Removes support for txt file for specifying initial admin password and prevents password from being printed in the logs #3850
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Darshit Chanpura <[email protected]>
Signed-off-by: Darshit Chanpura <[email protected]>
DarshitChanpura
requested review from
cliu123,
cwperks,
davidlago,
peternied,
RyanL1997,
stephen-crawford,
reta and
willyborankin
as code owners
10 tasks
|
Fixed. |
cwperks
reviewed
Dec 14, 2023
src/main/java/org/opensearch/security/tools/democonfig/SecuritySettingsConfigurer.java
Outdated
Show resolved
Hide resolved
Signed-off-by: Darshit Chanpura <[email protected]>
derek-ho
reviewed
Dec 14, 2023
src/test/java/org/opensearch/security/tools/democonfig/SecuritySettingsConfigurerTests.java
Show resolved
Hide resolved
Signed-off-by: Darshit Chanpura <[email protected]>
Signed-off-by: Darshit Chanpura <[email protected]>
Codecov Report
Additional details and impacted files@@ Coverage Diff @@
## main #3850 +/- ##
==========================================
+ Coverage 65.24% 66.59% +1.35%
==========================================
Files 298 298
Lines 21197 21188 -9
Branches 3454 3453 -1
==========================================
+ Hits 13830 14111 +281
+ Misses 5669 5360 -309
- Partials 1698 1717 +19
|
Signed-off-by: Darshit Chanpura <[email protected]>
Signed-off-by: Darshit Chanpura <[email protected]>
This was referenced Dec 14, 2023
cwperks
previously approved these changes
Dec 14, 2023
src/main/java/org/opensearch/security/tools/democonfig/SecuritySettingsConfigurer.java
Outdated
Show resolved
Hide resolved
Signed-off-by: Darshit Chanpura <[email protected]>
cwperks
approved these changes
Dec 14, 2023
peternied
approved these changes
Dec 14, 2023
DarshitChanpura
added a commit
to DarshitChanpura/security
that referenced
this pull request
Dec 15, 2023
…d prevents password from being printed in the logs (opensearch-project#3850) Signed-off-by: Darshit Chanpura <[email protected]>
cwperks
pushed a commit
that referenced
this pull request
Dec 18, 2023
…t for Bundled JDK for this tool and updates DEVELOPER_GUIDE.md (#3845) ### Description Backports following commits related to demo configuration tool from main to 2.x: - [x] [17748b9](17748b9) from #3669 - [x] [4496440](4496440) from #3734 - [x] [06d8c29](06d8c29) from #3777 - [x] [e698315](e698315) from #3807 - [x] [9d11524](9d11524) from #3843 - [x] [62aed21](62aed21) from #3850 - [x] [ceabe13](ceabe13) from #3844 ### Issues Resolved - Related to #3827 ### Testing - automated tests ### Check List - [x] New functionality includes testing - [x] New functionality has been documented - [x] Commits are signed per the DCO using --signoff By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license. For more information on following Developer Certificate of Origin and signing off your commits, please check [here](https://github.com/opensearch-project/OpenSearch/blob/main/CONTRIBUTING.md#developer-certificate-of-origin). --------- Signed-off-by: Darshit Chanpura <[email protected]> Signed-off-by: Darshit Chanpura <[email protected]>
3 tasks
prabhask5
pushed a commit
to prabhask5/opensearch-security
that referenced
this pull request
Jan 11, 2024
…d prevents password from being printed in the logs (opensearch-project#3850) Signed-off-by: Darshit Chanpura <[email protected]> Signed-off-by: Prabhas Kurapati <[email protected]>
dlin2028
pushed a commit
to dlin2028/security
that referenced
this pull request
May 1, 2024
…d prevents password from being printed in the logs (opensearch-project#3850) Signed-off-by: Darshit Chanpura <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Storing an admin password in a text file that can be available to anyone that has access to config folder at any time could be potentially vulnerable. Although, originally added with the perception to support autonomous process to easily read from the config folder, we now only allow passing the admin password through environment variable as it is session-scoped. Further, we don't print the password to the logs to avoid any traces.
Testing
Check List
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.