You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@lucene.apache.org by "Mano Kovacs (JIRA)" <ji...@apache.org> on 2017/03/08 10:41:38 UTC
[jira] [Comment Edited] (SOLR-10076) Hiding keystore and truststore
passwords from /admin/info/* outputs
[ https://issues.apache.org/jira/browse/SOLR-10076?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15901050#comment-15901050 ]
Mano Kovacs edited comment on SOLR-10076 at 3/8/17 10:41 AM:
-------------------------------------------------------------
Thank you [~markrmiller@gmail.com] for your comment.
bq. We probably want to push users towards configuring this in a way it's not on the command line though, right?
I agree that this is more like a workaround in the current state. It could also work as a second layer of protection if passwords being passed in command line. I would assume that getting the list of running processes on a server would require higher privileges than accessing the admin-ui, which suggests that the passwords should not be exposed there.
Also, the {{/admin/info/properties}} API would expose password were set differently.
bq. I know our start scripts recently still set some of this ssl stuff via the command line, but if that is still the case, we should fix that too.
Is there a jira for that? I would be happy looking into it.
was (Author: manokovacs):
Thank you [~markrmiller@gmail.com] for your comment.
bq. We probably want to push users towards configuring this in a way it's not on the command line though, right?
I agree that this is more like a workaround in the current state. It could also work as a second layer of protection if passwords being passed in command line. I would assume that getting the list of running processes on a server would require higher privileges than accessing the admin-ui, which suggests that the passwords should not be exposed there.
bq. I know our start scripts recently still set some of this ssl stuff via the command line, but if that is still the case, we should fix that too.
Is there a jira for that? I would be happy looking into it.
> Hiding keystore and truststore passwords from /admin/info/* outputs
> -------------------------------------------------------------------
>
> Key: SOLR-10076
> URL: https://issues.apache.org/jira/browse/SOLR-10076
> Project: Solr
> Issue Type: Improvement
> Security Level: Public(Default Security Level. Issues are Public)
> Reporter: Mano Kovacs
> Assignee: Mark Miller
> Attachments: SOLR-10076.patch
>
>
> Passing keystore and truststore password is done by system properties, via cmd line parameter.
> As result, {{/admin/info/properties}} and {{/admin/info/system}} will print out the received password.
> Proposing solution to automatically redact value of any system property before output, containing the word {{password}}, and replacing its value with {{******}}.
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lucene.apache.org
For additional commands, e-mail: dev-help@lucene.apache.org