[
https://issues.apache.org/jira/browse/HADOOP-11300?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14212601#comment-14212601
]
Arun Suresh commented on HADOOP-11300:
--------------------------------------
[~atm], thanks for the review..
I tested the patch as follows :
* I did a {{mvn package -Pdist}}
* I ran the {{kms.sh}} script with {{KMS_SSL_KEYSTORE_PASS}} env variable set
and {{-Djavax.net.ssl.trustStorePassword=}} key value appended to the
{{CATALINA_OPTS}} env variable.
* I verified that the kms server started up with the new {{ssl-server.xml}}
populated with the correct passwords and no passwords were that the passwords
were masked out in the sysout and {{ps}} displays.
> KMS startup scripts must not display the keystore / truststore passwords
> ------------------------------------------------------------------------
>
> Key: HADOOP-11300
> URL: https://issues.apache.org/jira/browse/HADOOP-11300
> Project: Hadoop Common
> Issue Type: Bug
> Components: kms
> Affects Versions: 2.6.0
> Reporter: Arun Suresh
> Assignee: Arun Suresh
> Attachments: HADOOP-11300.1.patch, HADOOP-11300.2.patch
>
>
> Sample output of the KMS startup scripts :
> {noformat}
> Setting KMS_HOME: /usr/lib/hadoop-kms
> Using KMS_CONFIG: /var/run/kms-config/
> Using KMS_LOG: /var/log/kms-log
> Using KMS_TEMP: /var/run/kms-tmp/
> Using KMS_HTTP_PORT: 16000
> Using KMS_ADMIN_PORT: 16001
> Using KMS_MAX_THREADS: 250
> Using KMS_SSL_KEYSTORE_FILE: /etc/conf/kms-keystore.jks
> Using KMS_SSL_KEYSTORE_PASS: keystorepass
> Using CATALINA_BASE: /var/lib/kms/tomcat-deployment
> Using KMS_CATALINA_HOME: /usr/lib/hadoop-kms/lib/bigtop-tomcat
> Setting CATALINA_OUT: /var/log/kms-log/kms-catalina.out
> Setting CATALINA_PID: /tmp/kms.pid
> Using CATALINA_OPTS: .....
> -Djavax.net.ssl.trustStorePassword=truststorepass ....
> Adding to CATALINA_OPTS: -Dkms.home.dir=...... -Dkms.ssl.keystore.pass=
> keystorepass ....
> {noformat}
> The keystore password and truststore password are in clear text.. which
> should be masked
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
