[HIVE-27308] Exposing client keystore and truststore passwords in the JDBC URL can be a security concern

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 4.0.0-beta-1
• Labels: pull-request-available
• Assignee: Venugopal Reddy K
• Reporter: Venugopal Reddy K
• Created: 02/May/23 06:27
• Updated: 15/Aug/23 06:33
• Resolved: 17/May/23 16:53

Description

At present, we may have the following keystore and truststore passwords in the JDBC URL.

1. trustStorePassword
2. keyStorePassword
3. zooKeeperTruststorePassword
4. zooKeeperKeystorePassword

Exposing these passwords in URL can be a security concern. Can hide all these passwords from JDBC URL when we protect these passwords in a local JCEKS keystore file and pass the JCEKS file to URL instead.

1. Leverage the hadoop credential provider Link Create aliases for these passwords in a local JCE keystore like below. Store all the passwords in the same JCEKS files.

hadoop credential create keyStorePassword -value FDUxmzTxW15xWoaCk6GxLlaoHjnjV9H7iHqCIDxTwoq -provider localjceks://file/tmp/store/client_creds.jceks

2. Add a new option storePasswordPath to JDBC URL that point to the local JCE keystore file storing the password aliases. When the existing password option is present in URL, can ignore to fetch that particular alias from local jceks(i.e., giving preference to existing password option). And if password option is not present in URL, can fetch the password from local jceks.

JDBC URL may look like: 

beeline -u "jdbc:hive2://kvr-host:10001/default;retries=5;ssl=true;sslTrustStore=/tmp/truststore.jks;transportMode=http;httpPath=cliservice;twoWay=true;sslKeyStore=/tmp/keystore.jks;storePasswordPath=localjceks://file/tmp/client_creds.jceks;"

3. Hive JDBC can fetch the passwords with Configuration.getPassword API

Issue Links

• relates to: HIVE-27271 Client connection to HS2 fails when transportMode=http, ssl=true, sslTrustStore specified without trustStorePassword in the JDBC URL
• links to: GitHub Pull Request #4282