{"action":"closed","issue":{"url":"https://api.github.com/repos/hashicorp/nomad/issues/1875","repository_url":"https://api.github.com/repos/hashicorp/nomad","labels_url":"https://api.github.com/repos/hashicorp/nomad/issues/1875/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/nomad/issues/1875/comments","events_url":"https://api.github.com/repos/hashicorp/nomad/issues/1875/events","html_url":"https://github.com/hashicorp/nomad/issues/1875","id":185693543,"number":1875,"title":"Nomad API exposes task credentials to unauthenticated and unauthorized users","user":{"login":"rileyje","id":18637782,"avatar_url":"https://avatars.githubusercontent.com/u/18637782?v=3","gravatar_id":"","url":"https://api.github.com/users/rileyje","html_url":"https://github.com/rileyje","followers_url":"https://api.github.com/users/rileyje/followers","following_url":"https://api.github.com/users/rileyje/following{/other_user}","gists_url":"https://api.github.com/users/rileyje/gists{/gist_id}","starred_url":"https://api.github.com/users/rileyje/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rileyje/subscriptions","organizations_url":"https://api.github.com/users/rileyje/orgs","repos_url":"https://api.github.com/users/rileyje/repos","events_url":"https://api.github.com/users/rileyje/events{/privacy}","received_events_url":"https://api.github.com/users/rileyje/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-10-27T14:59:25Z","updated_at":"2016-11-01T22:07:49Z","closed_at":"2016-11-01T22:07:49Z","body":"In our environment, we have multiple groups which each have their own Docker registry. It is important that the registries are isolated and Group A not be able to pull from the Group B registry. However with Nomad it appears the Docker credentials are trivially available via the HTTP API, and a user could submit a job to scrape the API and collect all of the credentials by listing allocations and inspecting them.\n\nThe API should not return sensitive information.\n### Nomad version\n\nNomad v0.4.1\n### Operating system and Environment details\n\nCentOS Linux release 7.2.1511 (Core)\nLinux 3.10.0-327.36.2.el7.x86_64\n### Issue\n\nCredentials provided to driver are made publicly available via the HTTP API of all servers and clients in the Nomad cluster, via both the /v1/job/jobID and /v1/allocation/allocID endpoints.\n### Reproduction steps\n1. deploy a Nomad cluster\n2. `nomad init`\n3. Edit example.nomad and add following to section `task \"redis\"`:\n   \n   ```\n   auth = {\n           username = \"example\"\n           password = \"secret123\"\n   }\n   ```\n4. `nomad run example`\n5. Use curl to query /v1/job/<job id> endpoint on local host:\n   \n   ```\n   curl -s http://127.0.0.1:4646/v1/job/example |jq '.TaskGroups[].Tasks[].Config.auth'\n   [\n           {\n                   \"password\": \"secret123\",\n                   \"username\": \"example\"\n          }\n   ]\n   ```\n6. Find allocation ID and node IP address, curl HTTP API on node:\n   \n   ```\n   curl -s http://172.26.106.43:4646/v1/allocation/$alloc_id |jq '.[\"Job\"].TaskGroups[].Tasks[].Config.auth'\n   [{\n           \"username\": \"example\",\n           \"password\": \"secret123\"\n   }]\n   ```\n### Job file (if appropriate)\n\n```\njob \"example\" {\n        region = \"aws\"\n        datacenters = [\"us-east-1a\"]\n        constraint {\n                attribute = \"${attr.kernel.name}\"\n                value = \"linux\"\n        }\n        update {\n                stagger = \"10s\"\n                max_parallel = 1\n        }\n        group \"cache\" {\n                restart {\n                        attempts = 10\n                        interval = \"5m\"\n                        delay = \"25s\"\n                        mode = \"delay\"\n                }\n                task \"redis\" {\n                        driver = \"docker\"\n                        config {\n                                auth = {\n                                        username = \"example\"\n                                        password = \"secret123\"\n                                }\n                                image = \"redis:latest\"\n                                port_map {\n                                        db = 6379\n                                }\n                        }\n                        service {\n                                name = \"${TASKGROUP}-redis\"\n                                tags = [\"global\", \"cache\"]\n                                port = \"db\"\n                                check {\n                                        name = \"alive\"\n                                        type = \"tcp\"\n                                        interval = \"10s\"\n                                        timeout = \"2s\"\n                                }\n                        }\n                        resources {\n                                network {\n                                        mbits = 10\n                                        port \"db\" {\n                                        }\n                                }\n                        }\n                }\n        }\n}\n```\n"}}
{"actor":{"display_login":"dadgar"}}