)]}'
{"security-notes/OSSN-0023":[{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"64e54ce3f99ed870014490bba31ffd1dc02533fa","unresolved":false,"context_lines":[{"line_number":8,"context_line":"logged at INFO level."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Keystone, "},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"Tokens may be used to make requests without providing additional user"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"1abeadc6_9df92750","line":11,"updated":"2014-08-18 15:01:01.000000000","message":"White space, we really need a gate test for this.","commit_id":"3c5261b1628a3330147941cb43b329c40d79c41b"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"7d29aa2905c5f8bb213d36500eac7e1dd1a72795","unresolved":false,"context_lines":[{"line_number":8,"context_line":"logged at INFO level."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Keystone, "},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"Tokens may be used to make requests without providing additional user"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"1abeadc6_8676383d","line":11,"in_reply_to":"1abeadc6_9df92750","updated":"2014-08-18 15:42:51.000000000","message":"Actually I was going to fill in the affected releases here, but forgot to do it. I\u0027ll update soon","commit_id":"3c5261b1628a3330147941cb43b329c40d79c41b"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"621888f139ff6bf635b109b217ec6e01d32a45f7","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Keystone logs auth tokens in URLs at log level info"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_bebca607","line":1,"updated":"2014-08-21 00:09:02.000000000","message":"I would reorder the words and capitalize INFO:\n\n   \u0027...at the INFO log level\u0027","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"75d0fc128d889dee467f1fbbdf6c04225e040dfe","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Keystone logs auth tokens in URLs at log level info"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_240797cb","line":1,"in_reply_to":"1abeadc6_bebca607","updated":"2014-08-21 12:48:29.000000000","message":"+1","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"3d2371fe13ac28e93eec08817f652964c4e57b2f","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Keystone logs auth tokens in URLs at log level info"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_9ccefb2c","line":1,"in_reply_to":"1abeadc6_bebca607","updated":"2014-08-21 15:35:14.000000000","message":"Done","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"621888f139ff6bf635b109b217ec6e01d32a45f7","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"When a client uses Keystone API version 2, the tokens will be logged as"},{"line_number":6,"context_line":"part of some request URLs. Specifically all requests to the tokens"},{"line_number":7,"context_line":"resource like: /v2.0/tokens/d5036612660543a3a9b8054c79dea8d3 will be"},{"line_number":8,"context_line":"logged at INFO level."}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_febc5ede","line":5,"updated":"2014-08-21 00:09:02.000000000","message":"We should really refer to the API as the Identity API, not the Keystone API.  Keystone is merely an implementation of the Identity API.  Something like this would do:\n\n    \u0027When a client accesses Keystone using the Identity API v2, the tokens...\u0027","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"3d2371fe13ac28e93eec08817f652964c4e57b2f","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"When a client uses Keystone API version 2, the tokens will be logged as"},{"line_number":6,"context_line":"part of some request URLs. Specifically all requests to the tokens"},{"line_number":7,"context_line":"resource like: /v2.0/tokens/d5036612660543a3a9b8054c79dea8d3 will be"},{"line_number":8,"context_line":"logged at INFO level."}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_44f57355","line":5,"in_reply_to":"1abeadc6_e4003fad","updated":"2014-08-21 15:35:14.000000000","message":"It\u0027s Keystone\u0027s logging problem, but I think we can safely assume any service not specifically configured to workaround this problem will try to log the accessed URLs.","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"75d0fc128d889dee467f1fbbdf6c04225e040dfe","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"When a client uses Keystone API version 2, the tokens will be logged as"},{"line_number":6,"context_line":"part of some request URLs. Specifically all requests to the tokens"},{"line_number":7,"context_line":"resource like: /v2.0/tokens/d5036612660543a3a9b8054c79dea8d3 will be"},{"line_number":8,"context_line":"logged at INFO level."}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_e4003fad","line":5,"in_reply_to":"1abeadc6_febc5ede","updated":"2014-08-21 12:48:29.000000000","message":"Ok but this isn\u0027t a problem with the Identity API, it\u0027s a problem with the Keystone implementation of the v2 api...","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"621888f139ff6bf635b109b217ec6e01d32a45f7","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"When a client uses Keystone API version 2, the tokens will be logged as"},{"line_number":6,"context_line":"part of some request URLs. Specifically all requests to the tokens"},{"line_number":7,"context_line":"resource like: /v2.0/tokens/d5036612660543a3a9b8054c79dea8d3 will be"},{"line_number":8,"context_line":"logged at INFO level."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_bee58639","line":7,"updated":"2014-08-21 00:09:02.000000000","message":"I would remove the URL example here (see my commend in the discussion section below).","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"3d2371fe13ac28e93eec08817f652964c4e57b2f","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"When a client uses Keystone API version 2, the tokens will be logged as"},{"line_number":6,"context_line":"part of some request URLs. Specifically all requests to the tokens"},{"line_number":7,"context_line":"resource like: /v2.0/tokens/d5036612660543a3a9b8054c79dea8d3 will be"},{"line_number":8,"context_line":"logged at INFO level."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_3f04f916","line":7,"in_reply_to":"1abeadc6_bee58639","updated":"2014-08-21 15:35:14.000000000","message":"Done","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"621888f139ff6bf635b109b217ec6e01d32a45f7","unresolved":false,"context_lines":[{"line_number":8,"context_line":"logged at INFO level."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Keystone, Havana, Icehouse, Juno"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"Tokens may be used to make requests without providing additional user"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_1edbda50","line":11,"updated":"2014-08-21 00:09:02.000000000","message":"Add Grizzly as I mentioned in my other comment.  We don\u0027t usually list unreleased versions, but I\u0027m OK if you want to leave Juno in since v2 is going to exist there and we know this won\u0027t be fixed.","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"3d2371fe13ac28e93eec08817f652964c4e57b2f","unresolved":false,"context_lines":[{"line_number":8,"context_line":"logged at INFO level."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Keystone, Havana, Icehouse, Juno"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"Tokens may be used to make requests without providing additional user"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_bce657ae","line":11,"in_reply_to":"1abeadc6_1edbda50","updated":"2014-08-21 15:35:14.000000000","message":"Done","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"75d0fc128d889dee467f1fbbdf6c04225e040dfe","unresolved":false,"context_lines":[{"line_number":8,"context_line":"logged at INFO level."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Keystone, Havana, Icehouse, Juno"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"Tokens may be used to make requests without providing additional user"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_4433b3aa","line":11,"in_reply_to":"1abeadc6_1edbda50","updated":"2014-08-21 12:48:29.000000000","message":"Yeah if it\u0027s not going to be fixed it seems prudent to leave it in","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"621888f139ff6bf635b109b217ec6e01d32a45f7","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"Tokens may be used to make requests without providing additional user"},{"line_number":15,"context_line":"information, like user or tenant name and without a password. This makes"},{"line_number":16,"context_line":"them very sensitive when stored and transmitted on the wire. Ideally"},{"line_number":17,"context_line":"tokens should never be stored on the disk to avoid the possibility of an"},{"line_number":18,"context_line":"attacker obtaining local storage access and reusing them in the system."}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_5e863214","line":15,"updated":"2014-08-21 00:09:02.000000000","message":"I think we should make this more clear.  Tokens are for authorization without the need to perform additional authentication.  Something like this would be better:\n\n\u0027Tokens are used to authorize users when making API requests against OpenStack services.  This allows previously authenticated users to make API requests without providing their authentication information again, such as their username and password. This makes tokens very sensitive...\u0027","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"3d2371fe13ac28e93eec08817f652964c4e57b2f","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"Tokens may be used to make requests without providing additional user"},{"line_number":15,"context_line":"information, like user or tenant name and without a password. This makes"},{"line_number":16,"context_line":"them very sensitive when stored and transmitted on the wire. Ideally"},{"line_number":17,"context_line":"tokens should never be stored on the disk to avoid the possibility of an"},{"line_number":18,"context_line":"attacker obtaining local storage access and reusing them in the system."}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_3f495960","line":15,"in_reply_to":"1abeadc6_5e863214","updated":"2014-08-21 15:35:14.000000000","message":"Done","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"621888f139ff6bf635b109b217ec6e01d32a45f7","unresolved":false,"context_lines":[{"line_number":16,"context_line":"them very sensitive when stored and transmitted on the wire. Ideally"},{"line_number":17,"context_line":"tokens should never be stored on the disk to avoid the possibility of an"},{"line_number":18,"context_line":"attacker obtaining local storage access and reusing them in the system."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Large systems tend to use remote logging systems, which quite often use"},{"line_number":21,"context_line":"unencrypted protocols (like syslog/udp). This could lead to distributing"},{"line_number":22,"context_line":"the lines containing tokens to systems with different authorization"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_fe7b7ef2","line":19,"updated":"2014-08-21 00:09:02.000000000","message":"It seems like you should add a short paragraph here stating that the URLs are logged at the INFO level.  This repeats some of what you have in summary, but it seems odd to leave it out of the description.  Perhaps there shouldn\u0027t be a URL example in the summary section and you should put the URL example or a log snippet here.","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"3d2371fe13ac28e93eec08817f652964c4e57b2f","unresolved":false,"context_lines":[{"line_number":16,"context_line":"them very sensitive when stored and transmitted on the wire. Ideally"},{"line_number":17,"context_line":"tokens should never be stored on the disk to avoid the possibility of an"},{"line_number":18,"context_line":"attacker obtaining local storage access and reusing them in the system."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Large systems tend to use remote logging systems, which quite often use"},{"line_number":21,"context_line":"unencrypted protocols (like syslog/udp). This could lead to distributing"},{"line_number":22,"context_line":"the lines containing tokens to systems with different authorization"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_7fc91125","line":19,"in_reply_to":"1abeadc6_fe7b7ef2","updated":"2014-08-21 15:35:14.000000000","message":"Done","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"621888f139ff6bf635b109b217ec6e01d32a45f7","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Large systems tend to use remote logging systems, which quite often use"},{"line_number":21,"context_line":"unencrypted protocols (like syslog/udp). This could lead to distributing"},{"line_number":22,"context_line":"the lines containing tokens to systems with different authorization"},{"line_number":23,"context_line":"rules - for example providing easy access to them to support staff, or"},{"line_number":24,"context_line":"to third parties storing the logs."},{"line_number":25,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_7e412ea8","line":22,"updated":"2014-08-21 00:09:02.000000000","message":"(nit) I would make it clear that you\u0027re referring to the logfile entries instead of just saying \u0027lines\u0027.","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"3d2371fe13ac28e93eec08817f652964c4e57b2f","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Large systems tend to use remote logging systems, which quite often use"},{"line_number":21,"context_line":"unencrypted protocols (like syslog/udp). This could lead to distributing"},{"line_number":22,"context_line":"the lines containing tokens to systems with different authorization"},{"line_number":23,"context_line":"rules - for example providing easy access to them to support staff, or"},{"line_number":24,"context_line":"to third parties storing the logs."},{"line_number":25,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_1f01fd37","line":22,"in_reply_to":"1abeadc6_7e412ea8","updated":"2014-08-21 15:35:14.000000000","message":"Done","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"621888f139ff6bf635b109b217ec6e01d32a45f7","unresolved":false,"context_lines":[{"line_number":20,"context_line":"Large systems tend to use remote logging systems, which quite often use"},{"line_number":21,"context_line":"unencrypted protocols (like syslog/udp). This could lead to distributing"},{"line_number":22,"context_line":"the lines containing tokens to systems with different authorization"},{"line_number":23,"context_line":"rules - for example providing easy access to them to support staff, or"},{"line_number":24,"context_line":"to third parties storing the logs."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Version 3 of the Keystone API does not pass the tokens in the URLs"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_fe629e3c","line":23,"updated":"2014-08-21 00:09:02.000000000","message":"The word \u0027them\u0027 is ambiguous here.  I would explicitly say \u0027...providing easy access to tokens to...\u0027","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"3d2371fe13ac28e93eec08817f652964c4e57b2f","unresolved":false,"context_lines":[{"line_number":20,"context_line":"Large systems tend to use remote logging systems, which quite often use"},{"line_number":21,"context_line":"unencrypted protocols (like syslog/udp). This could lead to distributing"},{"line_number":22,"context_line":"the lines containing tokens to systems with different authorization"},{"line_number":23,"context_line":"rules - for example providing easy access to them to support staff, or"},{"line_number":24,"context_line":"to third parties storing the logs."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Version 3 of the Keystone API does not pass the tokens in the URLs"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_5ff7f558","line":23,"in_reply_to":"1abeadc6_fe629e3c","updated":"2014-08-21 15:35:14.000000000","message":"Done","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"621888f139ff6bf635b109b217ec6e01d32a45f7","unresolved":false,"context_lines":[{"line_number":23,"context_line":"rules - for example providing easy access to them to support staff, or"},{"line_number":24,"context_line":"to third parties storing the logs."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Version 3 of the Keystone API does not pass the tokens in the URLs"},{"line_number":27,"context_line":"anymore. This information is sent using the POST data instead."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"### Recommended Actions ###"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_7efa0e76","line":26,"updated":"2014-08-21 00:09:02.000000000","message":"The \u0027Identity API\u0027 comment from above applies here too.","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"621888f139ff6bf635b109b217ec6e01d32a45f7","unresolved":false,"context_lines":[{"line_number":28,"context_line":""},{"line_number":29,"context_line":"### Recommended Actions ###"},{"line_number":30,"context_line":"Where possible, users and services interacting with the Keystone service"},{"line_number":31,"context_line":"should be using the version 3 endpoint. If that\u0027s not possible,"},{"line_number":32,"context_line":"restricting the logging level to WARN will fix the immediate problem at"},{"line_number":33,"context_line":"the cost of removing potentially useful log information."},{"line_number":34,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_be4ca6c9","line":31,"updated":"2014-08-21 00:09:02.000000000","message":"(nit) Identity API v3 endpoint","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"3d2371fe13ac28e93eec08817f652964c4e57b2f","unresolved":false,"context_lines":[{"line_number":28,"context_line":""},{"line_number":29,"context_line":"### Recommended Actions ###"},{"line_number":30,"context_line":"Where possible, users and services interacting with the Keystone service"},{"line_number":31,"context_line":"should be using the version 3 endpoint. If that\u0027s not possible,"},{"line_number":32,"context_line":"restricting the logging level to WARN will fix the immediate problem at"},{"line_number":33,"context_line":"the cost of removing potentially useful log information."},{"line_number":34,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_3f9159f1","line":31,"in_reply_to":"1abeadc6_be4ca6c9","updated":"2014-08-21 15:35:14.000000000","message":"Done","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"621888f139ff6bf635b109b217ec6e01d32a45f7","unresolved":false,"context_lines":[{"line_number":32,"context_line":"restricting the logging level to WARN will fix the immediate problem at"},{"line_number":33,"context_line":"the cost of removing potentially useful log information."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"If logging of all the requests is required, this may be achieved by"},{"line_number":36,"context_line":"using a third-party proxy, like Apache or Nginx with a configuration"},{"line_number":37,"context_line":"that does not write the complete URL into the logs. For example Nginx"},{"line_number":38,"context_line":"can be configured to switch to a customised log format using directive"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_3ed096c8","line":35,"updated":"2014-08-21 00:09:02.000000000","message":"(nit) Remove the word \u0027the\u0027.","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"3d2371fe13ac28e93eec08817f652964c4e57b2f","unresolved":false,"context_lines":[{"line_number":32,"context_line":"restricting the logging level to WARN will fix the immediate problem at"},{"line_number":33,"context_line":"the cost of removing potentially useful log information."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"If logging of all the requests is required, this may be achieved by"},{"line_number":36,"context_line":"using a third-party proxy, like Apache or Nginx with a configuration"},{"line_number":37,"context_line":"that does not write the complete URL into the logs. For example Nginx"},{"line_number":38,"context_line":"can be configured to switch to a customised log format using directive"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_bfb48982","line":35,"in_reply_to":"1abeadc6_3ed096c8","updated":"2014-08-21 15:35:14.000000000","message":"Done","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"621888f139ff6bf635b109b217ec6e01d32a45f7","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"### Contacts / References ###"},{"line_number":42,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0023"},{"line_number":43,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1348844"},{"line_number":44,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":45,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_7efbeec0","line":43,"updated":"2014-08-21 00:09:02.000000000","message":"This should be the Keystone bug, not the OSSN bug:\n\n    https://bugs.launchpad.net/keystone/+bug/1348844","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"3d2371fe13ac28e93eec08817f652964c4e57b2f","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"### Contacts / References ###"},{"line_number":42,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0023"},{"line_number":43,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1348844"},{"line_number":44,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":45,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_ffb1a18f","line":43,"in_reply_to":"1abeadc6_7efbeec0","updated":"2014-08-21 15:35:14.000000000","message":"Done","commit_id":"ab62ec23ba9ff8a6deb74d020049573c3d0aded7"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f085f8a89f4c2b136b7ce8f1e65e951131a06f4e","unresolved":false,"context_lines":[{"line_number":21,"context_line":"Keystone logs the request URLs at the INFO level in order to make the"},{"line_number":22,"context_line":"system operations and support easier. Unfortunately when the tokens"},{"line_number":23,"context_line":"resource is accessed, the URLs include the user\u0027s secret token, like"},{"line_number":24,"context_line":"in this case: /v2.0/tokens/d5036612660543a3a9b8054c79dea8d3."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Large systems tend to use remote logging systems, which quite often use"},{"line_number":27,"context_line":"unencrypted protocols (like syslog/udp). This could lead to distributing"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1abeadc6_16755ff9","line":24,"updated":"2014-08-21 20:23:42.000000000","message":"should this be broken out as a snippet?","commit_id":"e1b38eef9a377288236493c29ef95640ea682481"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"08aafa8c9e17badd34fea2876db5b8f5acbba112","unresolved":false,"context_lines":[{"line_number":21,"context_line":"Keystone logs the request URLs at the INFO level in order to make the"},{"line_number":22,"context_line":"system operations and support easier. Unfortunately when the tokens"},{"line_number":23,"context_line":"resource is accessed, the URLs include the user\u0027s secret token, like"},{"line_number":24,"context_line":"in this case: /v2.0/tokens/d5036612660543a3a9b8054c79dea8d3."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Large systems tend to use remote logging systems, which quite often use"},{"line_number":27,"context_line":"unencrypted protocols (like syslog/udp). This could lead to distributing"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1abeadc6_aba7e1a5","line":24,"in_reply_to":"1abeadc6_16755ff9","updated":"2014-08-21 22:12:21.000000000","message":"+1.  Providing a real log snippet would be nice to demonstrate the problem.","commit_id":"e1b38eef9a377288236493c29ef95640ea682481"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f085f8a89f4c2b136b7ce8f1e65e951131a06f4e","unresolved":false,"context_lines":[{"line_number":23,"context_line":"resource is accessed, the URLs include the user\u0027s secret token, like"},{"line_number":24,"context_line":"in this case: /v2.0/tokens/d5036612660543a3a9b8054c79dea8d3."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Large systems tend to use remote logging systems, which quite often use"},{"line_number":27,"context_line":"unencrypted protocols (like syslog/udp). This could lead to distributing"},{"line_number":28,"context_line":"the logfile entries containing tokens to systems with different"},{"line_number":29,"context_line":"authorization rules - for example providing easy access to tokens to"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1abeadc6_96cfaf28","line":26,"updated":"2014-08-21 20:23:42.000000000","message":"I\u0027d take off \"quite often\" since we\u0027re already saying \"tend to use\"... Maybe just replace \"quite often\" with \"may\".","commit_id":"e1b38eef9a377288236493c29ef95640ea682481"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"08aafa8c9e17badd34fea2876db5b8f5acbba112","unresolved":false,"context_lines":[{"line_number":23,"context_line":"resource is accessed, the URLs include the user\u0027s secret token, like"},{"line_number":24,"context_line":"in this case: /v2.0/tokens/d5036612660543a3a9b8054c79dea8d3."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Large systems tend to use remote logging systems, which quite often use"},{"line_number":27,"context_line":"unencrypted protocols (like syslog/udp). This could lead to distributing"},{"line_number":28,"context_line":"the logfile entries containing tokens to systems with different"},{"line_number":29,"context_line":"authorization rules - for example providing easy access to tokens to"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1abeadc6_cbb97dcd","line":26,"in_reply_to":"1abeadc6_96cfaf28","updated":"2014-08-21 22:12:21.000000000","message":"+1","commit_id":"e1b38eef9a377288236493c29ef95640ea682481"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f085f8a89f4c2b136b7ce8f1e65e951131a06f4e","unresolved":false,"context_lines":[{"line_number":35,"context_line":"### Recommended Actions ###"},{"line_number":36,"context_line":"Where possible, users and services interacting with the Keystone service"},{"line_number":37,"context_line":"should be using the Identity API v3 endpoint. If that\u0027s not possible,"},{"line_number":38,"context_line":"restricting the logging level to WARN will fix the immediate problem at"},{"line_number":39,"context_line":"the cost of removing potentially useful log information."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"If logging of all requests is required, this may be achieved by"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1abeadc6_5697d7eb","line":38,"updated":"2014-08-21 20:23:42.000000000","message":"Can we show which specific file/log setting we need to set to \"WARN\" here?","commit_id":"e1b38eef9a377288236493c29ef95640ea682481"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"08aafa8c9e17badd34fea2876db5b8f5acbba112","unresolved":false,"context_lines":[{"line_number":35,"context_line":"### Recommended Actions ###"},{"line_number":36,"context_line":"Where possible, users and services interacting with the Keystone service"},{"line_number":37,"context_line":"should be using the Identity API v3 endpoint. If that\u0027s not possible,"},{"line_number":38,"context_line":"restricting the logging level to WARN will fix the immediate problem at"},{"line_number":39,"context_line":"the cost of removing potentially useful log information."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"If logging of all requests is required, this may be achieved by"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1abeadc6_cb07bd80","line":38,"in_reply_to":"1abeadc6_5697d7eb","updated":"2014-08-21 22:12:21.000000000","message":"+1.  This would be nice to provide.","commit_id":"e1b38eef9a377288236493c29ef95640ea682481"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f085f8a89f4c2b136b7ce8f1e65e951131a06f4e","unresolved":false,"context_lines":[{"line_number":42,"context_line":"using a third-party proxy, like Apache or Nginx with a configuration"},{"line_number":43,"context_line":"that does not write the complete URL into the logs. For example Nginx"},{"line_number":44,"context_line":"can be configured to switch to a customised log format using directive"},{"line_number":45,"context_line":"`access_log` only for requests matching location `/v2.0/tokens/...`."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"### Contacts / References ###"},{"line_number":48,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0023"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1abeadc6_f68703b3","line":45,"updated":"2014-08-21 20:23:42.000000000","message":"should this block be broken out as a snippet?","commit_id":"e1b38eef9a377288236493c29ef95640ea682481"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"08aafa8c9e17badd34fea2876db5b8f5acbba112","unresolved":false,"context_lines":[{"line_number":42,"context_line":"using a third-party proxy, like Apache or Nginx with a configuration"},{"line_number":43,"context_line":"that does not write the complete URL into the logs. For example Nginx"},{"line_number":44,"context_line":"can be configured to switch to a customised log format using directive"},{"line_number":45,"context_line":"`access_log` only for requests matching location `/v2.0/tokens/...`."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"### Contacts / References ###"},{"line_number":48,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0023"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1abeadc6_cbe09dcf","line":45,"in_reply_to":"1abeadc6_f68703b3","updated":"2014-08-21 22:12:21.000000000","message":"I don\u0027t think a snippet is necessary here, especially if we provide a real log snippet above.  We\u0027re not really showing a whole log statemetn or config setting, but merely a basic URL pattern.\n\nAs a minor nit, I would use normal single quotes (\u0027) instead of backticks (`).","commit_id":"e1b38eef9a377288236493c29ef95640ea682481"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"d197e9f96c1f5cd4843da0c92577de9a8898f14a","unresolved":false,"context_lines":[{"line_number":23,"context_line":"resource is accessed, the URLs include the user\u0027s secret token, like"},{"line_number":24,"context_line":"in this case: (single line, wrapped)"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    INFO eventlet.wsgi.server [-] 10.0.0.66 - - [22/Aug/2014 12:39:01]"},{"line_number":27,"context_line":"      \"GET /v2.0/tokens/\u003cplaintext_token\u003e HTTP/1.1\" 403 325 0.006539"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Large systems tend to use remote logging systems, which may use"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1abeadc6_dfa75cbb","line":26,"updated":"2014-08-22 15:03:31.000000000","message":"Add the standard snippet header/footer blocks that we use in OSSNs around this:\n\n---- begin example keystone.log snippet ----\nINFO eventlet.wsgi.server [-] 10.0.0.66 - - [22/Aug/2014 12:39:01]\n  \"GET /v2.0/tokens/\u003cplaintext_token\u003e HTTP/1.1\" 403 325 0.006539\n---- end example keystone.log snippet ----","commit_id":"4b479c3aa7e181ff323f7f1947b70ef3b360b96f"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"d197e9f96c1f5cd4843da0c92577de9a8898f14a","unresolved":false,"context_lines":[{"line_number":41,"context_line":"restricting the logging level to WARN will fix the immediate problem at"},{"line_number":42,"context_line":"the cost of removing potentially useful log information. This may be"},{"line_number":43,"context_line":"done by adding \u0027eventlet.wsgi.server\u003dWARN\u0027 to the \u0027default_log_levels\u0027"},{"line_number":44,"context_line":"option in keystone."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"If logging of all requests is required, this may be achieved by using a"},{"line_number":47,"context_line":"third-party proxy, like Apache or Nginx with a configuration that does"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1abeadc6_9f4884b4","line":44,"updated":"2014-08-22 15:03:31.000000000","message":"This is eventlet specific, and Keysone can (and is) run in httpd/mod_wsgi.  I also wonder if the \u0027verbose\u0027 and \u0027debug\u0027 options in keystone.conf will override \u0027default_log_levels\u0027.  Given this complexity, it may be best to punt on precise instructions since there are different scenarios based on the deployment and potentially the OpenStack release that is being used.\n\nI\u0027m going to rescind my previous comment in light of the above.  Let\u0027s go back to what you had before, but at least mention that it\u0027s Keystone\u0027s logging level that needes to be restricted:\n\n\u0027...restricting Keystone\u0027s logging level to WARN will fix...\u0027\n\nApologies for the back and forth on this.","commit_id":"4b479c3aa7e181ff323f7f1947b70ef3b360b96f"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"34ed042ad632248ae67ac8b0cad91cffe9dc87f1","unresolved":false,"context_lines":[{"line_number":41,"context_line":"restricting the logging level to WARN will fix the immediate problem at"},{"line_number":42,"context_line":"the cost of removing potentially useful log information. This may be"},{"line_number":43,"context_line":"done by adding \u0027eventlet.wsgi.server\u003dWARN\u0027 to the \u0027default_log_levels\u0027"},{"line_number":44,"context_line":"option in keystone."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"If logging of all requests is required, this may be achieved by using a"},{"line_number":47,"context_line":"third-party proxy, like Apache or Nginx with a configuration that does"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1abeadc6_952ea58a","line":44,"in_reply_to":"1abeadc6_9f4884b4","updated":"2014-08-22 15:38:39.000000000","message":"I think this is actually worth pointing out. The rules of one option overwriting the other and the possibility or the wsgi server patching up stuff are too complex to explain here, but let\u0027s call them out as something that needs to be double-checked.","commit_id":"4b479c3aa7e181ff323f7f1947b70ef3b360b96f"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"83a75e2c9df411dfca9550002c05a1423528f74d","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"When a client accesses Keystone using the Identity API version 2, the"},{"line_number":6,"context_line":"tokens will be logged as part of some request URLs. Specifically all"},{"line_number":7,"context_line":"requests to the tokens resource will be logged at the INFO level."},{"line_number":8,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1abeadc6_58a7dda6","line":5,"updated":"2014-08-22 19:18:35.000000000","message":"This is Keystone v2 token APIs specifically. Not the entire set.\n\n GET /v2/tokens/token_id\n DELETE /v2/tokens/token_id\n HEAD /v2/tokens/token_id\n\nService requests are still using X-Auth-Token header.","commit_id":"09e994ab2e33856f3c475e909e82995aebab231d"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"a25cfb9692dc9dd193261e9843e5345c304846bd","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"When a client accesses Keystone using the Identity API version 2, the"},{"line_number":6,"context_line":"tokens will be logged as part of some request URLs. Specifically all"},{"line_number":7,"context_line":"requests to the tokens resource will be logged at the INFO level."},{"line_number":8,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1abeadc6_7a6f64fc","line":5,"in_reply_to":"1abeadc6_58a7dda6","updated":"2014-08-28 18:21:48.000000000","message":"Yes, but that\u0027s covered by \"Specifically all requests to the tokens resource will be logged\". Do you think this needs to be written differently?","commit_id":"09e994ab2e33856f3c475e909e82995aebab231d"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"83a75e2c9df411dfca9550002c05a1423528f74d","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"When a client accesses Keystone using the Identity API version 2, the"},{"line_number":6,"context_line":"tokens will be logged as part of some request URLs. Specifically all"},{"line_number":7,"context_line":"requests to the tokens resource will be logged at the INFO level."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"### Affected Services / Software ###"},{"line_number":10,"context_line":"Keystone, Grizzly, Havana, Icehouse, Juno"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1abeadc6_788bb91e","line":7,"updated":"2014-08-22 19:18:35.000000000","message":"This is Keystone log specifically right? Typically deployment may include proxies and load-balancers, URLs are being logged there as well.","commit_id":"09e994ab2e33856f3c475e909e82995aebab231d"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"a25cfb9692dc9dd193261e9843e5345c304846bd","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"When a client accesses Keystone using the Identity API version 2, the"},{"line_number":6,"context_line":"tokens will be logged as part of some request URLs. Specifically all"},{"line_number":7,"context_line":"requests to the tokens resource will be logged at the INFO level."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"### Affected Services / Software ###"},{"line_number":10,"context_line":"Keystone, Grizzly, Havana, Icehouse, Juno"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1abeadc6_954b332a","line":7,"in_reply_to":"1abeadc6_2fa60bc2","updated":"2014-08-28 18:21:48.000000000","message":"This is for Keystone log files. Last section mentions configuring proxy in a specific way, but I\u0027ll try to point out the entry stays in multiple places.","commit_id":"09e994ab2e33856f3c475e909e82995aebab231d"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"e90610148e282efb5b76f9d5f107383b1a6ae257","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"When a client accesses Keystone using the Identity API version 2, the"},{"line_number":6,"context_line":"tokens will be logged as part of some request URLs. Specifically all"},{"line_number":7,"context_line":"requests to the tokens resource will be logged at the INFO level."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"### Affected Services / Software ###"},{"line_number":10,"context_line":"Keystone, Grizzly, Havana, Icehouse, Juno"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1abeadc6_2fa60bc2","line":7,"in_reply_to":"1abeadc6_788bb91e","updated":"2014-08-26 04:55:24.000000000","message":"In apache deployed this will be in the access log (wherever that is configured). In eventlet this will be in the keystonelog","commit_id":"09e994ab2e33856f3c475e909e82995aebab231d"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"83a75e2c9df411dfca9550002c05a1423528f74d","unresolved":false,"context_lines":[{"line_number":7,"context_line":"requests to the tokens resource will be logged at the INFO level."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"### Affected Services / Software ###"},{"line_number":10,"context_line":"Keystone, Grizzly, Havana, Icehouse, Juno"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"### Discussion ###"},{"line_number":13,"context_line":"Tokens are used to authorize users when making API requests against"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1abeadc6_d8004d68","line":10,"updated":"2014-08-22 19:18:35.000000000","message":"this is applicable to all Keystone releases that supports V2 token APIs","commit_id":"09e994ab2e33856f3c475e909e82995aebab231d"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"a25cfb9692dc9dd193261e9843e5345c304846bd","unresolved":false,"context_lines":[{"line_number":7,"context_line":"requests to the tokens resource will be logged at the INFO level."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"### Affected Services / Software ###"},{"line_number":10,"context_line":"Keystone, Grizzly, Havana, Icehouse, Juno"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"### Discussion ###"},{"line_number":13,"context_line":"Tokens are used to authorize users when making API requests against"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1abeadc6_35641fb8","line":10,"in_reply_to":"1abeadc6_4fb427f2","updated":"2014-08-28 18:21:48.000000000","message":"They\u0027re EOL\u0027ed already (https://wiki.openstack.org/wiki/Releases) Grizzly is already past the security-supported state.","commit_id":"09e994ab2e33856f3c475e909e82995aebab231d"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"e90610148e282efb5b76f9d5f107383b1a6ae257","unresolved":false,"context_lines":[{"line_number":7,"context_line":"requests to the tokens resource will be logged at the INFO level."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"### Affected Services / Software ###"},{"line_number":10,"context_line":"Keystone, Grizzly, Havana, Icehouse, Juno"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"### Discussion ###"},{"line_number":13,"context_line":"Tokens are used to authorize users when making API requests against"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1abeadc6_4fb427f2","line":10,"in_reply_to":"1abeadc6_d8004d68","updated":"2014-08-26 04:55:24.000000000","message":"This affects back to diablo.","commit_id":"09e994ab2e33856f3c475e909e82995aebab231d"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"83a75e2c9df411dfca9550002c05a1423528f74d","unresolved":false,"context_lines":[{"line_number":35,"context_line":"support staff, or to third parties storing the logs."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Version 3 of the Identity API does not pass the tokens in the URLs"},{"line_number":38,"context_line":"anymore. This information is sent using the POST data instead."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"### Recommended Actions ###"},{"line_number":41,"context_line":"Where possible, users and services interacting with the Keystone service"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1abeadc6_d8d3edd2","line":38,"updated":"2014-08-22 19:18:35.000000000","message":"This information is conveyed in the request headers.","commit_id":"09e994ab2e33856f3c475e909e82995aebab231d"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"a25cfb9692dc9dd193261e9843e5345c304846bd","unresolved":false,"context_lines":[{"line_number":35,"context_line":"support staff, or to third parties storing the logs."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Version 3 of the Identity API does not pass the tokens in the URLs"},{"line_number":38,"context_line":"anymore. This information is sent using the POST data instead."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"### Recommended Actions ###"},{"line_number":41,"context_line":"Where possible, users and services interacting with the Keystone service"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1abeadc6_75b697fa","line":38,"in_reply_to":"1abeadc6_d8d3edd2","updated":"2014-08-28 18:21:48.000000000","message":"Well spotted, thanks. Actually it\u0027s headers or POST data (/auth/tokens supports token in data)","commit_id":"09e994ab2e33856f3c475e909e82995aebab231d"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"83a75e2c9df411dfca9550002c05a1423528f74d","unresolved":false,"context_lines":[{"line_number":44,"context_line":"problem at the cost of removing potentially useful log information. Due"},{"line_number":45,"context_line":"to various ways Keystone may be deployed and configured, interaction of"},{"line_number":46,"context_line":"the \u0027debug\u0027, \u0027verbose\u0027, \u0027default_log_levels\u0027 and any wsgi server options"},{"line_number":47,"context_line":"should be considered for this change."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"If logging of all requests is required, this may be achieved by using a"},{"line_number":50,"context_line":"third-party proxy, like Apache or Nginx with a configuration that does"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1abeadc6_f80ee939","line":47,"updated":"2014-08-22 19:18:35.000000000","message":"This is not just about Keystone logs though. Pretty much any place where the URL is visible are problematic. Proxies, load-balancers, routers, etc. Bottom line, don\u0027t use V2 token API. :)","commit_id":"09e994ab2e33856f3c475e909e82995aebab231d"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"a25cfb9692dc9dd193261e9843e5345c304846bd","unresolved":false,"context_lines":[{"line_number":44,"context_line":"problem at the cost of removing potentially useful log information. Due"},{"line_number":45,"context_line":"to various ways Keystone may be deployed and configured, interaction of"},{"line_number":46,"context_line":"the \u0027debug\u0027, \u0027verbose\u0027, \u0027default_log_levels\u0027 and any wsgi server options"},{"line_number":47,"context_line":"should be considered for this change."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"If logging of all requests is required, this may be achieved by using a"},{"line_number":50,"context_line":"third-party proxy, like Apache or Nginx with a configuration that does"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1abeadc6_15900342","line":47,"in_reply_to":"1abeadc6_2f8d2b32","updated":"2014-08-28 18:21:48.000000000","message":"No, Apache will behave differently, but that\u0027s the reason for \"and any wsgi server options\tshould be considered for this change.\" We cannot predict all deployment models. Would you phrase it differently?","commit_id":"09e994ab2e33856f3c475e909e82995aebab231d"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"e90610148e282efb5b76f9d5f107383b1a6ae257","unresolved":false,"context_lines":[{"line_number":44,"context_line":"problem at the cost of removing potentially useful log information. Due"},{"line_number":45,"context_line":"to various ways Keystone may be deployed and configured, interaction of"},{"line_number":46,"context_line":"the \u0027debug\u0027, \u0027verbose\u0027, \u0027default_log_levels\u0027 and any wsgi server options"},{"line_number":47,"context_line":"should be considered for this change."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"If logging of all requests is required, this may be achieved by using a"},{"line_number":50,"context_line":"third-party proxy, like Apache or Nginx with a configuration that does"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1abeadc6_2f8d2b32","line":47,"in_reply_to":"1abeadc6_f80ee939","updated":"2014-08-26 04:55:24.000000000","message":"This will not fix apache deployed keystone (setting log level). It only affects eventlet.","commit_id":"09e994ab2e33856f3c475e909e82995aebab231d"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"d9a4f1a66e870550fab25041dbfe7227ea878f1c","unresolved":false,"context_lines":[{"line_number":28,"context_line":"  \"GET /v2.0/tokens/\u003cplaintext_token\u003e HTTP/1.1\" 403 325 0.006539"},{"line_number":29,"context_line":"---- end example keystone.log snippet ----"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Large systems tend to use remote logging systems, which may use"},{"line_number":32,"context_line":"unencrypted protocols (like syslog/udp). This could lead to distributing"},{"line_number":33,"context_line":"the logfile entries containing tokens to systems with different"},{"line_number":34,"context_line":"authorization rules - for example providing easy access to tokens to"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_166a631a","line":31,"updated":"2014-09-01 09:23:02.000000000","message":"tiny little nit, Large systems tend to use remote logging s/systems/mechanisms/ lowering frequency of the word \"systems\".","commit_id":"8a67dfd5c7d3fae3cb9db0160b4cc9e2cfca238a"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"e169e9ed7cab0b6125373d74ec0eeb30fa880e08","unresolved":false,"context_lines":[{"line_number":28,"context_line":"  \"GET /v2.0/tokens/\u003cplaintext_token\u003e HTTP/1.1\" 403 325 0.006539"},{"line_number":29,"context_line":"---- end example keystone.log snippet ----"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Large systems tend to use remote logging systems, which may use"},{"line_number":32,"context_line":"unencrypted protocols (like syslog/udp). This could lead to distributing"},{"line_number":33,"context_line":"the logfile entries containing tokens to systems with different"},{"line_number":34,"context_line":"authorization rules - for example providing easy access to tokens to"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_707c7e21","line":31,"in_reply_to":"fa98f980_166a631a","updated":"2014-09-01 16:50:27.000000000","message":"Done. Added more entropy to the wording system.","commit_id":"8a67dfd5c7d3fae3cb9db0160b4cc9e2cfca238a"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"4860daf417b36228cb5edf1ef8a9732445c547e1","unresolved":false,"context_lines":[{"line_number":51,"context_line":"to various ways Keystone may be deployed and configured, interaction of"},{"line_number":52,"context_line":"the \u0027debug\u0027, \u0027verbose\u0027, \u0027default_log_levels\u0027 and any wsgi server options"},{"line_number":53,"context_line":"should be considered for this change. Keystone deployed via servers"},{"line_number":54,"context_line":"other than eventlet will need their own solution."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"If logging of all requests is required, this may be achieved by using a"},{"line_number":57,"context_line":"third-party proxy, like Apache or Nginx with a configuration that does"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"1abeadc6_62197587","line":54,"updated":"2014-08-28 23:30:47.000000000","message":"This extra verbiage helps to clarify, as before it was not clear this was only targeting eventlet deployments. I would argue this information should be higher up in the OSSN as well.\n\nHowever, this addition is sufficient to help clarify the scope..","commit_id":"8a67dfd5c7d3fae3cb9db0160b4cc9e2cfca238a"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"33a7d5f0f306e193660a2e964de8f3d52dc93aca","unresolved":false,"context_lines":[{"line_number":29,"context_line":"---- end example keystone.log snippet ----"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Large systems tend to use remote logging mechanisms, which may use"},{"line_number":32,"context_line":"unencrypted protocols (like syslog/udp). This could lead to distributing"},{"line_number":33,"context_line":"the logfile entries containing tokens to systems with different"},{"line_number":34,"context_line":"authorization rules - for example providing easy access to tokens to"},{"line_number":35,"context_line":"support staff, or to third parties storing the logs."}],"source_content_type":"application/octet-stream","patch_set":9,"id":"fa98f980_9730bf02","line":32,"updated":"2014-09-02 15:23:37.000000000","message":"This line suggests two risks:\n1 - remote logging leading to unauthorized users accessing token data\n2 - unencrypted protocols allowing an attacker to access token data while it is in transit to the logging mechanism, especially if this is done across an untrusted network.\n\nSuggest you reword the rest of this paragraph slightly to cover both cases, otherwise its a +1 from me :)","commit_id":"753e0d0e87f85ea6a20de601d522a3382dd4ffdf"}]}