You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@kudu.apache.org by "Alexey Serbin (Code Review)" <ge...@cloudera.org> on 2021/07/12 18:56:44 UTC
[kudu-CR] [webserver] make a few flags as sensitive
Alexey Serbin has uploaded this change for review. ( http://gerrit.cloudera.org:8080/17679
Change subject: [webserver] make a few flags as sensitive
......................................................................
[webserver] make a few flags as sensitive
This patch marks a few flags of the embedded webserver as 'sensitive',
forcing the redaction of their values while logging those in the logfile
or showing them in the UI served by the embedded webserver. Yes, that's
rather "security by obscurity" practice, but it could help in preventing
unintentional leaks in the absence of proper FS access restrictions
and in avoiding false-positives reported by various automated security
scanners.
* --webserver_private_key_file
this file may contain a private key file in non-encrypted form
* --webserver_private_key_password_cmd
the value of this flag may contain a password for the private key
file in a plain form or other sensitive info provided as arguments
for the command
* --webserver_password_file
this file contains user names and encrypted/hashed passwords
Change-Id: I187c6e8118a3e118299da1e3f7321f48c5eb9e05
---
M src/kudu/server/webserver_options.cc
1 file changed, 33 insertions(+), 22 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/79/17679/1
--
To view, visit http://gerrit.cloudera.org:8080/17679
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I187c6e8118a3e118299da1e3f7321f48c5eb9e05
Gerrit-Change-Number: 17679
Gerrit-PatchSet: 1
Gerrit-Owner: Alexey Serbin <as...@cloudera.com>
[kudu-CR] [webserver] tag a few flags as sensitive
Posted by "Andrew Wong (Code Review)" <ge...@cloudera.org>.
Andrew Wong has posted comments on this change. ( http://gerrit.cloudera.org:8080/17679 )
Change subject: [webserver] tag a few flags as sensitive
......................................................................
Patch Set 2: Code-Review+2
--
To view, visit http://gerrit.cloudera.org:8080/17679
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I187c6e8118a3e118299da1e3f7321f48c5eb9e05
Gerrit-Change-Number: 17679
Gerrit-PatchSet: 2
Gerrit-Owner: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Andrew Wong <aw...@cloudera.com>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Grant Henke <gr...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Comment-Date: Tue, 13 Jul 2021 02:27:38 +0000
Gerrit-HasComments: No
[kudu-CR] [webserver] tag a few flags as sensitive
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/17679 )
Change subject: [webserver] tag a few flags as sensitive
......................................................................
[webserver] tag a few flags as sensitive
This patch marks a few flags of the embedded webserver as 'sensitive',
forcing the redaction of their values while logging those in the logfile
or showing them in the UI served by the embedded webserver. Yes, that's
rather "security by obscurity" practice, but it could help in preventing
unintentional leaks in the absence of proper FS access restrictions
and in avoiding false-positives reported by various automated security
scanners.
* --webserver_private_key_file
this file may contain a private key file in non-encrypted form
* --webserver_private_key_password_cmd
the value of this flag may contain a password for the private key
file in a plain form or other sensitive info provided as arguments
for the command
* --webserver_password_file
this file contains user names and encrypted/hashed passwords
Change-Id: I187c6e8118a3e118299da1e3f7321f48c5eb9e05
Reviewed-on: http://gerrit.cloudera.org:8080/17679
Reviewed-by: Andrew Wong <aw...@cloudera.com>
Tested-by: Kudu Jenkins
---
M src/kudu/server/webserver_options.cc
1 file changed, 47 insertions(+), 36 deletions(-)
Approvals:
Andrew Wong: Looks good to me, approved
Kudu Jenkins: Verified
--
To view, visit http://gerrit.cloudera.org:8080/17679
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: I187c6e8118a3e118299da1e3f7321f48c5eb9e05
Gerrit-Change-Number: 17679
Gerrit-PatchSet: 3
Gerrit-Owner: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Andrew Wong <aw...@cloudera.com>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Grant Henke <gr...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
[kudu-CR] [webserver] make a few flags as sensitive
Posted by "Andrew Wong (Code Review)" <ge...@cloudera.org>.
Andrew Wong has posted comments on this change. ( http://gerrit.cloudera.org:8080/17679 )
Change subject: [webserver] make a few flags as sensitive
......................................................................
Patch Set 1: Code-Review+2
(1 comment)
http://gerrit.cloudera.org:8080/#/c/17679/1/src/kudu/server/webserver_options.cc
File src/kudu/server/webserver_options.cc:
http://gerrit.cloudera.org:8080/#/c/17679/1/src/kudu/server/webserver_options.cc@97
PS1, Line 97: ut
nit: authentication
--
To view, visit http://gerrit.cloudera.org:8080/17679
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I187c6e8118a3e118299da1e3f7321f48c5eb9e05
Gerrit-Change-Number: 17679
Gerrit-PatchSet: 1
Gerrit-Owner: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Andrew Wong <aw...@cloudera.com>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Grant Henke <gr...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Comment-Date: Tue, 13 Jul 2021 01:40:01 +0000
Gerrit-HasComments: Yes
[kudu-CR] [webserver] tag a few flags as sensitive
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has posted comments on this change. ( http://gerrit.cloudera.org:8080/17679 )
Change subject: [webserver] tag a few flags as sensitive
......................................................................
Patch Set 1:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/17679/1/src/kudu/server/webserver_options.cc
File src/kudu/server/webserver_options.cc:
http://gerrit.cloudera.org:8080/#/c/17679/1/src/kudu/server/webserver_options.cc@97
PS1, Line 97: ut
> nit: authentication
Done
--
To view, visit http://gerrit.cloudera.org:8080/17679
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I187c6e8118a3e118299da1e3f7321f48c5eb9e05
Gerrit-Change-Number: 17679
Gerrit-PatchSet: 1
Gerrit-Owner: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Andrew Wong <aw...@cloudera.com>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Grant Henke <gr...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Comment-Date: Tue, 13 Jul 2021 01:54:41 +0000
Gerrit-HasComments: Yes
[kudu-CR] [webserver] tag a few flags as sensitive
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Hello Attila Bukor, Kudu Jenkins, Andrew Wong, Grant Henke,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/17679
to look at the new patch set (#2).
Change subject: [webserver] tag a few flags as sensitive
......................................................................
[webserver] tag a few flags as sensitive
This patch marks a few flags of the embedded webserver as 'sensitive',
forcing the redaction of their values while logging those in the logfile
or showing them in the UI served by the embedded webserver. Yes, that's
rather "security by obscurity" practice, but it could help in preventing
unintentional leaks in the absence of proper FS access restrictions
and in avoiding false-positives reported by various automated security
scanners.
* --webserver_private_key_file
this file may contain a private key file in non-encrypted form
* --webserver_private_key_password_cmd
the value of this flag may contain a password for the private key
file in a plain form or other sensitive info provided as arguments
for the command
* --webserver_password_file
this file contains user names and encrypted/hashed passwords
Change-Id: I187c6e8118a3e118299da1e3f7321f48c5eb9e05
---
M src/kudu/server/webserver_options.cc
1 file changed, 47 insertions(+), 36 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/79/17679/2
--
To view, visit http://gerrit.cloudera.org:8080/17679
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I187c6e8118a3e118299da1e3f7321f48c5eb9e05
Gerrit-Change-Number: 17679
Gerrit-PatchSet: 2
Gerrit-Owner: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Andrew Wong <aw...@cloudera.com>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Grant Henke <gr...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)