You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@ranger.apache.org by "Chinmay N Hegde (Jira)" <ji...@apache.org> on 2026/08/31 12:30:00 UTC

[jira] [Commented] (RANGER-5776) Prevent DB2HSM migration tool from overwriting existing keys in HSM

    [ https://issues.apache.org/jira/browse/RANGER-5776?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18109872#comment-18109872 ] 

Chinmay N Hegde commented on RANGER-5776:
-----------------------------------------

Merged into apache master : [https://github.com/apache/ranger/commit/ba5d6f0a2dbe9a7e1b5d82d2bc5203975ddd56fd]

 

> Prevent DB2HSM migration tool from overwriting existing keys in HSM
> -------------------------------------------------------------------
>
>                 Key: RANGER-5776
>                 URL: https://issues.apache.org/jira/browse/RANGER-5776
>             Project: Ranger
>          Issue Type: Bug
>          Components: Ranger
>    Affects Versions: 3.0.0
>            Reporter: Chinmay N Hegde
>            Assignee: Chinmay N Hegde
>            Priority: Major
>             Fix For: 3.0.0
>
>          Time Spent: 20m
>  Remaining Estimate: 0h
>
> Currently, when the master key is migrated from the KMS DB to Luna HSM using the migration tool ({*}DB2HSMMKUtil{*}), it silently overwrites any existing key present in the HSM. This overwrite should never happen, as it could lead to loss of data if the HSM already holds the active master key.
> The fix must be added to check the presence of alias in HSM before writing to the HSM. If the alias is already present, the write is skipped and a warning is logged. 
> This brings the behaviour in sync with how *HSM2DBMKUtil* works.
> (Note: This also needs to be fixed on *RangerSafenetKeySecure* side)



--
This message was sent by Atlassian Jira
(v8.20.10#820010)