Return-Path: X-Original-To: apmail-hadoop-common-commits-archive@www.apache.org Delivered-To: apmail-hadoop-common-commits-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id E1A371067B for ; Wed, 3 Dec 2014 05:23:35 +0000 (UTC) Received: (qmail 26238 invoked by uid 500); 3 Dec 2014 05:23:34 -0000 Delivered-To: apmail-hadoop-common-commits-archive@hadoop.apache.org Received: (qmail 26064 invoked by uid 500); 3 Dec 2014 05:23:34 -0000 Mailing-List: contact common-commits-help@hadoop.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: common-dev@hadoop.apache.org Delivered-To: mailing list common-commits@hadoop.apache.org Received: (qmail 25723 invoked by uid 99); 3 Dec 2014 05:23:33 -0000 Received: from tyr.zones.apache.org (HELO tyr.zones.apache.org) (140.211.11.114) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 03 Dec 2014 05:23:33 +0000 Received: by tyr.zones.apache.org (Postfix, from userid 65534) id 91B3CA07776; Wed, 3 Dec 2014 05:23:33 +0000 (UTC) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: vinayakumarb@apache.org To: common-commits@hadoop.apache.org Date: Wed, 03 Dec 2014 05:23:37 -0000 Message-Id: In-Reply-To: <1d780480d3a947b5bd82f2b6d1bd67f3@git.apache.org> References: <1d780480d3a947b5bd82f2b6d1bd67f3@git.apache.org> X-Mailer: ASF-Git Admin Mailer Subject: [05/50] [abbrv] hadoop git commit: HADOOP-11300. KMS startup scripts must not display the keystore / truststore passwords. Contributed by Arun Suresh. HADOOP-11300. KMS startup scripts must not display the keystore / truststore passwords. Contributed by Arun Suresh. Project: http://git-wip-us.apache.org/repos/asf/hadoop/repo Commit: http://git-wip-us.apache.org/repos/asf/hadoop/commit/56f3eecc Tree: http://git-wip-us.apache.org/repos/asf/hadoop/tree/56f3eecc Diff: http://git-wip-us.apache.org/repos/asf/hadoop/diff/56f3eecc Branch: refs/heads/HDFS-EC Commit: 56f3eecc129486d3297d082d9b97f26b40d0a2c6 Parents: 78f7cdb Author: Andrew Wang Authored: Tue Nov 25 15:12:04 2014 -0800 Committer: Andrew Wang Committed: Tue Nov 25 15:12:04 2014 -0800 ---------------------------------------------------------------------- hadoop-common-project/hadoop-common/CHANGES.txt | 3 + hadoop-common-project/hadoop-kms/pom.xml | 4 +- .../hadoop-kms/src/main/libexec/kms-config.sh | 5 +- .../hadoop-kms/src/main/sbin/kms.sh | 17 ++- .../hadoop-kms/src/main/tomcat/ssl-server.xml | 135 ------------------ .../src/main/tomcat/ssl-server.xml.conf | 136 +++++++++++++++++++ 6 files changed, 158 insertions(+), 142 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/hadoop/blob/56f3eecc/hadoop-common-project/hadoop-common/CHANGES.txt ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-common/CHANGES.txt b/hadoop-common-project/hadoop-common/CHANGES.txt index 5540e51..1419f25 100644 --- a/hadoop-common-project/hadoop-common/CHANGES.txt +++ b/hadoop-common-project/hadoop-common/CHANGES.txt @@ -465,6 +465,9 @@ Release 2.7.0 - UNRELEASED HADOOP-11322. key based ACL check in KMS always check KeyOpType.MANAGEMENT even actual KeyOpType is not MANAGEMENT. (Dian Fu via yliu) + HADOOP-11300. KMS startup scripts must not display the keystore / + truststore passwords. (Arun Suresh via wang) + Release 2.6.0 - 2014-11-18 INCOMPATIBLE CHANGES http://git-wip-us.apache.org/repos/asf/hadoop/blob/56f3eecc/hadoop-common-project/hadoop-kms/pom.xml ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-kms/pom.xml b/hadoop-common-project/hadoop-kms/pom.xml index fda25aa..c33b33e 100644 --- a/hadoop-common-project/hadoop-kms/pom.xml +++ b/hadoop-common-project/hadoop-kms/pom.xml @@ -397,8 +397,8 @@ - - + http://git-wip-us.apache.org/repos/asf/hadoop/blob/56f3eecc/hadoop-common-project/hadoop-kms/src/main/libexec/kms-config.sh ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-kms/src/main/libexec/kms-config.sh b/hadoop-common-project/hadoop-kms/src/main/libexec/kms-config.sh index dc603d4..d36ab4d 100644 --- a/hadoop-common-project/hadoop-kms/src/main/libexec/kms-config.sh +++ b/hadoop-common-project/hadoop-kms/src/main/libexec/kms-config.sh @@ -152,9 +152,10 @@ fi if [ "${KMS_SSL_KEYSTORE_PASS}" = "" ]; then export KMS_SSL_KEYSTORE_PASS=password - print "Setting KMS_SSL_KEYSTORE_PASS: ${KMS_SSL_KEYSTORE_PASS}" + print "Setting KMS_SSL_KEYSTORE_PASS: ********" else - print "Using KMS_SSL_KEYSTORE_PASS: ${KMS_SSL_KEYSTORE_PASS}" + KMS_SSL_KEYSTORE_PASS_DISP=`echo ${KMS_SSL_KEYSTORE_PASS} | sed 's/./*/g'` + print "Using KMS_SSL_KEYSTORE_PASS: ${KMS_SSL_KEYSTORE_PASS_DISP}" fi if [ "${CATALINA_BASE}" = "" ]; then http://git-wip-us.apache.org/repos/asf/hadoop/blob/56f3eecc/hadoop-common-project/hadoop-kms/src/main/sbin/kms.sh ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-kms/src/main/sbin/kms.sh b/hadoop-common-project/hadoop-kms/src/main/sbin/kms.sh index b43225f..1e40e10 100644 --- a/hadoop-common-project/hadoop-kms/src/main/sbin/kms.sh +++ b/hadoop-common-project/hadoop-kms/src/main/sbin/kms.sh @@ -36,7 +36,11 @@ source ${HADOOP_LIBEXEC_DIR:-${BASEDIR}/libexec}/kms-config.sh # The Java System property 'kms.http.port' it is not used by Kms, # it is used in Tomcat's server.xml configuration file # -print "Using CATALINA_OPTS: ${CATALINA_OPTS}" + +# Mask the trustStorePassword +KMS_SSL_TRUSTSTORE_PASS=`echo $CATALINA_OPTS | grep -o 'trustStorePassword=[^ ]*' | awk -F'=' '{print $2}'` +CATALINA_OPTS_DISP=`echo ${CATALINA_OPTS} | sed -e 's/trustStorePassword=[^ ]*/trustStorePassword=***/'` +print "Using CATALINA_OPTS: ${CATALINA_OPTS_DISP}" catalina_opts="-Dkms.home.dir=${KMS_HOME}"; catalina_opts="${catalina_opts} -Dkms.config.dir=${KMS_CONFIG}"; @@ -46,11 +50,11 @@ catalina_opts="${catalina_opts} -Dkms.admin.port=${KMS_ADMIN_PORT}"; catalina_opts="${catalina_opts} -Dkms.http.port=${KMS_HTTP_PORT}"; catalina_opts="${catalina_opts} -Dkms.max.threads=${KMS_MAX_THREADS}"; catalina_opts="${catalina_opts} -Dkms.ssl.keystore.file=${KMS_SSL_KEYSTORE_FILE}"; -catalina_opts="${catalina_opts} -Dkms.ssl.keystore.pass=${KMS_SSL_KEYSTORE_PASS}"; print "Adding to CATALINA_OPTS: ${catalina_opts}" +print "Found KMS_SSL_KEYSTORE_PASS: `echo ${KMS_SSL_KEYSTORE_PASS} | sed 's/./*/g'`" -export CATALINA_OPTS="${CATALINA_OPTS} ${catalina_opts}" +export CATALINA_OPTS="${CATALINA_OPTS_DISP} ${catalina_opts}" # A bug in catalina.sh script does not use CATALINA_OPTS for stopping the server # @@ -58,4 +62,11 @@ if [ "${1}" = "stop" ]; then export JAVA_OPTS=${CATALINA_OPTS} fi +# If ssl, the populate the passwords into ssl-server.xml before starting tomcat +if [ ! "${KMS_SSL_KEYSTORE_PASS}" = "" ] || [ ! "${KMS_SSL_TRUSTSTORE_PASS}" = "" ]; then + cat ${CATALINA_BASE}/conf/ssl-server.xml.conf \ + | sed 's/_kms_ssl_keystore_pass_/'${KMS_SSL_KEYSTORE_PASS}'/g' \ + | sed 's/_kms_ssl_truststore_pass_/'${KMS_SSL_TRUSTSTORE_PASS}'/g' > ${CATALINA_BASE}/conf/ssl-server.xml +fi + exec ${KMS_CATALINA_HOME}/bin/catalina.sh "$@" http://git-wip-us.apache.org/repos/asf/hadoop/blob/56f3eecc/hadoop-common-project/hadoop-kms/src/main/tomcat/ssl-server.xml ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-kms/src/main/tomcat/ssl-server.xml b/hadoop-common-project/hadoop-kms/src/main/tomcat/ssl-server.xml deleted file mode 100644 index 5215ded..0000000 --- a/hadoop-common-project/hadoop-kms/src/main/tomcat/ssl-server.xml +++ /dev/null @@ -1,135 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://git-wip-us.apache.org/repos/asf/hadoop/blob/56f3eecc/hadoop-common-project/hadoop-kms/src/main/tomcat/ssl-server.xml.conf ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-kms/src/main/tomcat/ssl-server.xml.conf b/hadoop-common-project/hadoop-kms/src/main/tomcat/ssl-server.xml.conf new file mode 100644 index 0000000..b60da47 --- /dev/null +++ b/hadoop-common-project/hadoop-kms/src/main/tomcat/ssl-server.xml.conf @@ -0,0 +1,136 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +