Password in plaintext in management and access logs

[CodeBleu]

ISSUE TYPE

• Bug Report

COMPONENT NAME

Logs

CLOUDSTACK VERSION

4.19.1.0, 4.18.1.0

CONFIGURATION

OS / ENVIRONMENT

SUMMARY

Password and sensitive information are shown in plaintext in the management and access logs on the management server.

STEPS TO REPRODUCE

Looking in log files.

EXPECTED RESULTS

No sensitive passwords or secrets in logs

ACTUAL RESULTS

/var/log/cloudstack/management/access.log:1077542308:10.30.0.61 - - [09/Aug/2024:16:42:01 +0000] "GET /client/api?account=joe-again-1286&apiKey=<apikey>&command=addVpnUser&domainid=c91a0528-377b-48aa-9c7b-2c7ead68200d&password=TOPSECRETPASSWORD&response=json&username=seantest2&signature=Ek%2BC7EGsrmNi0ONFL%2BxJBJxSGe0%3D HTTP/1.1" 200 115 "-" "GuzzleHttp/7" 86

/var/log/cloudstack/management/management-server.log:122775505:{u'vpn_users': [{u'add': True, u'password': u'TOPSECRETPASSWORD', u'user': u'seantest2'}], u'type': u'vpnuserlist', u'delete_from_processed_cache': False}

[boring-cyborg]

Thanks for opening your first issue here! Be sure to follow the issue template!

[rajujith]

It is best to send credentials in a POST.

[CodeBleu]

@rohityadavcloud Is there anyway this can be bumped up to a release sooner than 4.20.0.0? Being that this is a Security and Auditing issue, It would be nice to have this resolved sooner than later.

[weizhouapache]

the first issue with access.log has been discussed before
users can redirect the file access.log to /dev/null as suggested by @DaanHoogland

the second issue (vpn user password are displayed in management-server.log) seems to only impact vpn user.
I was able to reproduce the issue. it may not deserve a security release.
I will have a look

cc @rohityadavcloud @DaanHoogland @sureshanaparti