erlang_cookie echo'ed to agent output

[nerdcorenet]

Since erlang_cookie is sensitive data (authentication credential for cluster members), it should not be shown in the output of puppet agent.

Affected Puppet, Ruby, OS and module versions/distributions

• Puppet: 6.15.0
• Distribution: Ubuntu 18.04
• Module version: Latest (master)

How to reproduce (e.g Puppet code you use)

class { 'rabbitmq':
  config_cluster           => true,
  cluster_nodes            => ['rabbit1', 'rabbit2'],
  cluster_node_type        => 'ram',
  erlang_cookie            => 'A_SECRET_COOKIE_STRING',
  wipe_db_on_cookie_change => true,
}

What are you seeing

Notice: /Stage[main]/Rabbitmq::Config/Rabbitmq_erlang_cookie[/var/lib/rabbitmq/.erlang.cookie]/content: current_value '', should be 'A_SECRET_COOKIE_STRING'

What behaviour did you expect instead

Notice: /Stage[main]/Rabbitmq::Config/Rabbitmq_erlang_cookie[/var/lib/rabbitmq/.erlang.cookie]/content: current_value '', should be {md5}df8c77441bb0be2876cdfe6fd69d70ce

[wyardley]

It's been a while, but does anyone know the current state of the art about preventing sensitive information from being leaked? I know that Puppet has the "sensitive" type, but my memory is that, in the past, it was not actually that tricky to prevent things from being exposed.

https://puppet.com/blog/my-journey-securing-sensitive-data-puppet-code/ has some info that may be useful.

[nerdcorenet]

The usual method for a File resource is to pass the parameter "show_diff => false" but I'm not sure what this causes to happen internally or how to apply this technique to other resource types

https://puppet.com/docs/puppet/latest/types/file.html#file-attribute-show_diff