Passwords in Puppet Log files

edit

Have you considered setting a loglevel metaparameter for just the resources that you're trying to keep out of the logs? If you set it low enough, and your syslog config is discarding that level, you might have a quick fix. Docs are here:

https://docs.puppetlabs.com/reference...

Here are some techniques to help obfuscate your passwords:

1. Reduce or disable logging output on the client
2. Disable the show_diff option (Helps avoid passwords in your reports.)
3. Disable the catalog_cache_terminus; set catalog_cache_terminus="". (All your passwords are available in the catalog; this prevents the catalog from being written to disk.)
4. Avoid placing passwords in resource names; use the command parameter and a friendly resource title. (Resource names appear in verbose log messages and reports. Parameters appear in fewer places.)
5. Where possible, use other forms of authentication. The Puppet SSL certificate can be used, if your infrastructure trusts the CA cert, and maintains an access list.
6. Wrap passwords containing resources in if/then blocks, and only send them to the client when needed (note that class parameters are still sent to the client, so you might not want to parameterize your passwords with this approach.)
7. Centralize your logs; do not write them to the client.
8. Consider distributing passwords by other means, such as mcollective.
9. Write a post-run script that sanitizes your system.

All of these techniques simply obfuscate the passwords; any password sent to the client can be intercepted by a privileged user of that machine. The best way to secure your network is to avoid password reuse, or avoid using passwords at all.

There are some easy ways to generate unique deterministic passwords. One way would be to have the master hash a secret word with the clients certname. That password would be unique to that client, can be automatically generated by the master, but could not be generated for unathorized machines without knowing the original secret word. You could then distribute those passwords to other hosts using exported resources or other methods.