Rundeck App for Splunk token value exposed in log events

[sylbaea]

Hello,

During troubleshooting, I noticed token value is exposed in clear text in some log events... That is not very good from a security perspective. Could you please fix that... below a sample event:

09-25-2018 04:42:08.751 +0000 ERROR ExecProcessor - message from "python <...>/splunk/etc/apps/rundeck_app/bin/rundeck.py" ERROR:Rundeck:rundeck://users : HTTP Request error: 400 Client Error: Bad Request for url: https://<FQDN>/api/18/user/list?authtoken=<MY TOKEN !>

Regards.

[plambertrundeck · Accepted solution]

Version 1.0.2 of The Rundeck App for Splunk is now available in Splunkbase and addresses this issue. Thank you for your feedback!

[plambert]

Please reach out to me at plambert@rundeck.com for a patched version of the application that we expect will resolve this issue. If you're able to take the time to verify in your environment that it is resolved, then we will give you the chance to do so before publishing it.

If you don't have the time to verify, we understand, just let me know and the updated version will be published soon after.

Paul M. Lambert
Platform Solutions Architect
Rundeck, Inc

[sylbaea]

just sent you a mail. Thanks.

[plambert]

Thank you for pointing this out. We're looking at it and will have a workaround and/or fix as soon as possible.

Paul M. Lambert
Platform Solutions Architect
Rundeck, Inc

[plambert]

If you need an immediate workaround, please comment out line 346 of $SPLUNK_HOME/etc/apps/rundeck_app/bin/rundeck.py.

We will have a new version with the correct fix (and not a workaround) released as soon as we can.

Thank you again for noticing and reporting this.

Paul M. Lambert
Platform Solutions Architect
Rundeck, Inc