Mailing-List: contact issues-help@ambari.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@ambari.apache.org
Date: Mon, 27 Mar 2017 12:25:41 +0000 (UTC)
From: "Attila Magyar (JIRA)" <jira@apache.org>
To: issues@ambari.apache.org
Message-ID: <JIRA.13059383.1490616408000.130749.1490617541524@Atlassian.JIRA>
In-Reply-To: <JIRA.13059383.1490616408000@Atlassian.JIRA>
References: <JIRA.13059383.1490616408000@Atlassian.JIRA> <JIRA.13059383.1490616408388@jira-lw-us.apache.org>
Subject: [jira] [Updated] (AMBARI-20583) Allow for larger Ephemeral DH Keys
 in Ambari server running on JVM versions 1.8 and above
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Mon, 27 Mar 2017 12:25:49 -0000


     [ https://issues.apache.org/jira/browse/AMBARI-20583?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Attila Magyar updated AMBARI-20583:
-----------------------------------
    Attachment: AMBARI-20583.patch

> Allow for larger Ephemeral DH Keys in Ambari server running on JVM versions 1.8 and above	
> ------------------------------------------------------------------------------------------
>
>                 Key: AMBARI-20583
>                 URL: https://issues.apache.org/jira/browse/AMBARI-20583
>             Project: Ambari
>          Issue Type: Task
>          Components: ambari-server
>            Reporter: Attila Magyar
>            Assignee: Attila Magyar
>         Attachments: AMBARI-20583.patch
>
>
> Allow for larger Ephemeral DH Keys in Ambari server running on JVM versions 1.8 and above.
> This can already be done by manually editing the ambari-env.sh file (/var/lib/ambari-server/ambari-env.sh) and adding the following to the AMBARI_JVM_ARGS environment variable:
> -Djdk.tls.ephemeralDHKeySize=2048
> The jdk.tls.ephemeralDHKeySize property is only available in Java VM versions 1.8 and above. However it may not be supported in by all Java vendors. Both Oracle and OpenJDK JVM appear to support it.
> See https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/JSSERefGuide.html#customizing_dh_keys for more information.
> To help users set this value, Ambari should provide a property in the ambari.properties file. If a supported JVM is in use, Ambari should internally set the System property (before creating the embedded web server) as specified by the user. A possible Ambari property name could be security.server.tls.ephemeral_dh_key_size. If not set, it's default value should be 2048.
> To test the Ephemeral DH key size, the OpenSSL s_client utility may be used to query the Ambari server's HTTPS port(s):
> openssl s_client -connect `hostname -f`:8441 -cipher "EDH"


--
This message was sent by Atlassian JIRA
(v6.3.15#6346)