hi, maybe this is addressed in a later version (I am still on the lenny fai version, the upgrade is planned).
The standard fai log permissions are too generous: 644 for all the log files in /var/log/fai/localhost/install-date. If you use debconf to set passwords, then those passwords are readable to anyone with shell access. Is this issue still in the most recent fai? -- Groeten, natxo