Passwords in backup in plain text after server reset to defaults

[shadowempire]

Hi,
I want to sell my old TrueNAS Scale server.
So I did "Reset to Defaults".

Out from curiosity I downloaded a config backup (truenas-TrueNAS-SCALE-23.10.2-20240223170753.tar).
After untaring I found a plaintext password from an old nextcloud container which was already removed before the "Reset".
See the db entry (copy paste), I just replaced my "real" password with "my_password"

Aqö!U1AAnextcloud2023-12-22 07:46:45.469413An update is available for "%(name)s" application.{"name": "nextcloud", "info": {"first_deployed": "2022-02-18T13:05:47.477603226+01:00", "last_deployed": "2023-12-21T08:27:18.071589374+01:00", "deleted": "", "description": "Upgrade complete", "status": "deployed", "notes": "## Database\nYou can connect to the database using the pgAdmin App from the catalog\n\n<details>\n <summary>Database Details</summary>\n\n - Database: `nextcloud`\n - Username: `\ufffd\ufffd-\ufffd\ufffd\ufffd`\n - Password: `my_password`\n - Host: `nextcloud-postgres.ix-nextcloud.svc.cluster.local`\n - Port: `5432`\n\n</details>\n"}, "config": {"appVolumeMounts": {"nextcloud-data": {"datasetName": "ix-nextcloud_data", "hostPathEnabled": false, "mountPath": "/var/www"}}, "certificate": null, "cronjob": {"enabled": false}, "dnsConfig": {"options": []}, "enableResourceLimits": false, "environmentVariables": [], "extraAppVolumeMounts": [], "global": {"ixChartContext": {"addNvidiaRuntimeClass": false, "hasNFSCSI": true, "hasSMBCSI": true, "isInstall": false, "isUpdate": false, "isUpgrade": true, "kubernetes_config": {"cluster_cidr": "172.16.0.0/16", "cluster_dns_ip": "172.17.0.10", "service_cidr": "172.17.0.0/16"}, "nfsProvisioner": "nfs.csi.k8s.io", "nvidiaRuntimeClassName": "nvidia", "operation": "UPGRADE", "smbProvisioner": "smb.csi.k8s.io", "storageClassName": "ix-storage-class-nextcloud", "upgradeMetadata": {"newChartVersion": "1.6.54", "oldChartVersion": "1.6.52", "preUpgradeRevision": 33}}}, "image": {"pullPolicy": "IfNotPresent", "repository": "nextcloud", "tag": "28.0.0"}, "ixCertificateAuthorities": {}, "ixCertificates": {}, "ixChartContext": {"addNvidiaRuntimeClass": false, "hasNFSCSI": true, "hasSMBCSI": true, "isInstall": false, "isUpdate": false, "isUpgrade": true, "kubernetes_config": {"cluster_cidr": "172.16.0.0/16", "cluster_dns_ip": "172.17.0.10", "service_cidr": "172.17.0.0/16"}, "nfsProvisioner": "nfs.csi.k8s.io", "nvidiaRuntimeClassName": "nvidia", "operation": "UPGRADE", "smbProvisioner": "smb.csi.k8s.io", "storageClassName": "ix-storage-class-nextcloud", "upgradeMetadata": {"newChartVersion": "1.6.54", "oldChartVersion": "1.6.52", "preUpgradeRevision": 33}}, "ixExternalInterfacesConfiguration": [], "ixExternalInterfacesConfigurationNames": [], "ixVolumes": [{"hostPath": "/mnt/PoolSSD256GB/ix-applications/releases/nextcloud/volumes/ix_volumes/ix-nextcloud_data"}, {"hostPath": "/mnt/PoolSSD256GB/ix-applications/releases/nextcloud/volumes/ix_volumes/ix-postgres_data"}, {"hostPath": "/mnt/PoolSSD256GB/ix-applications/releases/nextcloud/volumes/ix_volumes/ix-postgres_backups"}], "nextcloud": {"datadir": "/var/www/html/data", "host": "192.168.1.57", "install_ffmpeg": false, "install_smbclient": false, "max_execution_time": 30, "max_upload_size": 3, "opcache_memory_consumption": 128, "password": "my_password", "php_memory_limit": 512, "username": "admin"}, "nginx": {"image": {"pullPolicy": "IfNotPresent", "repository": "nginx", "tag": "1.23.3"}}, "postgresAppVolumeMounts": {"postgres-backup": {"datasetName": "ix-postgres_backups", "hostPathEnabled": false, "mountPath": "/postgres_backups"}, "postgres-data": {"datasetName": "ix-postgres_data", "hostPathEnabled": false, "mountPath": "/var/lib/postgresql/data"}}, "release_name": "nextcloud", "service": {"nodePort": 9001}, "updateStrategy": "Recreate", "useServiceNameForHost": false}, "hooks": [{"name": "pre-upgrade-hook2", "kind": "Job", "path": "nextcloud/templates/backup-postgres-hook.yaml", "manifest": "apiVersion: batch/v1\nkind: Job\nmetadata:\n name: \"pre-upgrade-hook2\"\n anno Æ ue": "Europe/Vienna"}, {"name": "PUID", "value": "1000"}, {"name": "PGID", "value": "1000"}], "dnsConfig": {"nameservers": [], "options": [], "searches": []}, "dnsPolicy": "Default", "emptyDirVolumes": [], "enableResourceLimits": false, "enableUIPortal": false, "externalInterfaces": [], "global": {"ixChartContext": {"addNvidiaRuntimeClass": false, "hasNFSCSI": true, "hasSMBCSI": true, "isInstall": false, "isStopped": false, "isUpdate": true, "isUpgrade": false, "kubernetes_config": {"cluster_cidr": "172.16.0.0/16", "cluster_dns_ip": "172.17.0.10", "service_cidr": "172.17.0.0/16"}, "nfsProvisioner": "nfs.csi.k8s.io", "nvidiaRuntimeClassName": "nvidia", "operation": "UPDATE", "smbProvisioner": "smb.csi.k8s.io", "storageClassName": "ix-storage-class-radarr", "upgradeMetadata": {}}}, "gpuConfiguration": {"amd.com/gpu": 0, "gpu.intel.com/i915": 0, "nvidia.com/gpu": 0}, "hostNetwork": false, "hostPathVolumes": [{"hostPath": "/mnt/PoolSSD256GB/appdata/radarr", "mountPath": "/config", "readOnly": false}, {"hostPath": "/mnt/tray3/media/downloads/nzb", "mountPath": "/downloads", "readOnly": false}, {"hostPath": "/mnt/tray3/media/2watch/movies", "mountPath": "/movies", "readOnly": false}, {"hostPath": "/mnt/tray3/media/2watch/moviesj", "mountPath": "/moviesj", "readOnly": false}], "image": {"pullPolicy": "Always", "repository": "linuxserver/radarr", "tag": "latest"}, "ixCertificateAuthorities": {}, "ixCertificates": {}, "ixChartContext": {"addNvidiaRuntimeClass": false, "hasNFSCSI": true, "hasSMBCSI": true, "isInstall": false, "isStopped": false, "isUpdate": true, "isUpgrade": false, "kubernetes_config": {"cluster_cidr": "172.16.0.0/16", "cluster_dns_ip": "172.17.0.10", "service_cidr": "172.17.0.0/16"}, "nfsProvisioner": "nfs.csi.k8s.io", "nvidiaRuntimeClassName": "nvidia", "operation": "UPDATE", "smbProvisioner": "smb.csi.k8s.io", "storageClassName": "ix-storage-class-radarr", "upgradeMetadata": {}}, "ixExternalInterfacesConfiguration": [], "ixExternalInterfacesConfigurationNames": [], "ixVolumes": [], "livenessProbe": null, "placeholder": {}, "portForwardingList": [{"containerPort": 7878, "nodePort": 9878, "protocol": "TCP"}], "release_name": "radarr", "securityContext": {"capabilities": [], "enableRunAsUser": false, "privileged": false}, "stdin": false, "tty": false, "updateStrategy": "RollingUpdate", "volumes": [], "workloadType": "Deployment"}, "version": 49, "namespace": "ix-radarr", "chart_metadata": {"name": "ix-chart", "home": "https://www.truenas.com/", "version": "2308.0.1", "description": "A Helm chart for deploying simple workloads Kubernetes", "maintainers": [{"name": "truenas", "email": "dev@ixsystems.com", "url": "https://www.truenas.com/"}], "icon": "https://media.sys.truenas.net/apps/ix-chart/icons/icon.webp", "apiVersion": "v2", "appVersion": "v1", "annotations": {"title": "ix-chart"}, "kubeVersion": ">=1.16.0-0", "dependencies": [{"name": "common", "version": "2304.0.1", "repository": "file://../../../common/2304.0.1", "enabled": true}], "type": "application", "latest_chart_version": "2308.0.1"}, "id": "radarr", "catalog": "TRUENAS", "catalog_train": "charts", "path": "/mnt/PoolSSD256GB/ix-applications/releases/radarr", "dataset": "PoolSSD256GB/ix-applications/releases/radarr", "status": "STOPPED", "used_ports": [], "pod_status": {"desired": 0, "available": 0}, "update_available": false, "human_version": "linuxserver/radarr:latest_2308.0.1", "human_latest_version": "linuxserver/radarr:latest_2308.0.1", "container_images_update_available": true, "portals": {}}633b267f-fe46-43f4-a0b7-05082e54a0c1ChartReleaseUpdate2024-02-15 14:19:02.059048 ue": "Europe/Vienna"}, {"name": "PUID", "value": "1000"}, {"name": "PGID", "value": "1000"}], "dnsConfig": {"nameservers": [], "options": [], "searches": []}, "dnsPolicy": "Default", "emptyDirVolumes": [], "enableResourceLimits": false, "enableUIPortal": false, "externalInterfaces": [], "global": {"ixChartContext": {"addNvidiaRuntimeClass": false, "hasNFSCSI": true, "hasSMBCSI": true, "isInstall": false, "isStopped": false, "isUpdate": true, "isUpgrade": false, "kubernetes_config": {"cluster_cidr": "172.16.0.0/16", "cluster_dns_ip": "172.17.0.10", "service_cidr": "172.17.0.0/16"}, "nfsProvisioner": "nfs.csi.k8s.io", "nvidiaRuntimeClassName": "nvidia", "operation": "UPDATE", "smbProvisioner": "smb.csi.k8s.io", "storageClassName": "ix-storage-class-sonarr", "upgradeMetadata": {}}}, "gpuConfiguration": {"amd.com/gpu": 0, "gpu.intel.com/i915": 0, "nvidia.com/gpu": 0}, "hostNetwork": false, "hostPathVolumes": [{"hostPath": "/mnt/PoolSSD256GB/appdata/sonarr", "mountPath": "/config", "readOnly": false}, {"hostPath": "/mnt/tray3/media/downloads/nzb", "mountPath": "/downloads", "readOnly": false}, {"hostPath": "/mnt/tray3/media/2watch/tv", "mountPath": "/tv", "readOnly": false}, {"hostPath": "/mnt/tray3/media/2watch/tvj", "mountPath": "/tvj", "readOnly": false}], "image": {"pullPolicy": "Always", "repository": "linuxserver/sonarr", "tag": "latest"}, "ixCertificateAuthorities": {}, "ixCertificates": {}, "ixChartContext": {"addNvidiaRuntimeClass": false, "hasNFSCSI": true, "hasSMBCSI": true, "isInstall": false, "isStopped": false, "isUpdate": true, "isUpgrade": false, "kubernetes_config": {"cluster_cidr": "172.16.0.0/16", "cluster_dns_ip": "172.17.0.10", "service_cidr": "172.17.0.0/16"}, "nfsProvisioner": "nfs.csi.k8s.io", "nvidiaRuntimeClassName": "nvidia", "operation": "UPDATE", "smbProvisioner": "smb.csi.k8s.io", "storageClassName": "ix-storage-class-sonarr", "upgradeMetadata": {}}, "ixExternalInterfacesConfiguration": [], "ixExternalInterfacesConfigurationNames": [], "ixVolumes": [], "livenessProbe": null, "placeholder": {}, "portForwardingList": [{"containerPort": 8989, "nodePort": 9989, "protocol": "TCP"}], "release_name": "sonarr", "securityContext": {"capabilities": [], "enableRunAsUser": false, "privileged": false}, "stdin": false, "tty": false, "updateStrategy": "RollingUpdate", "volumes": [], "workloadType": "Deployment"}, "version": 53, "namespace": "ix-sonarr", "chart_metadata": {"name": "ix-chart", "home": "https://www.truenas.com/", "version": "2308.0.1", "description": "A Helm chart for deploying simple workloads Kubernetes", "maintainers": [{"name": "truenas", "email": "dev@ixsystems.com", "url": "https://www.truenas.com/"}], "icon": "https://media.sys.truenas.net/apps/ix-chart/icons/icon.webp", "apiVersion": "v2", "appVersion": "v1", "annotations": {"title": "ix-chart"}, "kubeVersion": ">=1.16.0-0", "dependencies": [{"name": "common", "version": "2304.0.1", "repository": "file://../../../common/2304.0.1", "enabled": true}], "type": "application", "latest_chart_version": "2308.0.1"}, "id": "sonarr", "catalog": "TRUENAS", "catalog_train": "charts", "path": "/mnt/PoolSSD256GB/ix-applications/releases/sonarr", "dataset": "PoolSSD256GB/ix-applications/releases/sonarr", "status": "STOPPED", "used_ports": [], "pod_status": {"desired": 0, "available": 0}, "update_available": false, "human_version": "linuxserver/sonarr:latest_2308.0.1", "human_latest_version": "linuxserver/sonarr:latest_2308.0.1", "container_images_update_available": true, "portals": {}}6428ae15-a8e7-45cd-adf6-f5174121b3eaChartReleaseUpdate2024-02-15 14:19:02.050221 alue": "Europe/Vienna"}, {"name": "PUID", "value": "1000"}, {"name": "PGID", "value": "1000"}], "dnsConfig": {"nameservers": [], "options": [], "searches": []}, "dnsPolicy": "Default", "emptyDirVolumes": [], "enableResourceLimits": false, "enableUIPortal": false, "externalInterfaces": [], "global": {"ixChartContext": {"addNvidiaRuntimeClass": false, "hasNFSCSI": true, "hasSMBCSI": true, "isInstall": false, "isUpdate": false, "isUpgrade": true, "kubernetes_config": {"cluster_cidr": "172.16.0.0/16", "cluster_dns_ip": "172.17.0.10", "service_cidr": "172.17.0.0/16"}, "nfsProvisioner": "nfs.csi.k8s.io", "nvidiaRuntimeClassName": "nvidia", "operation": "UPGRADE", "smbProvisioner": "smb.csi.k8s.io", "storageClassName": "ix-storage-class-readarr", "upgradeMetadata": {"newChartVersion": "2308.0.1", "oldChartVersion": "2304.0.3", "preUpgradeRevision": 53}}}, "gpuConfiguration": {"amd.com/gpu": 0, "gpu.intel.com/i915": 0, "nvidia.com/gpu": 0}, "hostNetwork": false, "hostPathVolumes": [{"hostPath": "/mnt/PoolSSD256GB/appdata/readarr", "mountPath": "/config", "readOnly": false}, {"hostPath": "/mnt/tray3/media/downloads/nzb", "mountPath": "/downloads", "readOnly": false}, {"hostPath": "/mnt/tray3/media/archiv/books", "mountPath": "/books", "readOnly": false}], "image": {"pullPolicy": "Always", "repository": "ghcr.io/linuxserver/readarr", "tag": "nightly"}, "ixCertificateAuthorities": {}, "ixCertificates": {}, "ixChartContext": {"addNvidiaRuntimeClass": false, "hasNFSCSI": true, "hasSMBCSI": true, "isInstall": false, "isUpdate": false, "isUpgrade": true, "kubernetes_config": {"cluster_cidr": "172.16.0.0/16", "cluster_dns_ip": "172.17.0.10", "service_cidr": "172.17.0.0/16"}, "nfsProvisioner": "nfs.csi.k8s.io", "nvidiaRuntimeClassName": "nvidia", "operation": "UPGRADE", "smbProvisioner": "smb.csi.k8s.io", "storageClassName": "ix-storage-class-readarr", "upgradeMetadata": {"newChartVersion": "2308.0.1", "oldChartVersion": "2304.0.3", "preUpgradeRevision": 53}}, "ixExternalInterfacesConfiguration": [], "ixExternalInterfacesConfigurationNames": [], "ixVolumes": [], "livenessProbe": null, "placeholder": {}, "portForwardingList": [{"containerPort": 8787, "nodePort": 9787, "protocol": "TCP"}], "release_name": "readarr", "securityContext": {"capabilities": [], "enableRunAsUser": false, "privileged": false}, "stdin": false, "tty": false, "updateStrategy": "RollingUpdate", "volumes": [], "workloadType": "Deployment"}, "version": 54, "namespace": "ix-readarr", "chart_metadata": {"name": "ix-chart", "home": "https://www.truenas.com/", "version": "2308.0.1", "description": "A Helm chart for deploying simple workloads Kubernetes", "maintainers": [{"name": "truenas", "email": "dev@ixsystems.com", "url": "https://www.truenas.com/"}], "icon": "https://media.sys.truenas.net/apps/ix-chart/icons/icon.webp", "apiVersion": "v2", "appVersion": "v1", "annotations": {"title": "ix-chart"}, "kubeVersion": ">=1.16.0-0", "dependencies": [{"name": "common", "version": "2304.0.1", "repository": "file://../../../common/2304.0.1", "enabled": true}], "type": "application", "latest_chart_version": "2308.0.1"}, "id": "readarr", "catalog": "TRUENAS", "catalog_train": "charts", "path": "/mnt/PoolSSD256GB/ix-applications/releases/readarr", "dataset": "PoolSSD256GB/ix-applications/releases/readarr", "status": "STOPPED", "used_ports": [{"port": 9787, "protocol": "TCP"}], "pod_status": {"desired": 0, "available": 0}, "update_available": false, "human_version": "nightly_2308.0.1", "human_latest_version": "nightly_2308.0.1", "container_images_update_available": true, "portals": {}}cc15eb98-4b20-4643-87ba-1275e177b6f2ChartReleaseUpdate2024-02-15 14:19:02.023501
Note: PoolSSD256GB was also deleted before.

Is this a bug?
How can I make sure that everything is deleted?
thx

 

[HoneyBadger]

Hey @shadowempire

While a config backup does contain sensitive information such as passwords, as described in the warning dialog:

The fact that you deleted your Nextcloud instance first and still found the password there makes me curious if there was potentially an incomplete deletion of this information somewhere.

Please submit a bug using the "Report a Bug" - and if the source system is still running, please use the option to securely and privately upload a debug file from System -> Advanced -> Save Debug. As this file also contains potentially sensitive information, please ensure that it is only uploaded via the "Private attachment" feature in Jira.

 

[shadowempire]

Log in with Atlassian account

Log in to Jira, Confluence, and all other Atlassian Cloud products here. Not an Atlassian user? Sign up for free.

ixsystems.atlassian.net