[STORM-3184] Storm supervisor log showing keystore and truststore password in plaintext

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.1.1
• Fix Version/s: 2.0.0, 1.2.3
• Component/s: storm-core
• Labels: pull-request-available
• Assignee: Arun Mahadevan
• Reporter: Arpit Khare
• Created: 07/Aug/18 01:27
• Updated: 23/Aug/18 13:38
• Resolved: 14/Aug/18 14:29

Description

When we enable SSL for Apache storm, the superviosr log shows the keystore and truststore password in the plaintext

log name : /var/log/storm/supervisor.log 

2018-05-28 16:21:12.594 o.a.s.d.s.Supervisor main [INFO] Starting supervisor for storm version '1.1.1.3.1.1.0-35'. 
2018-05-28 16:21:12.595 o.a.s.d.s.Supervisor main [INFO] Starting Supervisor with conf {storm.messaging.netty.min_wait_ms=100, storm.zookeeper.auth.user=null, storm.messaging.netty.buffer_s 
ize=5242880, client.jartransformer.class=org.apache.storm.hack.StormShadeTransformer, storm.exhibitor.port=8080, pacemaker.auth.method=NONE, ui.filter=null, worker.profiler.enabled=false 
ui.https.key.password=pass123
ui.https.keystore.password=pass123 

For the below properties created in custom-storm-site section in Ambari while enabling SSL. 

ui.https.key.password=pass123 
ui.https.keystore.password=pass123

Issue Links

• links to: GitHub Pull Request #2798
• links to: GitHub Pull Request #2801
• links to: GitHub Pull Request #2811