Re: FYI - ACS exposes password in log file

[Brian Parkins <goodprophet.bp@xxxxxxxxx>]

David has already indicated that the following post, (on the RPG400-L 
list) belongs on MIDRANGE-L. However, I am cross-posting here because 
RDi comes with some components of ACS built-in - regardless of whether 
ACS is installed or not.

Therefore. RDi users might wish to take note of Thomas' findings.

Brian.

On 28/10/2019 08:16, Thomas Raddatz wrote:
> Hi,
>
> By chance I noticed that ACS exposes the password in a log file created with log level 'FINE'. That is just for the records and something you may want remember, when enabling logging:
>
> 2019/10/23 7:23:39.786 #1   FINE: com.ibm.iaccess.base.AcsAttachThread.isDesiredPlugin (AcsAttachThread.java:227) [/4.dat]
>     name: /plugin=pcs
> 2019/10/23 7:23:39.787 #1   FINE: com.ibm.iaccess.base.AcsAttachThread.access$600 (AcsAttachThread.java:51) [/4.dat]
>     Attach not needed for: [/PLUGIN=logon, /SYSTEM=ghentw.gfd.de, /USERID=raddatz, /PASSWORD=myS3cret]
> 2019/10/23 7:23:39.787 #1   FINE: com.ibm.iaccess.base.AcsEnvironment.setLauncherPropForFileAssociations (AcsEnvironment.java:484) [/4.dat]
>     com.ibm.iaccess.base.AcsFile: invoked isDirectory() on file [C:\Users\traddatz\AppData\Local\IBM\Access Client Solutions\acsbundle.jar], result=false
>
> I replaced my password with 'myS3cret' to keep it secret.
>
> Thomas.