Details

Common feature that applications use to provide users a convenience is to cache the password locally in the browser (on the client machine) and having it ‘pre-typed’ in all subsequent requests. While this feature can be perceived as extremely friendly for the average user, at the same time, it introduces a flaw, as the user account becomes easily accessible to anyone that uses the same account on the client machine and thus may lead to compromise of the user account.

Solution

Set the value of parameter password_autocomplete in /etc/openstack-dashboard/local_settings.py to off

Supportive Information

The following resource is also helpful.

• http://docs.openstack.org/security-guide/dashboard/checklist.html

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Unix.

References

• 800-53|CM-7.

Source

• Tenable.com/audits