[jira] [Commented] (OOZIE-2244) Oozie should mask passwords in the logs when logging command arguments

["Hadoop QA (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/OOZIE-2244?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15057509#comment-15057509 ] 

Hadoop QA commented on OOZIE-2244:
----------------------------------

Testing JIRA OOZIE-2244

Cleaning local git workspace

----------------------------

{color:green}+1 PATCH_APPLIES{color}
{color:green}+1 CLEAN{color}
{color:red}-1 RAW_PATCH_ANALYSIS{color}
.    {color:green}+1{color} the patch does not introduce any @author tags
.    {color:green}+1{color} the patch does not introduce any tabs
.    {color:green}+1{color} the patch does not introduce any trailing spaces
.    {color:green}+1{color} the patch does not introduce any line longer than 132
.    {color:red}-1{color} the patch does not add/modify any testcase
{color:green}+1 RAT{color}
.    {color:green}+1{color} the patch does not seem to introduce new RAT warnings
{color:green}+1 JAVADOC{color}
.    {color:green}+1{color} the patch does not seem to introduce new Javadoc warnings
{color:green}+1 COMPILE{color}
.    {color:green}+1{color} HEAD compiles
.    {color:green}+1{color} patch compiles
.    {color:green}+1{color} the patch does not seem to introduce new javac warnings
{color:green}+1 BACKWARDS_COMPATIBILITY{color}
.    {color:green}+1{color} the patch does not change any JPA Entity/Colum/Basic/Lob/Transient annotations
.    {color:green}+1{color} the patch does not modify JPA files
{color:red}-1 TESTS{color}
.    Tests run: 1702
.    Tests failed: 7
.    Tests errors: 2

.    The patch failed the following testcases:

.      testSamplers(org.apache.oozie.util.TestMetricsInstrumentation)
.      testForNoDuplicates(org.apache.oozie.event.TestEventGeneration)
.      testMain(org.apache.oozie.action.hadoop.TestHiveMain)
.      testPigScript(org.apache.oozie.action.hadoop.TestPigMainWithOldAPI)
.      testPigScript(org.apache.oozie.action.hadoop.TestPigMain)
.      testEmbeddedPigWithinPython(org.apache.oozie.action.hadoop.TestPigMain)
.      testPig_withNullExternalID(org.apache.oozie.action.hadoop.TestPigMain)

{color:green}+1 DISTRO{color}
.    {color:green}+1{color} distro tarball builds with the patch 

----------------------------
{color:red}*-1 Overall result, please check the reported -1(s)*{color}


The full output of the test-patch run is available at

.   https://builds.apache.org/job/oozie-trunk-precommit-build/2643/

> Oozie should mask passwords in the logs when logging command arguments
> ----------------------------------------------------------------------
>
>                 Key: OOZIE-2244
>                 URL: https://issues.apache.org/jira/browse/OOZIE-2244
>             Project: Oozie
>          Issue Type: Bug
>    Affects Versions: 4.1.0, 4.0.1
>         Environment: All
>            Reporter: Venkat Ranganathan
>            Assignee: Venkat Ranganathan
>            Priority: Critical
>             Fix For: trunk
>
>         Attachments: OOZIE-2244-no-prefix.patch
>
>
> Users have complained that oozie logging the password related argument values in the launcher log is a security hole and want it to be masked in the output.   Even password aliases in keystore are considered to be a security hole.
> The fix is to mask any argument values if option name contains the string password (which is true for Sqoop).   We do this in multiple places, in Sqoop main, in Launcher Mapper, in JavaMain as well.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)