Uploaded image for project: 'Apache Drill'
  1. Apache Drill
  2. DRILL-3880

sqlline does not allow for a password prompt - security issue

    XMLWordPrintableJSON

Details

    • Improvement
    • Status: Open
    • Major
    • Resolution: Unresolved
    • 1.1.0
    • Future
    • Client - CLI

    Description

      When authentication is enabled in drill, and using sqlline, there is no way to get the sqlline client to prompt for a password. The only option is to specify the password at the command line (-n user -p password) or to log in and then connect.

      This is a security risk, in that now the .bash_history contains the user's password, defeating accountability on the system. Hive and MYSQL both allow for a -p flag with no value to trigger a prompt for the password that is not logged by .bash_history.

      One work around is to connect after starting sqlline, however, if the sqlline command offers a way to specify the username/password, we should do it in a way that doesn't violate security principles.

      Attachments

        Activity

          People

            Unassigned Unassigned
            mandoskippy John Omernik
            Votes:
            1 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated: