ldap/servers/slapd/auditlog.c | 17 +++++++++++++++++ ldap/servers/slapd/libglobs.c | 19 +++++++++++++++++++ ldap/servers/slapd/proto-slap.h | 3 +++ ldap/servers/slapd/slap.h | 2 ++ 4 files changed, 41 insertions(+)
New commits: commit 43fb648fd4d7663c61c7ea7ff649ffddb9cbf006 Author: Mark Reynolds mareynol@redhat.com Date: Wed May 16 17:53:27 2012 -0400
Ticket 365 - passwords in clear text in the audit log
Bug Description: after changing a user password, an additional modify is added to the mods: "unhashed#user#password: <clear text password>"
e.g. PSEUDO_ATTR_UNHASHEDUSERPASSWORD
Fix Description: Added new config param "nsslapd-audit-logging-hide-unhashed-pw". The default is "off". When "on" that single modify op is skipped from the audit logging.
https://fedorahosted.org/389/ticket/365
Reviewed by: Noriko (Thanks!)
diff --git a/ldap/servers/slapd/auditlog.c b/ldap/servers/slapd/auditlog.c index 79cd407..16c0f7e 100644 --- a/ldap/servers/slapd/auditlog.c +++ b/ldap/servers/slapd/auditlog.c @@ -55,6 +55,7 @@ char *attr_changetype = ATTR_CHANGETYPE; char *attr_newrdn = ATTR_NEWRDN; char *attr_deleteoldrdn = ATTR_DELETEOLDRDN; char *attr_modifiersname = ATTR_MODIFIERSNAME; +static int hide_unhashed_pw = 0;
/* Forward Declarations */ static void write_audit_file( int optype, const char *dn, void *change, int flag, time_t curtime ); @@ -152,6 +153,10 @@ write_audit_file( for ( j = 0; mods[j] != NULL; j++ ) { int operationtype= mods[j]->mod_op & ~LDAP_MOD_BVALUES; + + if((strcmp(mods[j]->mod_type, PSEUDO_ATTR_UNHASHEDUSERPASSWORD) == 0) && hide_unhashed_pw){ + continue; + } switch ( operationtype ) { case LDAP_MOD_ADD: @@ -246,3 +251,15 @@ write_audit_file(
lenstr_free( &l ); } + +void +auditlog_hide_unhashed_pw() +{ + hide_unhashed_pw = 1; +} + +void +auditlog_expose_unhashed_pw() +{ + hide_unhashed_pw = 0; +} diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c index 6d0db36..2540e25 100644 --- a/ldap/servers/slapd/libglobs.c +++ b/ldap/servers/slapd/libglobs.c @@ -459,6 +459,9 @@ static struct config_get_and_set { {CONFIG_AUDITLOG_LOGGING_ENABLED_ATTRIBUTE, NULL, log_set_logging, SLAPD_AUDIT_LOG, (void**)&global_slapdFrontendConfig.auditlog_logging_enabled, CONFIG_ON_OFF, NULL}, + {CONFIG_AUDITLOG_LOGGING_HIDE_UNHASHED_PW, config_set_auditlog_unhashed_pw, + NULL, 0, + (void**)&global_slapdFrontendConfig.auditlog_logging_hide_unhashed_pw, CONFIG_ON_OFF, NULL}, {CONFIG_ACCESSLOG_BUFFERING_ATTRIBUTE, config_set_accesslogbuffering, NULL, 0, (void**)&global_slapdFrontendConfig.accesslogbuffering, CONFIG_ON_OFF, NULL}, @@ -1072,6 +1075,7 @@ FrontendConfig_init () { cfg->auditlog_minfreespace = 5; cfg->auditlog_exptime = 1; cfg->auditlog_exptimeunit = slapi_ch_strdup("month"); + cfg->auditlog_logging_hide_unhashed_pw = LDAP_OFF;
cfg->entryusn_global = LDAP_OFF; cfg->entryusn_import_init = slapi_ch_strdup("0"); @@ -1171,6 +1175,21 @@ get_entry_point( int ep_name, caddr_t *ep_addr ) return rc; }
+int +config_set_auditlog_unhashed_pw(const char *attrname, char *value, char *errorbuf, int apply) +{ + slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); + int retVal = LDAP_SUCCESS; + + retVal = config_set_onoff ( attrname, value, &(slapdFrontendConfig->auditlog_logging_hide_unhashed_pw), + errorbuf, apply); + if(strcasecmp(value,"on") == 0){ + auditlog_hide_unhashed_pw(); + } else { + auditlog_expose_unhashed_pw(); + } + return retVal; +}
/* * Utility function called by many of the config_set_XXX() functions. diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h index ea6f610..c3ebd79 100644 --- a/ldap/servers/slapd/proto-slap.h +++ b/ldap/servers/slapd/proto-slap.h @@ -387,6 +387,7 @@ int config_set_disk_threshold( const char *attrname, char *value, char *errorbuf int config_set_disk_grace_period( const char *attrname, char *value, char *errorbuf, int apply ); int config_set_disk_preserve_logging( const char *attrname, char *value, char *errorbuf, int apply ); int config_set_disk_logging_critical( const char *attrname, char *value, char *errorbuf, int apply ); +int config_set_auditlog_unhashed_pw(const char *attrname, char *value, char *errorbuf, int apply);
#if !defined(_WIN32) && !defined(AIX) int config_set_maxdescriptors( const char *attrname, char *value, char *errorbuf, int apply ); @@ -1190,6 +1191,8 @@ void factory_destroy_extension(int type,void *object,void *parent,void **extensi */
void write_audit_log_entry( Slapi_PBlock *pb); +void auditlog_hide_unhashed_pw(); +void auditlog_expose_unhashed_pw();
/* * eventq.c diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h index 2e4db56..22237ce 100644 --- a/ldap/servers/slapd/slap.h +++ b/ldap/servers/slapd/slap.h @@ -1874,6 +1874,7 @@ typedef struct _slapdEntryPoints { #define CONFIG_ACCESSLOG_LOGGING_ENABLED_ATTRIBUTE "nsslapd-accesslog-logging-enabled" #define CONFIG_ERRORLOG_LOGGING_ENABLED_ATTRIBUTE "nsslapd-errorlog-logging-enabled" #define CONFIG_AUDITLOG_LOGGING_ENABLED_ATTRIBUTE "nsslapd-auditlog-logging-enabled" +#define CONFIG_AUDITLOG_LOGGING_HIDE_UNHASHED_PW "nsslapd-auditlog-logging-hide-unhashed-pw" #define CONFIG_ROOTDN_ATTRIBUTE "nsslapd-rootdn" #define CONFIG_ROOTPW_ATTRIBUTE "nsslapd-rootpw" #define CONFIG_ROOTPWSTORAGESCHEME_ATTRIBUTE "nsslapd-rootpwstoragescheme" @@ -2163,6 +2164,7 @@ typedef struct _slapdFrontendConfig { int auditlog_minfreespace; int auditlog_exptime; char *auditlog_exptimeunit; + int auditlog_logging_hide_unhashed_pw;
int return_exact_case; /* Return attribute names with the same case * as they appear in at.conf */
389-commits@lists.fedoraproject.org