1

I want to remove Keystore passwords from properties file of kafka, for that i have removed passwords from server.properties file and run following kafka commands.

bin/kafka-configs.bat --zookeeper 10.200.10.1:2181 --entity-type brokers --entity-name 0 --alter --add-config  'listener.name.internal.ssl.key.password=Pass1234,password.encoder.secret=secret,password.encoder.iterations=8192'

bin/kafka-configs.bat --zookeeper 10.200.10.1:2181 --entity-type brokers --entity-name 0 --alter --add-config  listener.name.internal.ssl.keystore.password=Pass1234,password.encoder.secret=secret,password.encoder.iterations=8192

bin/kafka-configs.bat --zookeeper 10.200.10.1:2181 --entity-type brokers --entity-name 0 --alter --add-config  listener.name.internal.ssl.truststore.password=Pass1234,password.encoder.secret=secret,password.encoder.iterations=8192

After starting Kafka following exception occurred.

[2020-01-24 15:21:55,419] ERROR [KafkaServer id=0] Fatal error during KafkaServe
r startup. Prepare to shutdown (kafka.server.KafkaServer)
org.apache.kafka.common.KafkaException: org.apache.kafka.common.KafkaException:
SSL key store is specified, but key store password is not specified.
        at org.apache.kafka.common.network.SslChannelBuilder.configure(SslChanne
lBuilder.java:71)
        at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilder
s.java:146)
        at org.apache.kafka.common.network.ChannelBuilders.serverChannelBuilder(
ChannelBuilders.java:85)
        at kafka.network.Processor.<init>(SocketServer.scala:747)
        at kafka.network.SocketServer.newProcessor(SocketServer.scala:394)
        at kafka.network.SocketServer$$anonfun$kafka$network$SocketServer$$addDa
taPlaneProcessors$1.apply$mcVI$sp(SocketServer.scala:279)
        at scala.collection.immutable.Range.foreach$mVc$sp(Range.scala:160)
        at kafka.network.SocketServer.kafka$network$SocketServer$$addDataPlanePr
ocessors(SocketServer.scala:278)
        at kafka.network.SocketServer$$anonfun$createDataPlaneAcceptorsAndProces
sors$1.apply(SocketServer.scala:241)
        at kafka.network.SocketServer$$anonfun$createDataPlaneAcceptorsAndProces
sors$1.apply(SocketServer.scala:238)
        at scala.collection.mutable.ResizableArray$class.foreach(ResizableArray.
scala:59)
        at scala.collection.mutable.ArrayBuffer.foreach(ArrayBuffer.scala:48)
        at kafka.network.SocketServer.createDataPlaneAcceptorsAndProcessors(Sock
etServer.scala:238)
        at kafka.network.SocketServer.startup(SocketServer.scala:121)
        at kafka.server.KafkaServer.startup(KafkaServer.scala:263)
        at kafka.server.KafkaServerStartable.startup(KafkaServerStartable.scala:
44)
        at kafka.Kafka$.main(Kafka.scala:84)
        at kafka.Kafka.main(Kafka.scala)
Caused by: org.apache.kafka.common.KafkaException: SSL key store is specified, b
ut key store password is not specified.
        at org.apache.kafka.common.security.ssl.SslEngineBuilder.createKeystore(
SslEngineBuilder.java:171)
        at org.apache.kafka.common.security.ssl.SslEngineBuilder.<init>(SslEngin
eBuilder.java:95)
        at org.apache.kafka.common.security.ssl.SslFactory.configure(SslFactory.
java:95)
        at org.apache.kafka.common.network.SslChannelBuilder.configure(SslChanne
lBuilder.java:69)
        ... 17 more

Kindly let me know if there is any other configuration required .

Olaf Kock
  • 46,930
  • 8
  • 59
  • 90
Junaid Ahmed
  • 21
  • 7
  • If you limit SSH access to the brokers, is this really necessary? – OneCricketeer Jan 27 '20 at 08:17
  • Hi this is security requirement of client to not showing password in properties file. – Junaid Ahmed Jan 28 '20 at 05:08
  • `ssl.keystore.password` , `ssl.truststore.password`, nor `ssl.key.password` can be obfuscated. – OneCricketeer Jan 28 '20 at 09:03
  • If you want to do this, you need to enabled `SASL/SCRAM`, not just `SSL` listeners. https://kafka.apache.org/documentation/#security_sasl_scram – OneCricketeer Jan 28 '20 at 09:07
  • Or you setup a [Kerberos Realm](https://kafka.apache.org/documentation/#security_sasl_kerberos) or use [OPA](https://www.openpolicyagent.org/docs/latest/kafka-authorization/) or [Vault PKI](https://opencredo.com/blogs/securing-kafka-using-vault-pki/). In the end, though, plaintext (or access keys) is still stored ***somewhere***, and you need to limit access to those who are trusted to access it – OneCricketeer Jan 28 '20 at 09:09

0 Answers0