[openstack-dev] passwords in logs --security related

Steve Baker sbaker at redhat.com
Mon Apr 22 19:51:39 UTC 2013


On 04/23/2013 12:11 AM, Thierry Carrez wrote:
> Dolph Mathews wrote:
>> 3) if any other service is handling passwords, then we're doing
>> something very wrong
> Some other services peruse external credentials, for example for storage
> backends.
>
Heat currently does too much with passwords, but everything is in place
now for token-only operations. Soon I'd like to drop any password at the
API and remove the password code paths.



More information about the OpenStack-dev mailing list