Actions
Bug #2709
closedForeman stores compute_resource passwords in plaintext
Status:
Duplicate
Priority:
Normal
Assignee:
-
Category:
Compute resources
Target version:
-
Description
Foreman stores the user credentials for compute_resources (vmware in our case) in plain-text. We will have an API user that has full access into the specific datacenters we'll use. Assuming we've done our homework, no one should have access to this, but it exposes a very sensitive piece of info in plain-text that should not be that way.
Expected behavior would be a hashed password being stored.
(The database is dumped for backup, and perhaps people who have access to the backups shouldn't have access to a plain-text version of this password.)
Actions