Open Stack

CVE-2013-1977 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1977):
  OpenStack devstack uses world-readable permissions for keystone.conf, which
  allows local users to obtain sensitive information such as the LDAP password
  and admin_token secret by reading the file.

-- 
You received this bug notification because you are a member of OpenStack
Security Group, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1168252

Title:
  keystone.conf should not be world-readable (to keep LDAP password and
  admin_token secret)

Status in devstack - openstack dev environments:
  Confirmed
Status in OpenStack Security Notes:
  Fix Released
Status in Gentoo Linux:
  Unknown

Bug description:
  The password configuration of LDAP and admin_token in keystone.conf
  should be secret to protect security information:

  [ldap]
  # url = ldap://localhost
  # user = dc=Manager,dc=example,dc=com
  # password = None                                            <- should be secrect
  # suffix = cn=example,cn=com
  # use_dumb_member = False
  # allow_subtree_delete = False
  # dumb_member = cn=dumb,dc=example,dc=com

  
  [DEFAULT]
  admin_token = passw0rd                                <- should be secrect

To manage notifications about this bug go to:
https://bugs.launchpad.net/devstack/+bug/1168252/+subscriptions