[FEATURE REQUEST] Hash minion IDs, in the "tgt" field, in the public channel for minions. #67342
intentropy
started this conversation in
Feature Requests
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
I have noticed when debugging salt minions that the public channel is read by the minion, and is shown in its debug output. This would also be logged at a debug level for the minion. I understand the need for the public channel to provide the minion its tasks, and also that most of the information is encrypted and requires the minions accepted key; however, the tgt is in plain text, and I think there is a simple solution for this. I would like to see the minion IDs hashed before placed in the public channel.
There are some potential security issues here, mostly in exposing information on what other minions exist, and what their potential role may be by correlating the id with the arg and the fun fields, in the output. The information pertaining to the minion is only needed by that minion, and that minion will be able to determine the hash of it's own minion id, so it will still be able to see the tasks it is meant to carry out.
Also, you could potentially cache a hash of the synced modules function names and hash that as well, but that may be outside of the scope of this request.
Let me know if this is something that should be considered by a salt enhancement proposal.
Beta Was this translation helpful? Give feedback.
All reactions