You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@hbase.apache.org by "Rajeshbabu Chintaguntla (Jira)" <ji...@apache.org> on 2023/05/03 13:02:00 UTC

[jira] [Updated] (HBASE-27792) Guard Master/RS Dump Servlet behind admin walls

     [ https://issues.apache.org/jira/browse/HBASE-27792?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Rajeshbabu Chintaguntla updated HBASE-27792:
--------------------------------------------
    Fix Version/s: 2.6.0
                   3.0.0-alpha-4
                   2.5.5
                   2.4.18
       Resolution: Fixed
           Status: Resolved  (was: Patch Available)

Pushed to 2.4+ branches.
Thanks for the patch [~nihaljain.cs] .

> Guard Master/RS Dump Servlet behind admin walls
> -----------------------------------------------
>
>                 Key: HBASE-27792
>                 URL: https://issues.apache.org/jira/browse/HBASE-27792
>             Project: HBase
>          Issue Type: Improvement
>          Components: security, UI
>            Reporter: Nihal Jain
>            Assignee: Nihal Jain
>            Priority: Minor
>             Fix For: 2.6.0, 3.0.0-alpha-4, 2.5.5, 2.4.18
>
>
> Currently RSDumpServlet and MasterDumpServlet do not require any check for whether the user has privileges to access to instrumentation servlets.
> This is unlike other servlets like ProfileServlet, ConfServlet, JMXJsonServlet etc. which are guarded by admin checks.
> Goal of this JIRA is to add similar check for RS and Master Dump Servlet. Post this change only admins will be able to access RSDumpServlet and MasterDumpServlet, if _hadoop.security.instrumentation.requires.admin_ is enabled.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)