When a TLS-enabled listener fails to bind to a port, the entire TLS config (potentially including sensitive values) is logged together with the exception #13958
-
Describe the bugRabbitMQ logs sensitive data as the password of certificate private key in rabbit@'machineName'.log: Text from log file: 2025-05-26 16:28:42.027000+03:00 [error] <0.624.0> Failed to start Ranch listener {acceptor,{0,0,0,0},5671} in ranch_ssl:listen(#{num_acceptors => 10,handshake_timeout => 5000,socket_opts => [{ip,{0,0,0,0}},{port,5671},inet,{backlog,128},{nodelay,true},{linger,{true,0}},{exit_on_close,false},{versions,['tlsv1.3']},{hibernate_after,6000},{keyfile,"c:\\certificates\\private.key"},{certfile,"c:\\certificates\\public.crt"},{cacertfile,"c:\\certificates\\ca.crt"},{fail_if_no_peer_cert,true},{verify,verify_peer},{password,'...'}],connection_type => supervisor,num_conns_sups => 1,max_connections => infinity}) for reason eaddrinuse (address already in use) Reproduction steps
Expected behaviorThe password of certificate private key file not logged or logged in a masked form. Additional contextNo response |
Beta Was this translation helpful? Give feedback.
Replies: 4 comments 18 replies
-
|
The answer is Configuration Value Encryption. The docs explain how to use such values with rabbitmq.confThese days they are even supported in key = encrypted:Valuewhere the value will be parsed as According to the {mapping, "ssl_options.password", "rabbit.ssl_options.password",
[{datatype, [tagged_binary, binary]}]}.In other words, compute the encrypted value as explained in the docs and then ssl_options.password = encrypted:a501a2c7958cb22cf1c665e7de2b2b3c032ed615(I am using an example value) |
Beta Was this translation helpful? Give feedback.
-
|
The first log message is from Ranch and the value is filtered. The value is not filtered in the supervisor report, over which Ranch has no control. |
Beta Was this translation helpful? Give feedback.
-
|
@vlcht why are you using Erlang/OTP 28.0? |
Beta Was this translation helpful? Give feedback.
-
|
@vlcht a fix might appear when someone contributes it. You can be that someone. This is open source software after all. |
Beta Was this translation helpful? Give feedback.
-
@ansd thanks, i'm using 27.3, tried with 28 |
Beta Was this translation helpful? Give feedback.
-
|
Similar situation if RabbitMQ configured incorrectly (RabbitMQ 4.0.7, Erlang 27.3): |
Beta Was this translation helpful? Give feedback.
-
|
The runtime logs all exceptions with a lot of detail by design. Our team has gone some lengths before to make sure that the sensitive connection, session, channel values are stored internally as encrypted, and decrypted on access. However, this is a very different case. We have a few options here:
@vlcht given that such events are not particularly common — we do not recommend running RabbitMQ next to other data services that could use the same port, or run multiple nodes on the same host in production — it's hard to justify spending time on this for our small team. So we need someone to volunteer to look into this. |
Beta Was this translation helpful? Give feedback.
-
|
@lhoguin has found out a much easier solution: the password now can be passed in as a function, so that's what we need to do in the RabbitMQ code. We need, however, to verify that Erlang 26 supports this option, or make it specific to Erlang 27+. |
Beta Was this translation helpful? Give feedback.
-
|
Erlang/OTP 26 has |
Beta Was this translation helpful? Give feedback.
-
|
And the |
Beta Was this translation helpful? Give feedback.
-
|
#13999 takes the "wrap the value in a function" approach which Erlang 26+ supports. Kudos to @lhoguin for bringing this up with the Erlang/OTP team a while ago and @dcorbacho for confirming my findings about Erlang 26+ support. |
Beta Was this translation helpful? Give feedback.
-
|
@vlcht can you please give this 4.1.x alpha build a shot? It includes #13999, which we expect it to ship in |
Beta Was this translation helpful? Give feedback.
-
|
@michaelklishin thanks! problem with busy port is out: |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for confirming, we will apply the same change for the management and other plugins. |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
#13999 takes the "wrap the value in a function" approach which Erlang 26+ supports. Kudos to @lhoguin for bringing this up with the Erlang/OTP team a while ago and @dcorbacho for confirming my findings about Erlang 26+ support.