Jira (PUP-7057) User provider shows plaintext password when it changes a managed users password

[Josh Cooper (JIRA)]

Title: Message Title

Josh Cooper commented on PUP-7057   Re: User provider shows plaintext password when it changes a managed users password The user type ensures passwords are redacted in all log destinations, e.g. e.g. console, windows event log, etc. Puppet has worked this way for a long time and it ensures we handle user password consistently on *nix and Windows. The linked tickets also describe other ways that passwords have leaked, e.g. IIS provider, when exec command fails, when running with --debug. Those issues have all been addressed. The remaining issue is that old and new values end up in the report, and the PE console will display those value. That issue is captured in the PUP-6482 epic, so I don't think we need a PUP issue for that. I agree that we should mention Sensitive in the password documentation, so adding the DOCS component and assigning to Jorie Tappa. Add Comment   This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.