https://bugs.openldap.org/show_bug.cgi?id=10654

Issue ID: 10654 Summary: slapo-auditlog writes password values (hashed or cleartext) to the log Product: OpenLDAP Version: 2.7.2 Hardware: x86_64 OS: Linux Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: slapd Assignee: bugs@openldap.org Reporter: dns.spiros@gmail.com Target Milestone: ---

Created attachment 1241 --> https://bugs.openldap.org/attachment.cgi?id=1241&action=edit proposed patch for this ITS to apply with git-am.

slapo-auditlog records every value of every attribute in Add and Modify operations, including the internal Modify issued by the Password Modify extended operation. As a result userPassword hashes are written to the audit log, and cleartext passwords too when a client sends them (absent ppolicy hash_cleartext).

The database protects userPassword with ACLs (typically "by self write by anonymous auth"), but the audit log is a plain file that is commonly readable by a log group, rotated, backed up and shipped to SIEMs. Fast schemes such as {SSHA} make the logged hashes cheap to crack offline.

This conflicts with widely used security requirements:

- CWE-532 "Insertion of Sensitive Information into Log File": "Do not write secrets into the log files." https://cwe.mitre.org/data/definitions/532.html - NIST SP 800-63B-4, sec. 3.1.1.2: "Verifiers SHALL store passwords in a form that is resistant to offline attacks." A copy of the hashes in a log file defeats the protection given to the stored form. https://pages.nist.gov/800-63-4/sp800-63b/authenticators/ - OWASP ASVS 5.0, req. 16.2.5 (L2): logging must not include data such as credentials or payment details (4.0.3: req. 7.1.1).

https://github.com/OWASP/ASVS/blob/master/5.0/en/0x25-V16-Security-Logging-a... - DISA Application Security and Development STIG, V-222444 (APSC-DV-000650, CCI-000169): "The application must not write sensitive data into the application logs"; logging passwords is a finding.

https://www.stigviewer.com/stigs/application_security_and_development/2025-0...

Other directory servers: 389-DS stopped logging cleartext passwords in its audit log (Ticket 365, CVE-2010-3282) and since Issue 6884 (2025) also masks password hashes (userPassword, nsslapd-rootpw, replication credentials) in both LDIF and JSON audit logs, unconditionally.

The attached patch adds a multi-valued auditlogmask / olcAuditlogMask option. Values of the listed attributes (and their subtypes) are replaced by a "# <attr>: (masked)" comment line; the attribute name and modification type are still logged, so password changes remain auditable. A comment is used rather than a placeholder value so that replaying the log can never set a password to a known string. The default is empty, so behaviour is unchanged unless configured; masking userPassword by default could be considered. test090-auditlog and slapo-auditlog(5) are updated.

The patch is a single commit for git am. As I am not yet familiar with the current contribution practices, its subject still carries an ITS#XXXXX placeholder; please amend the commit message as you see fit when applying it.

The attached patch file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Elia Pinto gitter.spiros@gmail.com. I have not assigned rights and/or interest in this work to any party.

I, Elia Pinto, hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.