Sahara creates hive related users with hardcoded password

[Vitalii Gridnev]

Sahara creates hive related user with hardcoded password there:

https://github.com/openstack/sahara/blob/master/sahara/plugins/vanilla/hadoop2/resources/create_hive_db.sql#L4

This issue should be repaired.

[Michael Ionkin (msionkin)]

Hide hardcoded password of hive db user

There was hardcoded password for hive database user. Now it is
generated randomly.
Also made code refactoring in methods that get data from files.

[Tristan Cacqueray (tristan-cacqueray)]

Since this report concerns a possible security risk, an incomplete security advisory task has been added while the core security reviewers for the affected project or projects confirm the bug and discuss the scope of any vulnerability along with potential solutions.

This looks like a similar issue of bug 1541122, though it might be more severe if this service is more likely available for remote user. Depending on default security group configuration this could be a class C1 or class A.

[Vitalii Gridnev (vgridnev)]

This user is created only for MySQL database in node with hiveserver on vanilla cluster. So, in case when user (it's not available for remote user) have access to the node he will have access to this database. I guess it's most likely issue of Class D / Class C1 by VMT map.

Also to have access to node user should have correct private key distributed on all instances.

[Tristan Cacqueray (tristan-cacqueray)]

Based on above comment, I've closed the OSSA task and switch the bug report to public.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/325850

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/325850
Committed: https://git.openstack.org/cgit/openstack/sahara/commit/?id=d7f17930919644bb44858956f690f9383de35d17
Submitter: Jenkins
Branch: master

commit d7f17930919644bb44858956f690f9383de35d17
Author: Michael Lelyakin <email address hidden>
Date: Wed Aug 3 16:02:18 2016 +0000

    Remove hardcoded password from db schema

    This patch remove hardcoded password from file "plugins/
    "vanilla/hadoop2/resources/create_hive_db.sql". Now we use
    castellan service to store random-generated password.

    Closes-bug: 1498035
    Change-Id: Ib354ef9d24df4eb19788b1cd7dbc495d0dada55a
    co-authored-by: Michael Ionkin <email address hidden>

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/sahara 5.0.0.0b3 development milestone.