logging passwords?

[setharnold]

fence-agents/agents/eps/fence_eps.py

Line 41 in 542fb6d

logging.debug("Authorization: %s\n", auth_str)

Hello, this appears to log passwords when run with debug logging enabled. Quite often even debug logs don't include authentication credentials, so that administrators can be more confident in sharing logs with others.

Is this intentional and expected?

Thanks

[setharnold]

fence-agents/agents/skalar/fence_skalar.py

Line 213 in 542fb6d

cookie = authorize_and_get_cookie(options["--ip"], options["--username"], options["--password"], options)

also appears to be willing to log passwords.

[oalbrigt]

In fence_eps it's only when verbose logging is enabled (and also it's base64 encoded, so not in clear text either). fence_skalar also only does it with --verbose.