ignite-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Вячеслав Коптилин <slava.kopti...@gmail.com>
Subject Re: Setting IGNITE_TO_STRING_INCLUDE_SENSITIVE=false prevents VM Arguments output
Date Thu, 01 Jul 2021 14:06:57 GMT
Hello Ivan,

> At least, we could just hide params that match a specific pattern
Yes, we can filter out all vm options that do not relate to Ignite, for
instance.

> Ilya, go ahead, file ticket and prepare a PR.
Please do not rush. Let's listen to other community members. This question
is about security and it should not be discussed in a hurry (even though it
looks like an obvious thing).

Thanks,
S.

чт, 1 июл. 2021 г. в 16:55, Ivan Daschinsky <ivandasch@gmail.com>:

> I suppose, that all normal users should not suffer from this restrictions.
> Nobody will pass password using jvm options. It is absolutely insane,
> normal users pass passwords using environment variables.
>
> At least, we could just hide params that match specific pattern
>
> Ilya, go ahead, file ticket and prepare a PR.
>
> чт, 1 июл. 2021 г., 16:45 Вячеслав Коптилин <slava.koptilin@gmail.com>:
>
> > Hello,
> >
> > Unfortunately, the user can pass its own system properties via JVM
> options
> > as follows: -DMY_SECRET_PASSWORD=123
> > It does not seem, this approach is the best one. However, the user should
> > have a "kostyl" in order to hide these properties and values in the log
> > file, IMHO.
> >
> > Thanks,
> > S.
> >
> > ср, 30 июн. 2021 г. в 22:52, Shishkov Ilya <shishkovilja@gmail.com>:
> >
> > > Hi Igniters,
> > >
> > > This feature [1, 2] prevents logging of the VM arguments when
> > > IGNITE_TO_STRING_INCLUDE_SENSITIVE option is set to false. Till now,
> > method
> > > IgniteKernal#ackVmArguments remains mostly the same [3].
> > >
> > > Is this behaviour actual now? Often, we should be able to get from logs
> > the
> > > actual VM options used at startup even if output of sensitive data is
> > > restricted.
> > >
> > > 1. https://issues.apache.org/jira/browse/IGNITE-4991
> > > 2.
> > >
> > >
> >
> https://github.com/apache/ignite/pull/2428/commits/4f90b6fd77bd23fa818620f0757b792ba388ef93
> > > 3.
> > >
> > >
> >
> https://github.com/apache/ignite/blob/master/modules/core/src/main/java/org/apache/ignite/internal/IgniteKernal.java#L3002
> > >
> >
>

Mime
  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message