drill-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Volodymyr Tkach (JIRA)" <j...@apache.org>
Subject [jira] [Created] (DRILL-6257) Sqlline start command with password appears in the sqlline.log
Date Fri, 16 Mar 2018 06:35:00 GMT
Volodymyr Tkach created DRILL-6257:

             Summary: Sqlline start command with password appears in the sqlline.log
                 Key: DRILL-6257
                 URL: https://issues.apache.org/jira/browse/DRILL-6257
             Project: Apache Drill
          Issue Type: Bug
            Reporter: Volodymyr Tkach
            Assignee: Volodymyr Tkach

 *1.* Log level is set to "all" in the conf/logback.xml:
<logger name="org.apache.drill" additivity="false">
    <level value="all" />
    <appender-ref ref="FILE" />
*2.* PLAIN authentication mechanism is configured:
  security.user.auth: {
	enabled: true,
	packages += "org.apache.drill.exec.rpc.user.security",
	impl: "pam",
	pam_profiles: [ "sudo", "login" ]
 *1.* Start the drillbits
 *2.* Connect by sqlline:
/opt/mapr/drill/drill-1.13.0/bin/sqlline -u "jdbc:drill:zk=node1:5181;" -n user1 -p 1234
*3.* Use check the sqlline logs:
tail -F log/sqlline.log|grep 1234 -a5 -b5
*Expected result:* Logs shouldn't contain clear-text passwords

*Actual result:* The logs contain the sqlline start command with password:
# system properties
35333-        "java" : {
35352-            # system properties
35384:            "command" : "sqlline.SqlLine -d org.apache.drill.jdbc.Driver --maxWidth=10000
--color=true -u jdbc:drill:zk=node1:5181; -n user1 -p 1234",
35535-            # system properties
35567-            "launcher" : "SUN_STANDARD"
35607-        }

This message was sent by Atlassian JIRA

View raw message