You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "iamqq23ue (via GitHub)" <gi...@apache.org> on 2025/06/03 08:53:45 UTC
[I] [Bug] Bug title acl2.0依然可以看到明文密码 [rocketmq]
iamqq23ue opened a new issue, #9446:
URL: https://github.com/apache/rocketmq/issues/9446
### Before Creating the Bug Report
- [x] I found a bug, not just asking a question, which should be created in [GitHub Discussions](https://github.com/apache/rocketmq/discussions).
- [x] I have searched the [GitHub Issues](https://github.com/apache/rocketmq/issues) and [GitHub Discussions](https://github.com/apache/rocketmq/discussions) of this repository and believe that this is not a duplicate.
- [x] I have confirmed that this bug belongs to the current repository, not other repositories of RocketMQ.
### Runtime platform environment
linux
### RocketMQ version
5.3.3
### JDK Version
jdk8
### Describe the Bug
根据acl2.0全新升级这篇文章，acl2.0可以不用明文保存密码。但实际发现有两个地方还是要明文密码。
1，innerClientAuthenticationCredentials还是会配置明文的用户密码
2，新创建的用户密码会在config/users/000024.sst也能看到。这个文件不是纯文本，但可以被文本扫描看到内容。比如使用写字板打开能看到密码。
### Steps to Reproduce
1，innerClientAuthenticationCredentials还是会配置明文的用户密码
2，新创建的用户密码会在config/users/000024.sst也能看到。这个文件不是纯文本，但可以被文本扫描看到内容。比如使用写字板打开能看到密码。
### What Did You Expect to See?
配置文件或存储文件中查不到明文密码
### What Did You See Instead?
可以看到明文密码
### Additional Context
_No response_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] Bug title acl2.0依然可以看到明文密码 [rocketmq]
Posted by "iamqq23ue (via GitHub)" <gi...@apache.org>.
iamqq23ue commented on issue #9446:
URL: https://github.com/apache/rocketmq/issues/9446#issuecomment-2942420858
> 你好，目前ACL中的密码确实没有进行加密存储，之前的考虑是：
>
> 1. 系统可以通过权限控制来设置是否能够查询出用户的密码。
> 2. 加密算法的选择上，时间原因，还没有考虑清楚通过哪些算法来进行支持。
> 3. 文档中说的非明文存储，确实是相比原来的yaml来说的，实际可以通过你说的方式能够查看
>
> 关于加密，如果可以，目前还是希望相关的使用方自己进行实现，确保系统绝对的安全性。当然后续，我们也会调研下常见的加密算法进行支持
感谢回复，看来目前还是要自己实现。
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] Bug title acl2.0依然可以看到明文密码 [rocketmq]
Posted by "dingshuangxi888 (via GitHub)" <gi...@apache.org>.
dingshuangxi888 commented on issue #9446:
URL: https://github.com/apache/rocketmq/issues/9446#issuecomment-2934832015
你好，目前ACL中的密码确实没有进行加密存储，之前的考虑是：
1. 系统可以通过权限控制来设置是否能够查询出用户的密码。
2. 加密算法的选择上，时间原因 还没有考虑清楚通过哪些算法来进行支持。
3. 文档中说的非明文存储，确实是相比原来的yaml来说的，实际可以通过你说的方式能够查看
关于加密，如果可以，目前还是希望相关的使用方自己进行实现，后续也会调研下常见的加密算法进行支持
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] acl 2.0 can still see plaintext passwords [rocketmq]
Posted by "RongtongJin (via GitHub)" <gi...@apache.org>.
RongtongJin closed issue #9446: [Bug] acl 2.0 can still see plaintext passwords
URL: https://github.com/apache/rocketmq/issues/9446
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org