Applications such as Zowe can store secure information on the end user’s machine. This is not very secure! It is built into the operating systems. It is a bit like securing a door with a bit of string. Joshua Waters pointed out
The fact of the matter is that regardless of whether or not you are storing your credentials on a machine, if there is a virus or malicious actor on it, your credentials are up for grabs while the user is logged in. The only time they wouldn’t be up for grabs is if you were using an application that either require some master key to access the credentials store for it, or every authed request to the server requires user to re-enter credentials.
On Linux
The information is in the gnome-keyring ~/.local/share/keyrings/login.keyring .
You can use the Linux command seahorse to display the contents of the gnome-keyring. The user’s password is used to decrypt the store.
The following python code display the keyring contents
import secretstorage
conn = secretstorage.dbus_init()
collection = secretstorage.get_default_collection(conn)
for item in collection.get_all_items():
print('='*30)
print('label:', item.get_label())
print('attributes:')
for k,v in item.get_attributes().items():
print('\t%-12s: %s' % (k,v))
print('secret:',item.get_secret())This gave
label: Zowe/secure_config_props
attributes:
account : secure_config_props
service : Zowe
xdg:schema : org.freedesktop.Secret.Generic
secret: b'eyIva...9fQ=='
The secret is based64 encoded. You can decode it (on Linux) with
base64 -d <<<"eyIva...9fQ=="
This gave
{"/home/colinpaice/ssl/ssl2/zowe.config.json":
{"profiles.project_base.properties.user":"colin",
"profiles.project_base.properties.password":"password"
}
}
Where /home/colinpaice/ssl/ssl2/zowe.config.json is the name of the configuration file it applies to.
You can delete an entry using
import secretstorage
conn = secretstorage.dbus_init()
collection = secretstorage.get_default_collection(conn)
for item in collection.get_all_items():
print('='*30)
print('label:', item.get_label())
if item.get_label() == "Zowe/secure_config_props":
item.delete()
print("delete")
continue
This deletes all of the entries for that component – so all the Zowe data.
Who can see the contents of the store?
Your gnome-keyring is encrypted with your password, so you can access it. Someone one else would need your password to be able to decrypt it and see the contents.
What happens on other platforms?
On Windows and Mac’s it is essentially the same. There is a secure disk, and you need to be running as the owner to access it.
If your machine is infected with a virus, which runs under your userid, it can access the key stores and so get userid and password information store in the “secure store”.
ColinPaice 