ambari-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Andrew Onischuk (JIRA)" <>
Subject [jira] [Created] (AMBARI-16810) Ambari Agent security bypassed in Python=>2.7.9
Date Mon, 23 May 2016 06:46:12 GMT
Andrew Onischuk created AMBARI-16810:

             Summary: Ambari Agent security bypassed in Python=>2.7.9
                 Key: AMBARI-16810
             Project: Ambari
          Issue Type: Bug
            Reporter: Andrew Onischuk
            Assignee: Andrew Onischuk
             Fix For: 2.4.0

We hard-coded the Ambari Agents to ignore certification
verification. But the reason why this was required was Python be un-secure by

That method will cause signed certificates to not serve any purpose & is
discouraged by RedHat & Python security experts:

> "It is also possible, though highly discouraged , to globally disable
verification by monkeypatching the ssl module in versions of Python"

Instead we should abstract it to a setting (e.g. ssl_verify_cert) in the
ambari-agent.ini such that users can turn certification verification if they
provide a signed/trusted certificate.

This message was sent by Atlassian JIRA

View raw message