From commits-return-206059-archive-asf-public=cust-asf.ponee.io@cassandra.apache.org Wed Feb 7 13:32:05 2018 Return-Path: X-Original-To: archive-asf-public@eu.ponee.io Delivered-To: archive-asf-public@eu.ponee.io Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183]) by mx-eu-01.ponee.io (Postfix) with ESMTP id 79DAA180676 for ; Wed, 7 Feb 2018 13:32:05 +0100 (CET) Received: by cust-asf.ponee.io (Postfix) id 6992C160C3C; Wed, 7 Feb 2018 12:32:05 +0000 (UTC) Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by cust-asf.ponee.io (Postfix) with SMTP id AE321160C5B for ; Wed, 7 Feb 2018 13:32:04 +0100 (CET) Received: (qmail 76506 invoked by uid 500); 7 Feb 2018 12:32:03 -0000 Mailing-List: contact commits-help@cassandra.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@cassandra.apache.org Delivered-To: mailing list commits@cassandra.apache.org Received: (qmail 76473 invoked by uid 99); 7 Feb 2018 12:32:03 -0000 Received: from pnap-us-west-generic-nat.apache.org (HELO spamd4-us-west.apache.org) (209.188.14.142) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 07 Feb 2018 12:32:03 +0000 Received: from localhost (localhost [127.0.0.1]) by spamd4-us-west.apache.org (ASF Mail Server at spamd4-us-west.apache.org) with ESMTP id 383A5C0160 for ; Wed, 7 Feb 2018 12:32:03 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at spamd4-us-west.apache.org X-Spam-Flag: NO X-Spam-Score: -110.311 X-Spam-Level: X-Spam-Status: No, score=-110.311 tagged_above=-999 required=6.31 tests=[ENV_AND_HDR_SPF_MATCH=-0.5, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, USER_IN_DEF_SPF_WL=-7.5, USER_IN_WHITELIST=-100] autolearn=disabled Received: from mx1-lw-us.apache.org ([10.40.0.8]) by localhost (spamd4-us-west.apache.org [10.40.0.11]) (amavisd-new, port 10024) with ESMTP id nhhYFZwZOa-n for ; Wed, 7 Feb 2018 12:32:01 +0000 (UTC) Received: from mailrelay1-us-west.apache.org (mailrelay1-us-west.apache.org [209.188.14.139]) by mx1-lw-us.apache.org (ASF Mail Server at mx1-lw-us.apache.org) with ESMTP id EAFEE5F230 for ; Wed, 7 Feb 2018 12:32:00 +0000 (UTC) Received: from jira-lw-us.apache.org (unknown [207.244.88.139]) by mailrelay1-us-west.apache.org (ASF Mail Server at mailrelay1-us-west.apache.org) with ESMTP id 785AAE0230 for ; Wed, 7 Feb 2018 12:32:00 +0000 (UTC) Received: from jira-lw-us.apache.org (localhost [127.0.0.1]) by jira-lw-us.apache.org (ASF Mail Server at jira-lw-us.apache.org) with ESMTP id 2132F21E84 for ; Wed, 7 Feb 2018 12:32:00 +0000 (UTC) Date: Wed, 7 Feb 2018 12:32:00 +0000 (UTC) From: "Jason Brown (JIRA)" To: commits@cassandra.apache.org Message-ID: In-Reply-To: References: Subject: [jira] [Commented] (CASSANDRA-13314) Config file based SSL settings MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394 [ https://issues.apache.org/jira/browse/CASSANDRA-13314?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16355382#comment-16355382 ] Jason Brown commented on CASSANDRA-13314: ----------------------------------------- [~ronblechman] please open a new Jira for cert validation/revocation stuffs. It's a topic with discussing, and [~djoshi3] and I may have some ideas on that topic, as well. > Config file based SSL settings > ------------------------------ > > Key: CASSANDRA-13314 > URL: https://issues.apache.org/jira/browse/CASSANDRA-13314 > Project: Cassandra > Issue Type: Improvement > Components: Configuration, Tools > Reporter: Stefan Podkowinski > Assignee: Stefan Podkowinski > Priority: Minor > Fix For: 4.x > > > As follow up of CASSANDRA-13259, I'd like to continue discussing how we can make SSL less awkward to use and further move SSL related code out of our code base. Currently we construct our own SSLContext in SSLFactory based on EncryptionOptions passed by the MessagingService or any individual tool where we need to offer SSL support. This leads to a situation where the user has not only to learn how to enable the correct settings in cassandra.yaml, but these settings must also be reflected in each tool's own command line options. As argued in CASSANDRA-13259, these settings could be done as well by setting the appropriate system and security properties ([overview|http://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/JSSERefGuide.html#InstallationAndCustomization]) and we should just point the user to the right files to do that (jvm.options and java.security) and make sure that daemon and all affected tools will source them. > Since giving this a quick try on my WIP branch, I've noticed the following issues in doing so: > * Keystore passwords will show up in process list (-Djavax.net.ssl.keyStorePassword=..). We should keep the password setting in cassandra.yaml and clis and do a System.setProperty() if they have been provided. > * It's only possible to configure settings for a single default key-/truststore. Since we currently allow configuring both ServerEncryptionOptions and ClientEncryptionOptions with different settings, we'd have to make this a breaking change. I don't really see why you would want to use different stores for node-to-node and node-to-client, but that wouldn't be possible anymore. > * This would probably only make sense if we really remove the affected CLI options, or we'll end up with just another way to configure this stuff. This will break existing scripts and obsolete existing documentation. > Any opinions? -- This message was sent by Atlassian JIRA (v7.6.3#76005) --------------------------------------------------------------------- To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org For additional commands, e-mail: commits-help@cassandra.apache.org