Skip to content

Commit e470f5d

Browse files
committed
Added config file password encryption capabilities.
1 parent f730627 commit e470f5d

File tree

14 files changed

+622
-83
lines changed

14 files changed

+622
-83
lines changed

README.md

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,70 @@ hive-sre sre -db priv_dstreev -o ./sre-out`
8282

8383
**NOTE** It is NOT necessary to use the `-cfg` option if your config is `$HOME/.hive-sre/cfg/default`.
8484

85+
### Using Encrypted Password in the config 'yaml'
86+
87+
#### Generate the Encrypted Password
88+
89+
Use the `-pkey <password-key>` and `-p <password-to-encrypt` options of `hive-sre`
90+
91+
`hive-sre u3 -pkey cloudera -p have-a-nice-day`
92+
93+
Will generate:
94+
```
95+
...
96+
Encrypted password: HD1eNF8NMFahA2smLM9c4g==
97+
```
98+
99+
Copy this encrypted password and place it in your configuration file for the connection `password`. Repeat for the other passwords, if it's different, and paste it in the configuration as well.
100+
101+
#### Running with Encrypted Passwords
102+
103+
Using the **same** `-pkey <password-key>` you used to generate the encrypted password, we'll run `hive-sre`
104+
105+
`hive-sre u3 -pkey cloudera ...`
106+
107+
When the `-pkey` option is specified **WITHOUT** the `-p` option (used previously), `hive-sre` will understand to **decrypt** the configuration passwords before connecting to the resources. If you receive jdbc connection exceptions, recheck the `-pkey` and encrypted password from before.
108+
109+
**NOTE**: The encrypted password process is shared by `u3`, `sre`, and `perf`. It's not necessary to use different configs or password keys.
110+
111+
#### Checking the 'encrypted' password with Key
112+
113+
If you're not sure the password is correct, copy the 'encrypted' password from the config file and run:
114+
115+
```
116+
hive-sre u3 -pkey <password-key> -dp <encrypted_password>
117+
```
118+
119+
For example:
120+
```
121+
# Encrypt
122+
dstreev@e01 ~ $ hive-sre u3 -pkey cloudera -p have-a-nice-day
123+
APP_DIR: /usr/local/hive-sre/bin
124+
Running Host instance
125+
Application JAVA_OPTS=-Djavax.net.ssl.trustStore=/home/dstreev/bin/certs/gateway-client-trust.jks -Djavax.net.ssl.trustStorePassword=changeit
126+
PRG_ARGS= "u3" "-pkey" "cloudera" "-p" "have-a-nice-day"
127+
openjdk version "1.8.0_272"
128+
OpenJDK Runtime Environment (build 1.8.0_272-b10)
129+
OpenJDK 64-Bit Server VM (build 25.272-b10, mixed mode)
130+
Launching: u3
131+
Using Config: /home/dstreev/.hive-sre/cfg/default.yaml
132+
1:Encrypted Password: HD1eNF8NMFahA2smLM9c4g==
133+
134+
# Decrypt
135+
dstreev@e01 ~ $ hive-sre u3 -pkey cloudera -dp HD1eNF8NMFahA2smLM9c4g==
136+
APP_DIR: /usr/local/hive-sre/bin
137+
Running Host instance
138+
Application JAVA_OPTS=-Djavax.net.ssl.trustStore=/home/dstreev/bin/certs/gateway-client-trust.jks -Djavax.net.ssl.trustStorePassword=changeit
139+
PRG_ARGS= "u3" "-pkey" "cloudera" "-dp" "HD1eNF8NMFahA2smLM9c4g=="
140+
openjdk version "1.8.0_272"
141+
OpenJDK Runtime Environment (build 1.8.0_272-b10)
142+
OpenJDK 64-Bit Server VM (build 25.272-b10, mixed mode)
143+
Launching: u3
144+
Using Config: /home/dstreev/.hive-sre/cfg/default.yaml
145+
2:Decrypted Password: have-a-nice-day
146+
```
147+
148+
85149
### Output
86150

87151
The output is a set of files with actions and error (when encountered). The files maybe `txt` files or `markdown`. You may want to use a `markdown` viewer for easier viewing of those reports. The markdown viewer needs to support [github markdown tables](https://github.com/adam-p/markdown-here/wiki/Markdown-Cheatsheet#tables) .

pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222

2323
<groupId>com.cloudera.utils.hive</groupId>
2424
<artifactId>hive-sre</artifactId>
25-
<version>2.4.0.22.0-SNAPSHOT</version>
25+
<version>2.4.0.23.0-SNAPSHOT</version>
2626

2727
<name>hive-sre</name>
2828

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
package com.cloudera.utils;
2+
3+
import com.cloudera.utils.hive.sre.MessageCode;
4+
5+
import java.text.MessageFormat;
6+
import java.util.*;
7+
8+
public class Messages {
9+
10+
private final BitSet bitSet;
11+
private final Map<Integer, Object[]> argMap = new TreeMap<Integer, Object[]>();
12+
13+
public Messages(int size) {
14+
bitSet = new BitSet(size);
15+
}
16+
17+
public void set(int bit, Object... args) {
18+
bitSet.set(bit);
19+
if (args != null) {
20+
argMap.put(bit, args);
21+
}
22+
}
23+
24+
public void set(int bit) {
25+
bitSet.set(bit);
26+
}
27+
28+
public long getReturnCode() {
29+
long rtn = 0;
30+
long[] messageSet = bitSet.toLongArray();
31+
for (long messageBit : messageSet) {
32+
rtn = rtn | messageBit;
33+
}
34+
return rtn;
35+
}
36+
37+
public String getMessage(int bit) {
38+
String rtn = null;
39+
for (MessageCode messageCode : MessageCode.values()) {
40+
if (messageCode.getCode() == bit) {
41+
if (argMap.containsKey(bit)) {
42+
Object[] args = argMap.get(messageCode.getCode());
43+
rtn = MessageFormat.format(messageCode.getDesc(), args);
44+
} else {
45+
rtn = messageCode.getDesc();
46+
}
47+
48+
}
49+
}
50+
return rtn;
51+
}
52+
53+
public String[] getMessages() {
54+
List<String> messageList = new ArrayList<String>();
55+
for (MessageCode messageCode : MessageCode.getCodes(bitSet)) {
56+
if (!argMap.containsKey(messageCode.getCode())) {
57+
messageList.add(messageCode.getCode()+":"+messageCode.getDesc());
58+
} else {
59+
messageList.add(messageCode.getCode()+":"+MessageFormat.format(messageCode.getDesc(), argMap.get(messageCode.getCode())));
60+
}
61+
}
62+
String[] rtn = messageList.toArray(new String[0]);
63+
64+
return rtn;
65+
}
66+
67+
}
Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
/*
2+
* Copyright 2021 Cloudera, Inc. All Rights Reserved.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package com.cloudera.utils;
18+
19+
import javax.crypto.BadPaddingException;
20+
import javax.crypto.Cipher;
21+
import javax.crypto.IllegalBlockSizeException;
22+
import javax.crypto.NoSuchPaddingException;
23+
import javax.crypto.spec.SecretKeySpec;
24+
import javax.xml.bind.DatatypeConverter;
25+
import java.nio.charset.StandardCharsets;
26+
import java.security.InvalidAlgorithmParameterException;
27+
import java.security.InvalidKeyException;
28+
import java.security.NoSuchAlgorithmException;
29+
30+
public class Protect {
31+
32+
33+
// KeyGenerator keyGenerator = null;
34+
String key = null;
35+
SecretKeySpec keySpec = null;
36+
// SecretKey secretKey = null;
37+
Cipher cipher = null;
38+
final String initialVector = "ae280ckq";
39+
40+
final protected static char[] hexArray = "0123456789ABCDEF".toCharArray();
41+
42+
// Converts byte array to hex string
43+
// From: http://stackoverflow.com/questions/9655181/convert-from-byte-array-to-hex-string-in-java
44+
public static String bytesToHex(byte[] bytes) {
45+
char[] hexChars = new char[bytes.length * 2];
46+
for ( int j = 0; j < bytes.length; j++ ) {
47+
int v = bytes[j] & 0xFF;
48+
hexChars[j * 2] = hexArray[v >>> 4];
49+
hexChars[j * 2 + 1] = hexArray[v & 0x0F];
50+
}
51+
return new String(hexChars);
52+
}
53+
54+
public Protect(String key) {
55+
this.key = key;
56+
try {
57+
/*
58+
Create key spec seeded with a user defined key.
59+
*/
60+
keySpec = new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "Blowfish");
61+
62+
/**
63+
* Create an instance of cipher mentioning the name of algorithm
64+
* - Blowfish
65+
*/
66+
cipher = Cipher.getInstance("Blowfish/CBC/PKCS5Padding");
67+
} catch (NoSuchPaddingException ex) {
68+
System.out.println(ex);
69+
} catch (NoSuchAlgorithmException ex) {
70+
System.out.println(ex);
71+
}
72+
73+
}
74+
75+
/**
76+
* @param plainText
77+
* @return cipherBytes
78+
*/
79+
public String encrypt(String plainText) {
80+
81+
String rtn = null;
82+
byte[] encoding = new byte[0];
83+
try {
84+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, new javax.crypto.spec.IvParameterSpec(initialVector.getBytes()));
85+
encoding = cipher.doFinal(plainText.getBytes());
86+
} catch (InvalidKeyException|InvalidAlgorithmParameterException|IllegalBlockSizeException|BadPaddingException e) {
87+
e.printStackTrace();
88+
throw new RuntimeException(e);
89+
}
90+
91+
rtn = DatatypeConverter.printBase64Binary(encoding);
92+
93+
// System.out.println("-- Encrypted -----------");
94+
// System.out.println("Base64:\t " + rtn);
95+
// System.out.println("HEX:\t " + bytesToHex(encoding));
96+
97+
return rtn;
98+
}
99+
100+
/**
101+
* @param text
102+
* @return plainText
103+
*/
104+
public String decrypt(String text) throws RuntimeException {
105+
String plainText = null;
106+
byte[] ciphertext = DatatypeConverter.parseBase64Binary(text);
107+
108+
// Decrypt
109+
try {
110+
cipher.init(Cipher.DECRYPT_MODE, keySpec, new javax.crypto.spec.IvParameterSpec(initialVector.getBytes()));
111+
} catch (InvalidKeyException e) {
112+
e.printStackTrace();
113+
} catch (InvalidAlgorithmParameterException e) {
114+
e.printStackTrace();
115+
}
116+
byte[] message = new byte[0];
117+
try {
118+
message = cipher.doFinal(ciphertext);
119+
} catch (IllegalBlockSizeException e) {
120+
throw new RuntimeException(e);
121+
} catch (BadPaddingException e) {
122+
throw new RuntimeException(e);
123+
}
124+
plainText = new String(message);
125+
126+
// System.out.println("-- Decrypted -----------");
127+
// System.out.println("HEX:\t " + bytesToHex(message));
128+
// System.out.println("PLAIN:\t " + plainText);
129+
130+
return plainText;
131+
}
132+
133+
public static void main(String[] args) {
134+
Protect blowfishAlgorithm = new Protect("hello2");
135+
String textToEncrypt = "Blowfish Algorithm";
136+
System.out.println("Text before Encryption: " + textToEncrypt);
137+
String cipherText = blowfishAlgorithm.encrypt(textToEncrypt);
138+
System.out.println("Cipher Text: " + cipherText);
139+
System.out.println("Text after Decryption: " + blowfishAlgorithm.decrypt(cipherText));
140+
}
141+
142+
}
143+

0 commit comments

Comments
 (0)