Can "javax.jdo.option.ConnectionPassword" be encrypted ?

[#1]

Hive users can read the hive-site.xml and javax.jdo.option.ConnectionPassword because the password is stored in plane text.

Can I make it encrypted ?

[#2 · Accepted solution]

I am using Ambari 2.2

[#3]

@Junichi Oda

[#4]

@Neeraj Sabharwal

Thank you for your prompt reply.

I alse see that the password is encrypted on Ambari.

On the hive-site.xml in the hive metastore server(/etc/hive/conf/conf.server/hive-site.xml), I can find the password for "javax.jdo.option.ConnectionPassword" that is plane text.

[#5]

@Junichi Oda

Removing Hive Metastore Password from Hive Configuration

Support for this was added in Hive 0.14.0 with HIVE-7634 and HADOOP-10904. By setting up a CredentialProvider to handle storing/retrieval of passwords, you can remove the need to keep the Hive metastore password in cleartext in the Hive configuration.

https://cwiki.apache.org/confluence/display/Hive/AdminManual+Configuration

[#6]

Thank you for the reference. I will try to do it.

Thanks a lot!!

[#7]

@Junichi Oda I have never tried it but looks like its going to work 😉 ..Keep us posted on the final results and do accept the best answer to close the thread whenever you are ready

[#8]

@Junichi Oda If you are using ambari then you will end up hitting an issue on removing "Remove the Hive Metastore password entry (javax.jdo.option.ConnectionPassword) from the Hive configuration"

I am working on finding the option to make it work.

[#9]

@Neeraj Sabharwal

Thank you for your kindness. I'm sorry for the delay in responding.

As you pointed out, I couldn't work "Remove the Hive Metastore password entry from the Hive configuration" with the Ambari.

When the Hive restarts with the Ambari, the hive-site.xml will be removed.

[#10]

@Junichi Oda

It won't work in this ambari release. Future release, yes