Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FEATURE] Clear text password stored in OPENSEARCH_INITIAL_ADMIN_PASSWORD_TXT is insecure #3847

Closed
dblock opened this issue Dec 14, 2023 · 1 comment
Labels
enhancement New feature or request untriaged Require the attention of the repository maintainers and may need to be prioritized

Comments

@dblock
Copy link
Member

dblock commented Dec 14, 2023

Is your feature request related to a problem?

Storing passwords in the clear is insecure. The implementation that was chosen in #3560 offers a way to specify the password in a file that will be permanently stored on disk. Even if deleted it can be recovered. This is not secure.

What solution would you like?

Get rid of the file support that stores a clear text password.

There's already a way to specify the admin password in a file, see https://code.dblock.org/2023/08/08/changing-the-default-admin-password-in-opensearch.html. It's not easy, but you can generate a configuration file with the password. We also do need an easier way to do this, captured in #3848.

What alternatives have you considered?

Do nothing.

Do you have any additional context?

https://code.dblock.org/2023/08/08/changing-the-default-admin-password-in-opensearch.html

@dblock dblock added enhancement New feature or request untriaged Require the attention of the repository maintainers and may need to be prioritized labels Dec 14, 2023
@dblock dblock changed the title [FEATURE] Clear text OPENSEARCH_INITIAL_ADMIN_PASSWORD and OPENSEARCH_INITIAL_ADMIN_PASSWORD_TXT are insecure [FEATURE] Clear text password stored in OPENSEARCH_INITIAL_ADMIN_PASSWORD_TXT is insecure Dec 14, 2023
@derek-ho
Copy link
Collaborator

Closing as it was done in #3850

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request untriaged Require the attention of the repository maintainers and may need to be prioritized
Projects
None yet
Development

No branches or pull requests

2 participants