From 30205445a3305d607c734035779bdf17bc4ad4e5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mike=20Gro=C3=9Fmann?= Date: Mon, 6 Jul 2026 12:13:20 +0200 Subject: [PATCH] Stop logging the plaintext password on a failed login cred_login() wrote an operator/SYSLOG message on a failed racf_login() that included the attempted password in plaintext, e.g. cred_login: racf_login("NOSUCHUS", "WRONGPW") failed, rc=28 This duplicated RAKF's own RAKF0004 audit message and leaked a plaintext credential to the console and SYSLOG -- on a mistyped login that is the real password, and endpoint-probing bots spam the log with password- bearing lines. It also contradicts the credential package's own posture of keeping the password Blowfish-encrypted at rest and never handing it back in the clear. Remove the message entirely: RAKF0004 already provides the failure audit trail and the rc is returned to the caller. The surrounding internal- error diagnostics (cred_array()/credkey() NULL, cred_new()/array_add() failed, array full) are unaffected -- they are rare and carry no sensitive data. Fixes #116 --- credentials/src/credlin.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/credentials/src/credlin.c b/credentials/src/credlin.c index 1adab2e..fd498cf 100644 --- a/credentials/src/credlin.c +++ b/credentials/src/credlin.c @@ -65,11 +65,12 @@ cred_login(unsigned addr, unsigned char *userid, unsigned char *password) cred = cred_find_by_token(&tok); if (cred) goto cleanup; - /* attempt to login via racf interface */ + /* attempt to login via racf interface. On failure RAKF already writes its + own RAKF0004 audit message, so we do NOT log here -- an httpd message + would only duplicate it, and logging the attempted password (pass) would + leak a plaintext credential to the console/SYSLOG (issue #116). */ acee = racf_login(user, pass, 0, &rc); if (!acee) { - wtof("%s: racf_login(\"%s\", \"%s\") failed, rc=%d", - __func__, user, pass, rc); goto cleanup; }