hadoop-common-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Arun Suresh (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (HADOOP-11300) KMS startup scripts must not display the keystore / truststore passwords
Date Fri, 14 Nov 2014 18:38:34 GMT

    [ https://issues.apache.org/jira/browse/HADOOP-11300?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14212601#comment-14212601
] 

Arun Suresh commented on HADOOP-11300:
--------------------------------------

[~atm], thanks for the review..

I tested the patch as follows :
* I did a {{mvn package -Pdist}}
* I ran the {{kms.sh}} script with {{KMS_SSL_KEYSTORE_PASS}} env variable set and {{-Djavax.net.ssl.trustStorePassword=}}
key value appended to the {{CATALINA_OPTS}} env variable.
* I verified that the kms server started up with the new {{ssl-server.xml}} populated with
the correct passwords and no passwords were that the passwords were masked out in the sysout
and {{ps}} displays.

> KMS startup scripts must not display the keystore / truststore passwords
> ------------------------------------------------------------------------
>
>                 Key: HADOOP-11300
>                 URL: https://issues.apache.org/jira/browse/HADOOP-11300
>             Project: Hadoop Common
>          Issue Type: Bug
>          Components: kms
>    Affects Versions: 2.6.0
>            Reporter: Arun Suresh
>            Assignee: Arun Suresh
>         Attachments: HADOOP-11300.1.patch, HADOOP-11300.2.patch
>
>
> Sample output of the KMS startup scripts :
> {noformat}
> Setting KMS_HOME:          /usr/lib/hadoop-kms
> Using   KMS_CONFIG:        /var/run/kms-config/
> Using   KMS_LOG:           /var/log/kms-log
> Using   KMS_TEMP:           /var/run/kms-tmp/
> Using   KMS_HTTP_PORT:     16000
> Using   KMS_ADMIN_PORT:     16001
> Using   KMS_MAX_THREADS:     250
> Using   KMS_SSL_KEYSTORE_FILE:     /etc/conf/kms-keystore.jks
> Using   KMS_SSL_KEYSTORE_PASS:     keystorepass
> Using   CATALINA_BASE:       /var/lib/kms/tomcat-deployment
> Using   KMS_CATALINA_HOME:       /usr/lib/hadoop-kms/lib/bigtop-tomcat
> Setting CATALINA_OUT:        /var/log/kms-log/kms-catalina.out
> Setting CATALINA_PID:        /tmp/kms.pid
> Using   CATALINA_OPTS:       ..... -Djavax.net.ssl.trustStorePassword=truststorepass
....
> Adding to CATALINA_OPTS:     -Dkms.home.dir=......  -Dkms.ssl.keystore.pass= keystorepass
....
> {noformat}
> The keystore password and truststore password are in clear text.. which should be masked



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message