tomaswolf opened a new pull request, #289: URL: https://github.com/apache/mina-sshd/pull/289
With trace logging on, sensitive data in keyboard-interactive or in password user authentication ended up being logged via two paths both in a client or in a server. In a client: - when logging outgoing packets just before they are encrypted - when logging challenge responses in keyboard-interactive auth In a server: - when logging incoming packets just after having been decrypted - when logging received challenge responses (keyboard-interactive auth) Avoid this by not logging raw packet contents for SSH_MSG_USERAUTH_REQUEST and SSH_MSG_USERAUTH_INFO_RESPONSE. In the client, log challenge responses with echo=false as "(hidden)", and in the server don't log the received challenge responses at all, only their number. All these log messages are active only for trace logging, which is intended for detailed debugging. There is no reason to use trace logging on a production instance (it also may impact performance quite negatively). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
