Ceph

I would expect the `diskprediction_cloud` module to also be affected by this. See http://docs.ceph.com/docs/master/mgr/diskprediction/#connection-settings

I think that is going to be very hard to detect when a command parameter should be hidden or not. Because trying to deduce this point using only the name of the parameter probably will drive us to wrong decisions.

In my view, we have two options:
1. To have a predefined list of parameters names whose value must be hidden always in the logs.
2. To add a new optional parameter for all the Ceph manager commands ( --nolog for example ) to avoid to log the command (or just log the command without parameters)

For the current log trace:

cmd=[{"prefix": "dashboard ac-user-create", "force_password": true, "username": "admin", "password": "admin", "rolename": "administrator", "target": ["mon-mgr", ""]}]

• Forcing sensitive information not to be passed by command line (e.g.: read from file): as commands are kept in shell history and procfs also keeps cmdline in memory.

• Per-command: Adding a new MonCommand FLAG (src/mon/MonCommand.h), like FLAG_SANITIZE_CMDARGS. It'd print the command trace but with everything except the prefix redacted out:
  

  cmd=[{"prefix": "dashboard ac-user-create", "force_password": SANITIZED, "username": SANITIZED, "password": SANITIZED, "rolename": SANITIZED, "target": ["mon-mgr", ""]}]
  

• Per-argument 1 (new flag) (as we may still want to log some command args): Adding a new command option to cmddesc, like name=password,type=CephString,sanitized=true
  

  cmd=[{"prefix": "dashboard ac-user-create", "force_password": true, "username": "admin", "password": SANITIZED, "rolename": "administrator", "target": ["mon-mgr", ""]}]
  

• Per-argument 2 (new Ceph Type): Adding a new CephType, like name=password,type=CephSecret
  

  cmd=[{"prefix": "dashboard ac-user-create", "force_password": true, "username": "admin", "password": SANITIZED, "rolename": "administrator", "target": ["mon-mgr", ""]}]
  

• New Ceph Option Flag: Adding a new flag for Ceph Options (like FLAG_DO_NOT_LOG):
  

  cmd=[{"prefix": "dashboard ac-user-create", "force_password": true, "username": "admin", "password": SANITIZED, "rolename": "administrator", "target": ["mon-mgr", ""]}]
  

This would be required both for ceph-mgr commands and also for ceph-mon config/config-key commands, as these Mgr commands end up stored in the Mon KV store.

Rook really would benefit from at least a simple solution that sanitizes the log for setting the dashboard password. Rook doesn't need to worry about shell history either.

What's the simplest solution to avoid logging the dashboard username/password? Couldn't the log at least be sanitized if the prefix matches certain commands like "dashboard set-login-credentials"? Let's at least get something simple for the commands that currently exist instead of waiting for the perfect solution.