You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@activemq.apache.org by Vilius Šumskas <vi...@rivile.lt> on 2025/01/09 07:33:04 UTC
Artemis journal compacting when password masking enabled
Hello,
I’m trying to compact Artemis journal with ./artemis data compact however no matter what I do I always get this error:
[root@activemq-artemis-node-1 bin]# ./artemis data compact
2025-01-09 07:23:24,038 WARN [org.apache.activemq.artemis.logs] AMQ202017: Algorithm two-way is deprecated and will be removed from the default codec in a future version. Use a custom codec instead. Consult the manual for details.
Error:Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
at java.base/com.sun.crypto.provider.CipherCore.unpad(CipherCore.java:862)
at java.base/com.sun.crypto.provider.CipherCore.fillOutputBuffer(CipherCore.java:942)
at java.base/com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:735)
at java.base/com.sun.crypto.provider.BlowfishCipher.engineDoFinal(BlowfishCipher.java:321)
at java.base/javax.crypto.Cipher.doFinal(Cipher.java:2205)
at org.apache.activemq.artemis.utils.DefaultSensitiveStringCodec$BlowfishAlgorithm.decode(DefaultSensitiveStringCodec.java:200)
at org.apache.activemq.artemis.utils.DefaultSensitiveStringCodec.decode(DefaultSensitiveStringCodec.java:70)
at org.apache.activemq.artemis.utils.DefaultSensitiveStringCodec.decode(DefaultSensitiveStringCodec.java:52)
at org.apache.activemq.artemis.utils.PasswordMaskingUtil.resolveMask(PasswordMaskingUtil.java:68)
at org.apache.activemq.artemis.core.deployers.impl.FileConfigurationParser.parseMainConfig(FileConfigurationParser.java:541)
at org.apache.activemq.artemis.core.config.impl.FileConfiguration.parse(FileConfiguration.java:56)
at org.apache.activemq.artemis.core.config.FileDeploymentManager.readConfiguration(FileDeploymentManager.java:81)
at org.apache.activemq.artemis.cli.commands.Configurable.readConfiguration(Configurable.java:89)
at org.apache.activemq.artemis.cli.commands.Configurable.getFileConfiguration(Configurable.java:66)
at org.apache.activemq.artemis.cli.commands.tools.journal.CompactJournal.execute(CompactJournal.java:37)
at org.apache.activemq.artemis.cli.Artemis.internalExecute(Artemis.java:225)
at org.apache.activemq.artemis.cli.Artemis.execute(Artemis.java:171)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at org.apache.activemq.artemis.boot.Artemis.execute(Artemis.java:152)
at org.apache.activemq.artemis.boot.Artemis.main(Artemis.java:64)
This is probably due to password masking which we are using. So far the things I tried:
1. pass -Dartemis.default.sensitive.string.codec.key=myKey in artemis-utility.properties
2. pass configuration to ./artemis data compact via both unnamed argument and –brokerConfig (this one is a little bit not clear because parameters differ if I type “artemis help” and in documentation and it’s unclear if configuration parameter requires broker.xml or bootstrap.xml, but I tried with both files)
3. searched for any way to pass username/password directly, but could not find any
Artemis version is 2.39.0, but 2.34.0 produces the same result.
What I’m doing wrong?
--
Best Regards,
Vilius Šumskas
Rivile
IT manager
RE: Artemis journal compacting when password masking enabled
Posted by Vilius Šumskas <vi...@rivile.lt>.
Found it. It looks like ${broker.instance}/bin/artemis have changed recently and artemis-utility.profile was not accounted for when running CLI commands. Updated bin/artemis script from clean Artemis instance installation and now it works.
These changes should be mentioned on https://activemq.apache.org/components/artemis/documentation/latest/versions.html though. It was a usual to mention in the release notes what needs to be changed. So when previously upgrading to 2.37.0 I saw release notes regarding new artemis-utility.profile file, just created clean broker and copied over this file from it.
Yes, I know that there is a new tool to upgrade configuration but since we have some modifications in our config files it is almost always faster to just add what is missing.
--
Vilius
-----Original Message-----
From: Domenico Francesco Bruscino <br...@gmail.com>
Sent: Thursday, January 9, 2025 12:25 PM
To: users@activemq.apache.org
Subject: Re: Artemis journal compacting when password masking enabled
Hi Vilius,
passing -Dartemis.default.sensitive.string.codec.key=myKey in artemis-utility.properties should work unless you are using a custom password-codec. Could you share the steps to reproduce this issue?
Thanks,
Domenico
On Thu, 9 Jan 2025 at 08:34, Vilius Šumskas <vi...@rivile.lt>
wrote:
> Hello,
>
> I’m trying to compact Artemis journal with ./artemis data compact
> however no matter what I do I always get this error:
>
> [root@activemq-artemis-node-1 bin]# ./artemis data compact
> 2025-01-09 07:23:24,038 WARN [org.apache.activemq.artemis.logs]
> AMQ202017: Algorithm two-way is deprecated and will be removed from
> the default codec in a future version. Use a custom codec instead.
> Consult the manual for details.
>
> Error:Given final block not properly padded. Such issues can arise if
> a bad key is used during decryption.
>
> javax.crypto.BadPaddingException: Given final block not properly padded.
> Such issues can arise if a bad key is used during decryption.
> at
> java.base/com.sun.crypto.provider.CipherCore.unpad(CipherCore.java:862)
> at
> java.base/com.sun.crypto.provider.CipherCore.fillOutputBuffer(CipherCore.java:942)
> at
> java.base/com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:735)
> at
> java.base/com.sun.crypto.provider.BlowfishCipher.engineDoFinal(BlowfishCipher.java:321)
> at java.base/javax.crypto.Cipher.doFinal(Cipher.java:2205)
> at
> org.apache.activemq.artemis.utils.DefaultSensitiveStringCodec$BlowfishAlgorithm.decode(DefaultSensitiveStringCodec.java:200)
> at
> org.apache.activemq.artemis.utils.DefaultSensitiveStringCodec.decode(DefaultSensitiveStringCodec.java:70)
> at
> org.apache.activemq.artemis.utils.DefaultSensitiveStringCodec.decode(DefaultSensitiveStringCodec.java:52)
> at
> org.apache.activemq.artemis.utils.PasswordMaskingUtil.resolveMask(PasswordMaskingUtil.java:68)
> at
> org.apache.activemq.artemis.core.deployers.impl.FileConfigurationParser.parseMainConfig(FileConfigurationParser.java:541)
> at
> org.apache.activemq.artemis.core.config.impl.FileConfiguration.parse(FileConfiguration.java:56)
> at
> org.apache.activemq.artemis.core.config.FileDeploymentManager.readConfiguration(FileDeploymentManager.java:81)
> at
> org.apache.activemq.artemis.cli.commands.Configurable.readConfiguration(Configurable.java:89)
> at
> org.apache.activemq.artemis.cli.commands.Configurable.getFileConfiguration(Configurable.java:66)
> at
> org.apache.activemq.artemis.cli.commands.tools.journal.CompactJournal.execute(CompactJournal.java:37)
> at
> org.apache.activemq.artemis.cli.Artemis.internalExecute(Artemis.java:225)
> at
> org.apache.activemq.artemis.cli.Artemis.execute(Artemis.java:171)
> at
> java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native
> Method)
> at
> java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
> at
> java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> at java.base/java.lang.reflect.Method.invoke(Method.java:569)
> at
> org.apache.activemq.artemis.boot.Artemis.execute(Artemis.java:152)
> at
> org.apache.activemq.artemis.boot.Artemis.main(Artemis.java:64)
>
>
> This is probably due to password masking which we are using. So far
> the things I tried:
>
> 1. pass -Dartemis.default.sensitive.string.codec.key=myKey in
> artemis-utility.properties
> 2. pass configuration to ./artemis data compact via both unnamed
> argument and –brokerConfig (this one is a little bit not clear because
> parameters differ if I type “artemis help” and in documentation and
> it’s unclear if configuration parameter requires broker.xml or
> bootstrap.xml, but I tried with both files)
> 3. searched for any way to pass username/password directly, but
> could not find any
>
> Artemis version is 2.39.0, but 2.34.0 produces the same result.
>
> What I’m doing wrong?
>
> --
> Best Regards,
>
> Vilius Šumskas
> Rivile
> IT manager
>
>
Re: Artemis journal compacting when password masking enabled
Posted by Domenico Francesco Bruscino <br...@gmail.com>.
Hi Vilius,
passing -Dartemis.default.sensitive.string.codec.key=myKey in
artemis-utility.properties should work unless you are using a
custom password-codec. Could you share the steps to reproduce this issue?
Thanks,
Domenico
On Thu, 9 Jan 2025 at 08:34, Vilius Šumskas <vi...@rivile.lt>
wrote:
> Hello,
>
> I’m trying to compact Artemis journal with ./artemis data compact however
> no matter what I do I always get this error:
>
> [root@activemq-artemis-node-1 bin]# ./artemis data compact
> 2025-01-09 07:23:24,038 WARN [org.apache.activemq.artemis.logs]
> AMQ202017: Algorithm two-way is deprecated and will be removed from the
> default codec in a future version. Use a custom codec instead. Consult the
> manual for details.
>
> Error:Given final block not properly padded. Such issues can arise if a
> bad key is used during decryption.
>
> javax.crypto.BadPaddingException: Given final block not properly padded.
> Such issues can arise if a bad key is used during decryption.
> at
> java.base/com.sun.crypto.provider.CipherCore.unpad(CipherCore.java:862)
> at
> java.base/com.sun.crypto.provider.CipherCore.fillOutputBuffer(CipherCore.java:942)
> at
> java.base/com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:735)
> at
> java.base/com.sun.crypto.provider.BlowfishCipher.engineDoFinal(BlowfishCipher.java:321)
> at java.base/javax.crypto.Cipher.doFinal(Cipher.java:2205)
> at
> org.apache.activemq.artemis.utils.DefaultSensitiveStringCodec$BlowfishAlgorithm.decode(DefaultSensitiveStringCodec.java:200)
> at
> org.apache.activemq.artemis.utils.DefaultSensitiveStringCodec.decode(DefaultSensitiveStringCodec.java:70)
> at
> org.apache.activemq.artemis.utils.DefaultSensitiveStringCodec.decode(DefaultSensitiveStringCodec.java:52)
> at
> org.apache.activemq.artemis.utils.PasswordMaskingUtil.resolveMask(PasswordMaskingUtil.java:68)
> at
> org.apache.activemq.artemis.core.deployers.impl.FileConfigurationParser.parseMainConfig(FileConfigurationParser.java:541)
> at
> org.apache.activemq.artemis.core.config.impl.FileConfiguration.parse(FileConfiguration.java:56)
> at
> org.apache.activemq.artemis.core.config.FileDeploymentManager.readConfiguration(FileDeploymentManager.java:81)
> at
> org.apache.activemq.artemis.cli.commands.Configurable.readConfiguration(Configurable.java:89)
> at
> org.apache.activemq.artemis.cli.commands.Configurable.getFileConfiguration(Configurable.java:66)
> at
> org.apache.activemq.artemis.cli.commands.tools.journal.CompactJournal.execute(CompactJournal.java:37)
> at
> org.apache.activemq.artemis.cli.Artemis.internalExecute(Artemis.java:225)
> at
> org.apache.activemq.artemis.cli.Artemis.execute(Artemis.java:171)
> at
> java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native
> Method)
> at
> java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
> at
> java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> at java.base/java.lang.reflect.Method.invoke(Method.java:569)
> at
> org.apache.activemq.artemis.boot.Artemis.execute(Artemis.java:152)
> at org.apache.activemq.artemis.boot.Artemis.main(Artemis.java:64)
>
>
> This is probably due to password masking which we are using. So far the
> things I tried:
>
> 1. pass -Dartemis.default.sensitive.string.codec.key=myKey in
> artemis-utility.properties
> 2. pass configuration to ./artemis data compact via both unnamed
> argument and –brokerConfig (this one is a little bit not clear because
> parameters differ if I type “artemis help” and in documentation and it’s
> unclear if configuration parameter requires broker.xml or bootstrap.xml,
> but I tried with both files)
> 3. searched for any way to pass username/password directly, but could
> not find any
>
> Artemis version is 2.39.0, but 2.34.0 produces the same result.
>
> What I’m doing wrong?
>
> --
> Best Regards,
>
> Vilius Šumskas
> Rivile
> IT manager
>
>