[HIVE-14889] Beeline leaks sensitive environment variables of HiveServer2 when you type set;

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.1.1, 2.2.0
• Component/s: Beeline
• Assignee: Vihang Karajgaonkar
• Reporter: Vihang Karajgaonkar
• Created: 04/Oct/16 21:16
• Updated: 08/Dec/16 14:09
• Resolved: 07/Oct/16 15:10

Description

When you type set; beeline prints all the environment variables including passwords which could be major security risk. Eg: HADOOP_CREDENTIAL_PASSWORD below is leaked.

| env:HADOOP_CREDSTORE_PASSWORD=password             |
| env:HADOOP_DATANODE_OPTS=-Dhadoop.security.logger=ERROR,RFAS  |
| env:HADOOP_HOME_WARN_SUPPRESS=true                 |
| env:HADOOP_IDENT_STRING=vihang                     |
| env:HADOOP_PID_DIR=                                |