[
https://issues.apache.org/jira/browse/HDFS-2617?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13409709#comment-13409709
]
Allen Wittenauer commented on HDFS-2617:
----------------------------------------
No. KSSL is hard-coded by RFC to only use certain ciphers. To put this into
terms that many might have an easier time understanding, KSSL is roughly
equivalent to WEP in terms of its vulnerability.
I'd also like to point out what our 'spread' looks like:
0.20.2 and lower: insecure only, so irrelevant
0.20.203 through 0.20.205: only had KSSL+hftp
1.0.0 and up: WebHDFS is available
So we're looking at a window of releases of about 5-6 months. Folks that are
running something in 0.20.203 through 1.0.1 should really upgrade anyway due to
the severity of some of the bugs never mind the security holes that have since
been found.
> Replaced Kerberized SSL for image transfer and fsck with SPNEGO-based solution
> ------------------------------------------------------------------------------
>
> Key: HDFS-2617
> URL: https://issues.apache.org/jira/browse/HDFS-2617
> Project: Hadoop HDFS
> Issue Type: Improvement
> Components: security
> Reporter: Jakob Homan
> Assignee: Jakob Homan
> Fix For: 2.0.1-alpha
>
> Attachments: HDFS-2617-a.patch, HDFS-2617-b.patch,
> HDFS-2617-config.patch, HDFS-2617-trunk.patch, HDFS-2617-trunk.patch,
> HDFS-2617-trunk.patch, HDFS-2617-trunk.patch, hdfs-2617-1.1.patch
>
>
> The current approach to secure and authenticate nn web services is based on
> Kerberized SSL and was developed when a SPNEGO solution wasn't available. Now
> that we have one, we can get rid of the non-standard KSSL and use SPNEGO
> throughout. This will simplify setup and configuration. Also, Kerberized
> SSL is a non-standard approach with its own quirks and dark corners
> (HDFS-2386).
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
