You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@hbase.apache.org by "Kevin Geiszler (Jira)" <ji...@apache.org> on 2025/12/09 17:15:00 UTC
[jira] [Comment Edited] (HBASE-29761) The HBase UI's Debug Dump is not redacting sensitive information
[ https://issues.apache.org/jira/browse/HBASE-29761?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18043911#comment-18043911 ]
Kevin Geiszler edited comment on HBASE-29761 at 12/9/25 5:14 PM:
-----------------------------------------------------------------
Consider an hbase-site.xml file that includes the following:
{code:java}
<property>
<name>hbase.zookeeper.property.ssl.trustStore.password</name>
<value>kevin-zk-pw</value>
</property>
<property>
<name>ssl.client.truststore.password</name>
<value>kevin-ssl-truststore-pw</value>
</property>
<property>
<name>hbase.rpc.tls.truststore.password</name>
<value>kevin-tls-truststore-pw</value>
</property>
<property>
<name>ssl.server.keystore.password</name>
<value>kevin-ssl-keystore-pw</value>
</property>
<property>
<name>hadoop.security.sensitive-config-keys</name>
<value>
secret$
password$
hbase\.zookeeper\.property\.ssl\.trustStore\.password$
ssl.keystore.pass$
fs.s3a.server-side-encryption.key
fs.s3a.*.server-side-encryption.key
fs.s3a.encryption.algorithm
fs.s3a.encryption.key
fs.s3a.secret.key
fs.s3a.*.secret.key
fs.s3a.session.key
fs.s3a.*.session.key
fs.s3a.session.token
fs.s3a.*.session.token
fs.azure.account.key.*
fs.azure.oauth2.*
fs.adl.oauth2.*
fs.gs.encryption.*
fs.gs.proxy.*
fs.gs.auth.*
credential$
oauth.*secret
oauth.*password
oauth.*token
hadoop.security.sensitive-config-keys
</value>
</property> {code}
If the user runs HBase locally and performs a Debug Dump in the UI, then {{ssl.server.keystore.password}} and the {{*.keystore.password}} config values will each have their contents shown despite {{hadoop.security.sensitive-config-keys}} being included in the config.
was (Author: JIRAUSER302671):
Consider an hbase-site.xml file that includes the following:
{code:java}
<property>
<name>hbase.zookeeper.property.ssl.trustStore.password</name>
<value>kevin-zk-pw</value>
</property>
<property>
<name>ssl.client.truststore.password</name>
<value>kevin-ssl-truststore-pw</value>
</property>
<property>
<name>hbase.rpc.tls.truststore.password</name>
<value>kevin-tls-truststore-pw</value>
</property>
<property>
<name>ssl.server.keystore.password</name>
<value>kevin-ssl-keystore-pw</value>
</property>
<property>
<name>hadoop.security.sensitive-config-keys</name>
<value>
secret$
password$
hbase\.zookeeper\.property\.ssl\.trustStore\.password$
ssl.keystore.pass$
fs.s3a.server-side-encryption.key
fs.s3a.*.server-side-encryption.key
fs.s3a.encryption.algorithm
fs.s3a.encryption.key
fs.s3a.secret.key
fs.s3a.*.secret.key
fs.s3a.session.key
fs.s3a.*.session.key
fs.s3a.session.token
fs.s3a.*.session.token
fs.azure.account.key.*
fs.azure.oauth2.*
fs.adl.oauth2.*
fs.gs.encryption.*
fs.gs.proxy.*
fs.gs.auth.*
credential$
oauth.*secret
oauth.*password
oauth.*token
hadoop.security.sensitive-config-keys
</value>
</property> {code}
If the user runs HBase locally and performs a Debug Dump in the UI, then {{ssl.server.keystore.password}} and the {{*.keystore.password}} config values will each have their contents show despite {{hadoop.security.sensitive-config-keys}} being included in the config.
> The HBase UI's Debug Dump is not redacting sensitive information
> ----------------------------------------------------------------
>
> Key: HBASE-29761
> URL: https://issues.apache.org/jira/browse/HBASE-29761
> Project: HBase
> Issue Type: Bug
> Components: UI
> Reporter: Kevin Geiszler
> Assignee: Kevin Geiszler
> Priority: Critical
>
> The Debug Dump feature in the HBase UI is supposed to redact sensitive configuration values such as truststore and keystore passwords, but it is not doing so. Instead, the sensitive values are shown in plain text.
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)