Created 05-06-2016 10:58 PM
How can we mask passwords on xml configuration files in HDP for instance, the ranger-policymgr-ssl.xml file?
Created 05-10-2016 07:06 PM
Unfortunately an application that uses a credential store will always need at least one cleartext password so it can unlock that credential store. This can be hardcoded into the binary or stored in a file. The ranger-policymgr-ssl.xml files contain the passwords to unlock the keystore and truststore used by Ranger agents. Obviously this file should be secured with the minimal permissions necessary.
Other passwords in Ranger config files are stored in a credential store (jceks file), so they don't show up in plaintext in the configs. The credential stores typically use the default keystore password, so the files themselves should still be protected by appropriate file permissions.
(thanks to @lmccay for clarifying the last part for me)
Created 05-09-2016 06:04 PM
Not for ranger, but for hive, you can remove password from hive-site.xml by following the below:
https://cwiki.apache.org/confluence/display/Hive/AdminManual+Configuration
Created 05-10-2016 07:06 PM
Unfortunately an application that uses a credential store will always need at least one cleartext password so it can unlock that credential store. This can be hardcoded into the binary or stored in a file. The ranger-policymgr-ssl.xml files contain the passwords to unlock the keystore and truststore used by Ranger agents. Obviously this file should be secured with the minimal permissions necessary.
Other passwords in Ranger config files are stored in a credential store (jceks file), so they don't show up in plaintext in the configs. The credential stores typically use the default keystore password, so the files themselves should still be protected by appropriate file permissions.
(thanks to @lmccay for clarifying the last part for me)