[jira] [Comment Edited] (OOZIE-2803) Mask passwords when printing out configs/args in MapReduceMain and SparkMain

["Peter Bacsko (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/OOZIE-2803?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15871796#comment-15871796 ] 

Peter Bacsko edited comment on OOZIE-2803 at 2/17/17 3:28 PM:
--------------------------------------------------------------

-In MapReduce, we have to mask the following props (if they contain a password):-

-{{mapred.child.env}}-
-{{yarn.app.mapreduce.am.env}}-
-{{oozie.launcher.mapred.child.env}}-

Edit: it's easier to mask all props which has a value with a substring "password".


was (Author: pbacsko):
In MapReduce, we have to mask the following props (if they contain a password):

{{mapred.child.env}}
{{yarn.app.mapreduce.am.env}}
{{oozie.launcher.mapred.child.env}}

> Mask passwords when printing out configs/args in MapReduceMain and SparkMain
> ----------------------------------------------------------------------------
>
>                 Key: OOZIE-2803
>                 URL: https://issues.apache.org/jira/browse/OOZIE-2803
>             Project: Oozie
>          Issue Type: Bug
>          Components: action
>            Reporter: Peter Bacsko
>            Assignee: Peter Bacsko
>            Priority: Critical
>
> Sometimes passwords are displayed in both MapReduce and Spark action.
> *MapReduce*: when using {{HADOOP_CREDSTORE_PASSWORD}}, it must be passed to some Hadoop-specific config values, like {{mapred.child.env}}. This is easy to fix because we already have a method {{logMasking()}} where you can define a {{maskSet}} which contains a list of property keys to be masked.
> Note that this is not necessarily the perfect solution, since you can pass multiple env. vars separated by a colon, and only the password specific parts should be masked. But we need a working solution relatively quickly - later we can enhance this, eg. we can re-use {{PasswordMasker}} in some way (right now it only works with {{Map<String, String>}}).
> *Spark*:  for Spark, we have to pass passwords like this:
> {{--conf spark.executorEnv.HADOOP_CREDSTORE_PASSWORD=<custom keystore password>}}
> The Spark arguments are printed in {{SparkMain.run()}}. There is already a code in {{LauncherMapper.printArgs()}} which deals with situations like this, but it's not perfect because it only works if the args look something like {{--password pwd123}}. So if a single arg contains a password, it doesn't work, therefore we need a different approach here.



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)