Re: FYI - ACS exposes password in log file

David has already indicated that the following post, (on the RPG400-L list) belongs on MIDRANGE-L. However, I am cross-posting here because RDi comes with some components of ACS built-in - regardless of whether ACS is installed or not.

Therefore. RDi users might wish to take note of Thomas' findings.

Brian.

On 28/10/2019 08:16, Thomas Raddatz wrote:

Hi,

By chance I noticed that ACS exposes the password in a log file created with log level 'FINE'. That is just for the records and something you may want remember, when enabling logging:

2019/10/23 7:23:39.786 #1 FINE: com.ibm.iaccess.base.AcsAttachThread.isDesiredPlugin (AcsAttachThread.java:227) [/4.dat]
name: /plugin=pcs
2019/10/23 7:23:39.787 #1 FINE: com.ibm.iaccess.base.AcsAttachThread.access$600 (AcsAttachThread.java:51) [/4.dat]
Attach not needed for: [/PLUGIN=logon, /SYSTEM=ghentw.gfd.de, /USERID=raddatz, /PASSWORD=myS3cret]
2019/10/23 7:23:39.787 #1 FINE: com.ibm.iaccess.base.AcsEnvironment.setLauncherPropForFileAssociations (AcsEnvironment.java:484) [/4.dat]
com.ibm.iaccess.base.AcsFile: invoked isDirectory() on file [C:\Users\traddatz\AppData\Local\IBM\Access Client Solutions\acsbundle.jar], result=false

I replaced my password with 'myS3cret' to keep it secret.

Thomas.