geode-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Tushar Khairnar (JIRA)" <>
Subject [jira] [Commented] (GEODE-17) Provide Integrated Security
Date Wed, 05 Aug 2015 11:50:04 GMT


Tushar Khairnar commented on GEODE-17:

I think you can always use encrypt('') syntax when specifying passwords. Gemfire/Geode resolves
this at very low level ie. SocketCreator just before forming SSLSocket.

Can you file new JIRA Issue for adding new algorithms for PasswordUtil? This will potentially
involve another gemfire property or system property to switch to alternate implementation.
We can even make this as callback to some other user-written java function. 

Also following is the comment from Jacob Barrett on the same issue : 

The problem is that this solution is actually no more secure than plain
 text in the command line. The PasswordUtil uses a static key to encrypt
 all the values. That key is in the open source. Anyone (everyone) with the
 key can simply decrypt the text on the command line.

 The securest solution is to either have gemfire prompt for the the
 password at startup or read from a properly secured file. The easiest is a
 properly secured passphraseless keystore file. On linux you can protect it
 with proper user permissions and SELinux to restrict reads to a specific
 process context

> Provide Integrated Security
> ---------------------------
>                 Key: GEODE-17
>                 URL:
>             Project: Geode
>          Issue Type: New Feature
>          Components: client/server, core, management & tools
>            Reporter: Tushar Khairnar
>            Assignee: Tushar Khairnar
>              Labels: security
> Integrated Security: Purpose of integrated security feature is to provide uniform authentication
and authorization capabilities for all Geode clients. Geode distributed systems has different
clients, some perform cache/region operations, some perform management operations. In order
to authenticate and authorize these actions we need single consistent framework or interface.
Such interface should allow configuration of access levels from single place and/or repository.

> The key requirements being met here are
>  - Authentication of all clients from single plugin
>  - Authorization of cache/data operations (through cache-client and REST) and managements
(GFSH/JMX) operations from single plugin
>  - Extend existing Client-Server security framework

This message was sent by Atlassian JIRA

View raw message