search

ngoduykhanh / wireguard-ui

Wireguard web interface
MIT License
4.22k stars 515 forks source link

App logs private keys and pre shared secrets to logs #624

Open supaflyster opened 1 month ago

supaflyster commented 1 month ago

Currently app is logging whole client config when creating/updating/deleteing clients. That output contains private key and pre shared key.

log.Infof("Created wireguard client: %v", client)

{"time":"2024-09-21T20:07:19.1004342Z","level":"INFO","prefix":"-","file":"routes.go","line":"512","message":"Created wireguard client: {crnietsfsmgc712m957g {secret} {secret} {secret} NewClient [] [10.88.0.3/32] [0.0.0.0/0] [] true true 2024-09-21 20:07:19.100278387 +0000 UTC 2024-09-21 20:07:19.100278387 +0000 UTC}"}

Can be a security risk to leak those if someone has access to logs. Suggesting to limit output only to client.Name in the logs. Preparing a PR for that - relatively easy thing to fix.

spetzreborn commented 1 month ago

I have merged you PR in our proof of concept evaluation setup as I find it good to remove secrets from logs. We are sending logs to other servers and don't want to expose unnecessary secrets.