 05:16:03PM +0000, Daniel P. Berrange wrote:
> 
> > I didn't add the signed-off-by because the patch isn't finished - I really 
> > just wanted to see if people were amenable to this kind of approach before
> > doing more work on it. Since you like it, I'll finish it off shortly - there
> > just a couple more test cases I need to go through - suspend/restore & inactive
> > domains - to verify passwords are always scrubbed correctly. I'll post a final
> > version of the patch by the end of today if all goes to plan.
> 
> Great, thanks.  I think you're right that this is the best of all the
> available options, fiddly though it is.  Perhaps we could write a final check
> at the end of xm-test, to make sure that "vncpasswd" doesn't appear in the
> logs anywhere -- that would make sure that this never regresses.

Attached is a final version of the patch to scrub passwords. I have tested
it with HVM guests, and parvirt guests, using 'start', 'new', 'create',
'suspend', 'resume' commands to XM. In all cases, no password was present
to the XenD log files created.

  Signed-off-by: Daniel P. Berrange <berrange@redhat.com>

Regards,
Dan.
-- 
|=- Red Hat, Engineering, Emerging Technologies, Boston.  +1 978 392 2496 -=|
|=-           Perl modules: http://search.cpan.org/~danberr/              -=|
|=-               Projects: http://freshmeat.net/~danielpb/               -=|
|=-  GnuPG: 7D3B9505   F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505  -=| 

[-- Attachment #2: xen-3.0.4-scrub-passwords-2.patch --]
[-- Type: text/plain, Size: 6101 bytes --]

diff -ruN xen-unstable.hg-12722/tools/python/xen/xend/XendConfig.py xen-unstable.hg-12722.new/tools/python/xen/xend/XendConfig.py
--- xen-unstable.hg-12722/tools/python/xen/xend/XendConfig.py	2006-12-04 14:43:22.000000000 -0500
+++ xen-unstable.hg-12722.new/tools/python/xen/xend/XendConfig.py	2006-12-06 12:49:16.000000000 -0500
@@ -42,6 +42,39 @@
 def bool0(v):
     return v != '0' and bool(v)
 
+# Recursively copy a data struct, scrubbing out VNC passwords.
+# Will scrub any dict entry with a key of 'vncpasswd' or any
+# 2-element list whose first member is 'vncpasswd'. It will
+# also scrub a string matching '(vncpasswd XYZ)'. Everything
+# else is no-op passthrough
+def scrub_password(data):
+    if type(data) == dict or type(data) == XendConfig:
+        scrubbed = {}
+        for key in data.keys():
+            if key == "vncpasswd":
+                scrubbed[key] = "XXXXXXXX"
+            else:
+                scrubbed[key] = scrub_password(data[key])
+        return scrubbed
+    elif type(data) == list:
+        if len(data) == 2 and type(data[0]) == str and data[0] == 'vncpasswd':
+            return ['vncpasswd', 'XXXXXXXX']
+        else:
+            scrubbed = []
+            for entry in data:
+                scrubbed.append(scrub_password(entry))
+            return scrubbed
+    elif type(data) == tuple:
+        scrubbed = []
+        for entry in data:
+            scrubbed.append(scrub_password(entry))
+        return tuple(scrubbed)
+    elif type(data) == str:
+        return re.sub(r'\(vncpasswd\s+[^\)]+\)','(vncpasswd XXXXXX)', data)
+    else:
+        return data
+
+
 # Mapping from XendConfig configuration keys to the old
 # legacy configuration keys that map directly.
 
@@ -269,7 +302,7 @@
             # output from xc.domain_getinfo
             self._dominfo_to_xapi(dominfo)
 
-        log.debug('XendConfig.init: %s' % self)
+        log.debug('XendConfig.init: %s' % scrub_password(self))
 
         # validators go here
         self.validate()
@@ -473,7 +506,7 @@
             else:
                 for opt, val in config[1:]:
                     dev_info[opt] = val
-                log.debug("XendConfig: reading device: %s" % dev_info)
+                log.debug("XendConfig: reading device: %s" % scrub_password(dev_info))
                 # create uuid if it doesn't
                 dev_uuid = dev_info.get('uuid', uuid.createString())
                 dev_info['uuid'] = dev_uuid
diff -ruN xen-unstable.hg-12722/tools/python/xen/xend/XendDomainInfo.py xen-unstable.hg-12722.new/tools/python/xen/xend/XendDomainInfo.py
--- xen-unstable.hg-12722/tools/python/xen/xend/XendDomainInfo.py	2006-12-04 14:43:22.000000000 -0500
+++ xen-unstable.hg-12722.new/tools/python/xen/xend/XendDomainInfo.py	2006-12-06 12:49:41.000000000 -0500
@@ -40,6 +40,7 @@
 from xen.xend import balloon, sxp, uuid, image, arch
 from xen.xend import XendRoot, XendNode, XendConfig
 
+from xen.xend.XendConfig import scrub_password
 from xen.xend.XendBootloader import bootloader
 from xen.xend.XendError import XendError, VmError
 from xen.xend.XendDevices import XendDevices
@@ -148,7 +149,7 @@
     @raise VmError: Invalid configuration or failure to start.
     """
 
-    log.debug("XendDomainInfo.create(%s)", config)
+    log.debug("XendDomainInfo.create(%s)", scrub_password(config))
     vm = XendDomainInfo(XendConfig.XendConfig(sxp_obj = config))
     try:
         vm.start()
@@ -175,7 +176,7 @@
     @raise XendError: Errors with configuration.
     """
 
-    log.debug("XendDomainInfo.recreate(%s)", info)
+    log.debug("XendDomainInfo.recreate(%s)", scrub_password(info))
 
     assert not info['dying']
 
@@ -257,7 +258,7 @@
     @raise XendError: Errors with configuration.
     """
 
-    log.debug("XendDomainInfo.restore(%s)", config)
+    log.debug("XendDomainInfo.restore(%s)", scrub_password(config))
     vm = XendDomainInfo(XendConfig.XendConfig(sxp_obj = config),
                         resume = True)
     try:
@@ -280,7 +281,7 @@
     @raise XendError: Errors with configuration.    
     """
     
-    log.debug("XendDomainInfo.createDormant(%s)", domconfig)
+    log.debug("XendDomainInfo.createDormant(%s)", scrub_password(domconfig))
     
     # domid does not make sense for non-running domains.
     domconfig.pop('domid', None)
@@ -520,11 +521,11 @@
         @param dev_config: device configuration
         @type  dev_config: SXP object (parsed config)
         """
-        log.debug("XendDomainInfo.device_create: %s" % dev_config)
+        log.debug("XendDomainInfo.device_create: %s" % scrub_password(dev_config))
         dev_type = sxp.name(dev_config)
         dev_uuid = self.info.device_add(dev_type, cfg_sxp = dev_config)
         dev_config_dict = self.info['devices'][dev_uuid][1]
-        log.debug("XendDomainInfo.device_create: %s" % dev_config_dict)
+        log.debug("XendDomainInfo.device_create: %s" % scrub_password(dev_config_dict))
         devid = self._createDevice(dev_type, dev_config_dict)
         self._waitForDevice(dev_type, devid)
         return self.getDeviceController(dev_type).sxpr(devid)
@@ -746,7 +747,7 @@
 
         to_store.update(self._vcpuDomDetails())
 
-        log.debug("Storing domain details: %s", to_store)
+        log.debug("Storing domain details: %s", scrub_password(to_store))
 
         self._writeDom(to_store)
 
@@ -1188,7 +1189,7 @@
         """
         for (devclass, config) in self.info.get('devices', {}).values():
             if devclass in XendDevices.valid_devices():            
-                log.info("createDevice: %s : %s" % (devclass, config))
+                log.info("createDevice: %s : %s" % (devclass, scrub_password(config)))
                 self._createDevice(devclass, config)
 
         if self.image:
@@ -1661,7 +1662,7 @@
         if not self._readVm('xend/restart_count'):
             to_store['xend/restart_count'] = str(0)
 
-        log.debug("Storing VM details: %s", to_store)
+        log.debug("Storing VM details: %s", scrub_password(to_store))
 
         self._writeVm(to_store)
         self._setVmPermissions()

[-- Attachment #3: Type: text/plain, Size: 138 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Re: [PATCH] Scrub VNC passwords from XenD log files

[Ewan Mellor]

On Wed, Dec 06, 2006 at 07:43:09PM +0000, Daniel P. Berrange wrote:

> On Wed, Dec 06, 2006 at 05:24:36PM +0000, Ewan Mellor wrote:
> > On Wed, Dec 06, 2006 at 05:16:03PM +0000, Daniel P. Berrange wrote:
> > 
> > > I didn't add the signed-off-by because the patch isn't finished - I really 
> > > just wanted to see if people were amenable to this kind of approach before
> > > doing more work on it. Since you like it, I'll finish it off shortly - there
> > > just a couple more test cases I need to go through - suspend/restore & inactive
> > > domains - to verify passwords are always scrubbed correctly. I'll post a final
> > > version of the patch by the end of today if all goes to plan.
> > 
> > Great, thanks.  I think you're right that this is the best of all the
> > available options, fiddly though it is.  Perhaps we could write a final check
> > at the end of xm-test, to make sure that "vncpasswd" doesn't appear in the
> > logs anywhere -- that would make sure that this never regresses.
> 
> Attached is a final version of the patch to scrub passwords. I have tested
> it with HVM guests, and parvirt guests, using 'start', 'new', 'create',
> 'suspend', 'resume' commands to XM. In all cases, no password was present
> to the XenD log files created.
> 
>   Signed-off-by: Daniel P. Berrange <berrange@redhat.com>

Applied, thanks.

Ewan.