-
Notifications
You must be signed in to change notification settings - Fork 24.9k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Handle pwd protected keystores in all CLI tools (#45289)
This change ensures that `elasticsearch-setup-passwords` and `elasticsearch-saml-metadata` can handle a password protected elasticsearch.keystore. For setup passwords the user would be prompted to add the elasticsearch keystore password upon running the tool. There is no option to pass the password as a parameter as we assume the user is present in order to enter the desired passwords for the built-in users. For saml-metadata, we prompt for the keystore password at all times even though we'd only need to read something from the keystore when there is a signing or encryption configuration.
- Loading branch information
Showing
8 changed files
with
276 additions
and
124 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
81 changes: 81 additions & 0 deletions
81
server/src/main/java/org/elasticsearch/cli/KeyStoreAwareCommand.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| /* | ||
| * Licensed to Elasticsearch under one or more contributor | ||
| * license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright | ||
| * ownership. Elasticsearch licenses this file to you under | ||
| * the Apache License, Version 2.0 (the "License"); you may | ||
| * not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, | ||
| * software distributed under the License is distributed on an | ||
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| * KIND, either express or implied. See the License for the | ||
| * specific language governing permissions and limitations | ||
| * under the License. | ||
| */ | ||
|
|
||
| package org.elasticsearch.cli; | ||
|
|
||
| import joptsimple.OptionSet; | ||
| import org.elasticsearch.common.settings.KeyStoreWrapper; | ||
| import org.elasticsearch.common.settings.SecureString; | ||
| import org.elasticsearch.env.Environment; | ||
|
|
||
| import javax.crypto.AEADBadTagException; | ||
| import java.io.IOException; | ||
| import java.security.GeneralSecurityException; | ||
| import java.util.Arrays; | ||
|
|
||
| /** | ||
| * An {@link org.elasticsearch.cli.EnvironmentAwareCommand} that needs to access the elasticsearch keystore, possibly | ||
| * decrypting it if it is password protected. | ||
| */ | ||
| public abstract class KeyStoreAwareCommand extends EnvironmentAwareCommand { | ||
| public KeyStoreAwareCommand(String description) { | ||
| super(description); | ||
| } | ||
|
|
||
| /** | ||
| * Reads the keystore password from the {@link Terminal}, prompting for verification where applicable and returns it as a | ||
| * {@link SecureString}. | ||
| * | ||
| * @param terminal the terminal to use for user inputs | ||
| * @param withVerification whether the user should be prompted for password verification | ||
| * @return a SecureString with the password the user entered | ||
| * @throws UserException If the user is prompted for verification and enters a different password | ||
| */ | ||
| protected static SecureString readPassword(Terminal terminal, boolean withVerification) throws UserException { | ||
| final char[] passwordArray; | ||
| if (withVerification) { | ||
| passwordArray = terminal.readSecret("Enter new password for the elasticsearch keystore (empty for no password): "); | ||
| char[] passwordVerification = terminal.readSecret("Enter same password again: "); | ||
| if (Arrays.equals(passwordArray, passwordVerification) == false) { | ||
| throw new UserException(ExitCodes.DATA_ERROR, "Passwords are not equal, exiting."); | ||
| } | ||
| Arrays.fill(passwordVerification, '\u0000'); | ||
| } else { | ||
| passwordArray = terminal.readSecret("Enter password for the elasticsearch keystore : "); | ||
| } | ||
| return new SecureString(passwordArray); | ||
| } | ||
|
|
||
| /** | ||
| * Decrypt the {@code keyStore}, prompting the user to enter the password in the {@link Terminal} if it is password protected | ||
| */ | ||
| protected static void decryptKeyStore(KeyStoreWrapper keyStore, Terminal terminal) | ||
| throws UserException, GeneralSecurityException, IOException { | ||
| try (SecureString keystorePassword = keyStore.hasPassword() ? | ||
| readPassword(terminal, false) : new SecureString(new char[0])) { | ||
| keyStore.decrypt(keystorePassword.getChars()); | ||
| } catch (SecurityException e) { | ||
| if (e.getCause() instanceof AEADBadTagException) { | ||
| throw new UserException(ExitCodes.DATA_ERROR, "Wrong password for elasticsearch.keystore"); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| protected abstract void execute(Terminal terminal, OptionSet options, Environment env) throws Exception; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.