Managing Passwords In Sqoop

[#1]

long time waited thing is done and I am very happy to see that we have a got a way to secure and encrypt password in sqoop.

"As of Sqoop 1.4.5, Sqoop supports the use of JAVA Key Store to store passwords, so that you do not need to store passwords in clear text in a file."

root@m1 ~]# hadoop credential create mydb.password.alias -provider jceks://hdfs/user/root/mysql.password.jceks

Enter password:

Enter password again:

mydb.password.alias has been successfully created.

org.apache.hadoop.security.alias.JavaKeyStoreProvider has been updated.

But I have few questions.

1. Where is mydb.password.alias file saved in local machine or hdfs?

2. When we schedule sqoop jobs in oozie or falcon or cron then do we need to create key for that user's home dir whoever is running jobs.

3. Can we see content of mydb.password.alias file ?

[#2 · Accepted solution]

@Saurabh Kumar Password is stored in HDFS at location jceks://hdfs/user/<user>/mydb.password.jceks

See http://www.ericlin.me/securely-managing-passwords-in-sqoop

I have not tried 2, but you should grant read access to this file for other user.

[#3]

@Shishir Saxena: Thanks for reply.

Actually when I tried above location then it failed like below as expected.

root@m1 ~]# hadoop fs -ls jceks://hdfs/user/

ls: No FileSystem for scheme: jceks

But when I did ls to my user inside hdfs then it listed out that file.

[root@m1 ~]# hadoop fs -ls /user/root/

Found 6 items

drwxr-xr-x - root hdfs 0 2016-01-25 23:30 /user/root/.hiveJars

drwx------ - root hdfs 0 2016-02-29 04:31 /user/root/.staging

drwxr-xr-x - root hdfs 0 2016-02-24 18:16 /user/root/OozieTest

-rwxr-xr-x 3 root hdfs 1484 2016-02-03 21:19 /user/root/Output.json

-rwx------ 3 root hdfs 504 2016-03-02 04:14 /user/root/mysql.password.jceks

[root@m1 ~]# hadoop fs -cat /user/root/mysql.password.jceks

encodedParamst[B[encryptedContentq~Lsun.paramsAlgtLjava/lang/String;LsealAlgq~xpur[B??T?xp0xrjavax.crypto.SealedObject>6=?÷Tp[

_ܬ??uq~?"?5?????-?y?L;XF6??zQ

!z???????"???>I?cU?ɾ!

So It gave my question's answer. Thanks once again.