7 Replies Latest reply on Jun 9, 2009 4:31 PM by josh2268

    mysql monitor

    josh2268 Jun 2, 2009 5:30 PM

      I manually added a mysql database to jopr to monitor and the user name and password are displayed in clear text for anyone to see. Is there a way to hide this ? It shows up on the "Inventory" tab in "General Properties" section.

      Name: MySql [MySql]
      Type: MySql Server (MySql)
      Date Created: 6/2/09, 3:42:16 PM, EDT
      Version: none
      Date Last Modified: 6/2/09, 3:42:16 PM, EDT
      Description: Mysql relational database server
      [color=444444]Resource Key: jdbc:mysql://127.0.0.1?user=mysql&password=mypass


      • 2548 Views
      • Tags:
        • 1. Re: mysql monitor
          mazz
          mazz Jun 2, 2009 5:33 PM (in response to josh2268)

          I dont' know much about the MySQL plugin - is there a way for you to not put the password in the JDBC URL but use the other connection properties to set the password (assuming the password is of property type "password" - the plugin descriptor would need to have defined that).

            • Actions
          • 2. Re: mysql monitor
            josh2268 Jun 3, 2009 2:20 PM (in response to josh2268)

            Yes I did use the connection properties to store the user name and password. For whatever reasons it's taking that and populating the credentials into the url on the overview page to see in clear text under in "Resource Key"

              • Actions
            • 3. Re: mysql monitor
              ips
              ips Jun 8, 2009 12:12 PM (in response to josh2268)

              Hi Josh,

              That sounds like a bug in the MySQL plugin. The password should definitely not be stored as part of the database Resource's key, as it is not needed to uniquely identify the database Resource among other database Resources on the same platform. And, as you've pointed out, it causes security issues, since the Resource key is displayed in the GUI. Please create an issue for this in RHQ JIRA - http://jira.rhq-project.org/.

              Thanks,
              Ian

                • Actions
              • 4. Re: mysql monitor
                mazz
                mazz Jun 8, 2009 12:13 PM (in response to josh2268)

                I already added this one (not specific to MySQL plugin - we should have a separate JIRA for that, I'll let someone else create that one)

                http://jira.rhq-project.org/browse/RHQ-2134

                  • Actions
                • 5. Re: mysql monitor
                  ips
                  ips Jun 8, 2009 12:19 PM (in response to josh2268)

                  Well, in the case of the MySQL plugin, I see no reason to include the password in the key in the first place (whether to even include the username is questionable) . Off the top of my head, I can't think of any other cases where it would be necessary to include a password in a Resource key, can you?

                    • Actions
                  • 6. Re: mysql monitor
                    mazz
                    mazz Jun 8, 2009 12:27 PM (in response to josh2268)

                    no, but perhaps people don't even want to expose pathnames? or any senstive info. This is perhaps a low-level enhancement request.

                    As for the My SQL plugin, we do need a JIRA for that for it to be fixed. I did not create a JIRA for that specific issue.

                      • Actions
                    • 7. Re: mysql monitor
                      josh2268 Jun 9, 2009 4:31 PM (in response to josh2268)

                      I submitted one for the mysql plugin I think.

                      http://jira.rhq-project.org/browse/RHQ-2137


                      thanks for all the help guys!

                        • Actions