Details
-
Improvement
-
Status: Resolved
-
Normal
-
Resolution: Fixed
-
None
-
Operability
-
Normal
-
All
-
None
-
Description
As seen on CASSANDRA-16801 and friends we are working across the system with plain text passwords. These can be unintentionally revealed by intermediate systems. Allowing the use of hashed passwords should mitigate that. The idea is to add a new option HASHED PASSWORD for CREATE/ALTER ROLE/USER. Examples:
CREATE ROLE foo WITH login = true AND hashed password = '$2a$10$JSJEMFm6GeaW9XxT5JIheuEtPvat6i7uKbnTcxX3c1wshIIsGyUtG'; ALTER ROLE foo WITH hashed password = '$2a$10$JSJEMFm6GeaW9XxT5JIheuEtPvat6i7uKbnTcxX3c1wshIIsGyUtG';
To generate the password hash, there will be a new tool hash_password in resources/cassandra/bin
Based on original works from snazy
Attachments
Attachments
Issue Links
- is a child of
-
CASSANDRA-16801 PasswordObfuscator should not assume PASSWORD is the last item in the WITH clause
-
- Resolved
-
- is a parent of
-
CASSANDRA-17494 Pre hashed passwords in CQL docs
-
- Resolved
-
-
CASSANDRA-17457 CEP-24 - Password validation/generation
-
- Resolved
-
- is related to
-
CASSANDRA-18237 Write documentation for hashed passwords
-
- Triage Needed
-
- links to