Page MenuHomePhabricator
Create Task
Maniphest T311652

AQS Cassandra superuser has default password
Closed, ResolvedPublicSecurity
Actions

Description

The Cassandra superuser on the AQS cluster is using the (obvious, well-known) default password.

Details

Risk Rating
Low
Author Affiliation
WMF Technology Dept
SubjectRepoBranchLines +/-
Add a hiera alias for the cassandra superuser password to AQSoperations/puppetproduction+1 -0
Correct the hiera entries for the aqs cassandra super userlabs/privatemaster+2 -2
Assign new password to Cassandra superuserlabs/privatemaster+2 -0
Customize query in gerrit

Related Objects

Event Timeline

Eevans created this task.Jun 29 2022, 4:41 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 29 2022, 4:41 PM
BTullis claimed this task.Jun 29 2022, 5:09 PM
BTullis subscribed.

I'll make a similar change to the private repo and apply it tomorrow, all being well. I might start with the old aqs servers, then promote it to the aqs_next servers once it's been shown to be harmless.

BTullis added a project: Data-Engineering-Kanban.Jun 29 2022, 5:09 PM
BTullis moved this task from Next Up to In Progress on the Data-Engineering-Kanban board.
sbassett added a project: Vuln-Infoleak.Jul 5 2022, 7:08 PM
sbassett moved this task from Incoming to In Progress on the Security-Team board.Jul 6 2022, 5:17 PM
BTullis mentioned this in rLPRI379411a19918: Assign new password to Cassandra superuser.Jul 8 2022, 10:29 AM
BTullis mentioned this in rLPRIaeacb3c3c387: Correct the hiera entries for the aqs cassandra super user.Jul 8 2022, 11:13 AM
BTullis added a comment.Jul 8 2022, 12:00 PM

I've now updated the private repo with cassandra::super_password entries for both aqs and aqs_next.

It turns out that this was all that was required and a puppet run does correctly update all of the /etc/cassandra-${instance}/cqlshrc files.

@Eevans - you can now read this file and then update the cassandra instances at your convenience. Is that OK, or would you prefer me to do it?

BTullis reassigned this task from BTullis to Eevans.Jul 8 2022, 12:11 PM
Eevans added a comment.Jul 8 2022, 3:04 PM
In T311652#8065082, @BTullis wrote:

I've now updated the private repo with cassandra::super_password entries for both aqs and aqs_next.

It turns out that this was all that was required and a puppet run does correctly update all of the /etc/cassandra-${instance}/cqlshrc files.

@Eevans - you can now read this file and then update the cassandra instances at your convenience. Is that OK, or would you prefer me to do it?

I'll take care of it; Thanks @BTullis !

Eevans closed this task as Resolved.Jul 8 2022, 7:51 PM
sbassett moved this task from In Progress to Our Part Is Done on the Security-Team board.Jul 8 2022, 8:36 PM
sbassett added a project: SecTeam-Processed.
sbassett subscribed.

@Eevans - if the creds have been rotated, I assume there are no other issues in making this task public?

Eevans added a comment.Jul 8 2022, 8:46 PM
In T311652#8066608, @sbassett wrote:

@Eevans - if the creds have been rotated, I assume there are no other issues in making this task public?

Nope; None that I am aware of!

sbassett triaged this task as Low priority.Jul 8 2022, 9:29 PM
sbassett changed Author Affiliation from N/A to WMF Technology Dept.
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".
sbassett changed the edit policy from "Custom Policy" to "All Users".
sbassett changed Risk Rating from N/A to Low.
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits