[ARTEMIS-3488] Create env variable AMQ_PASSWORD_CODEC_INIT_KEY

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.18.0
• Fix Version/s: 2.19.0
• Component/s: Configuration
• Labels: password security
• Flags: Important
• Assignee: Justin Bertram
• Reporter: Valeriy Ak
• Created: 17/Sep/21 07:46
• Updated: 08/Dec/22 15:09
• Resolved: 06/Oct/21 17:32

Description

Currently all passwords could be masked in broker.xml, bootstap.xml

However for simmetric password used BlowfishAlgorithm it use default internalKey= clusterpassword (org.apache.activemq.artemis.utils.DefaultSensitiveStringCodec.BlowfishAlgorithm:129)

 

Also DefaultSensitiveStringCodec (release has only this implementation) has option to change initKey, but it looks too silly:

broker.xml

<configuration>

    <core xmlns="urn:activemq:core">

    <mask-password>true</mask-password> 
    <password-codec>org.apache.activemq.artemis.utils.DefaultSensitiveStringCodec;key=changeit</password-codec>

    <acceptors>
        <acceptor name="artemis">
            tcp://0.0.0.0:61616?keyStorePassword=2490b5e188dbee2b6ad98b1650ed3d10
        </acceptor>
    </acceptors>
</core>
</configuration>

 

bootstrap.xml

<broker xmlns="http://activemq.org/schema">
    <web bind="https://0.0.0.0:8161" path="web"
         keyStorePath="/var/run/stores/keystore/keystore.jks"
         passwordCodec="org.apache.activemq.artemis.utils.DefaultSensitiveStringCodec;key=changeit"
         keyStorePassword="ENC(2490b5e188dbee2b6ad98b1650ed3d10)">
     </web>
</broker> 

 

So .. it just added another step for a hacker to get all passwords.
For examle - it easy to decrypt all passwords uses tool like -
http://blowfish.online-domain-tools.com/)

 

What need to do:

1. Add optional param AMQ_PASSWORD_CODEC_INIT_KEY (like AMQ_USER, AMQ_PASSWORD)
2. DefaultSensitiveStringCodec.BlowfishAlgorithm get this parameter as initKey by default. If key passed - use it

 

 

Issue Links

• relates to: ARTEMIS-4042 DefaultSensitiveStringCodec - read ARTEMIS_DEFAULT_SENSITIVE_STRING_CODEC_KEY env if system property is not set
• relates to: ARTEMIS-4112 DefaultSensitiveStringCodec don't set system property in scripts as env is read directly
• links to: GitHub Pull Request #3767
• links to: GitHub Pull Request #3780