Actions
Feature #16580
closed
Restrict and document access to BMC credentials
Description
BMC interface credentials stored in Foreman are accessible through the ENC YAML output and through templates (#15046), however it isn't clear that they are so readily available when entering them and there is no option to restrict it.
It should be possible to disable access through the ENC YAML and templates to credentials if the administrator wishes, via a setting. This would use the credentials only for BMC smart proxies.
The BMC interface form should probably also state where the credentials are accessible from.
Reported by Alex Fisher to foreman-security@googlegroups.com, thanks. No CVE will be requested as it's by design, this is hardening.
Updated by The Foreman Bot almost 9 years ago
- Status changed from Assigned to Ready For Testing
- Pull request https://github.com/theforeman/foreman/pull/3855 added
Updated by Dominic Cleal almost 9 years ago
- Status changed from Ready For Testing to Closed
- % Done changed from 0 to 100
Applied in changeset 72b2f9f29fd20385762a8b219a6f2f79e27b21ff.
Updated by Dominic Cleal almost 9 years ago
- Translation missing: en.field_release set to 189
Actions