question How do you mask passwords for xml files in HDP? in Archives of Support Questions (Read Only)

How do you mask passwords for xml files in HDP?

cspencer — Sat, 07 May 2016 05:58:30 GMT

How can we mask passwords on xml configuration files in HDP for instance, the ranger-policymgr-ssl.xml file?

Re: How do you mask passwords for xml files in HDP?

tsaito — Tue, 10 May 2016 01:04:16 GMT

Not for ranger, but for hive, you can remove password from hive-site.xml by following the below:

https://cwiki.apache.org/confluence/display/Hive/AdminManual+Configuration

Re: How do you mask passwords for xml files in HDP?

amiller — Wed, 11 May 2016 02:06:55 GMT

Unfortunately an application that uses a credential store will always need at least one cleartext password so it can unlock that credential store. This can be hardcoded into the binary or stored in a file. The ranger-policymgr-ssl.xml files contain the passwords to unlock the keystore and truststore used by Ranger agents. Obviously this file should be secured with the minimal permissions necessary.

Other passwords in Ranger config files are stored in a credential store (jceks file), so they don't show up in plaintext in the configs. The credential stores typically use the default keystore password, so the files themselves should still be protected by appropriate file permissions.

(thanks to @lmccay for clarifying the last part for me)