Dan Burkert has submitted this change and it was merged. Change subject: KUDU-1955 refuse to use world-readable keytabs ......................................................................
KUDU-1955 refuse to use world-readable keytabs Allowing users to supply keytab files and TLS private keys with world-readable permissions lessens a cluster's security. During Kerberos/TLS initialization, servers now check the permissions of these files and exit with bad statuses if they have world-readable permissions. Additionally, if users wish to override this safeguard, they may set the flag '--allow_world_readable_credentials' to true. However, this flag is tagged as unsafe. Change-Id: Ic2ee84e71023304f0743ba0ad37ebb1eef24abc6 Reviewed-on: http://gerrit.cloudera.org:8080/7249 Tested-by: Kudu Jenkins Reviewed-by: Dan Burkert <[email protected]> --- M src/kudu/integration-tests/security-itest.cc M src/kudu/rpc/messenger.cc M src/kudu/security/init.cc M src/kudu/util/env.h M src/kudu/util/env_posix.cc 5 files changed, 128 insertions(+), 5 deletions(-) Approvals: Dan Burkert: Looks good to me, approved Kudu Jenkins: Verified -- To view, visit http://gerrit.cloudera.org:8080/7249 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-MessageType: merged Gerrit-Change-Id: Ic2ee84e71023304f0743ba0ad37ebb1eef24abc6 Gerrit-PatchSet: 9 Gerrit-Project: kudu Gerrit-Branch: master Gerrit-Owner: Sam Okrent <[email protected]> Gerrit-Reviewer: Adar Dembo <[email protected]> Gerrit-Reviewer: Alexey Serbin <[email protected]> Gerrit-Reviewer: Dan Burkert <[email protected]> Gerrit-Reviewer: Kudu Jenkins Gerrit-Reviewer: Sam Okrent <[email protected]> Gerrit-Reviewer: Tidy Bot
