--- title: Recent Security Enhancements author: admin type: post date: 2013-12-12T18:54:00+00:00 url: /recent-security-enhancements/ tumblr_gethue_permalink: - http://gethue.tumblr.com/post/69803995520/recent-security-enhancements tumblr_gethue_id: - 69803995520 sf_thumbnail_type: - none sf_thumbnail_link_type: - link_to_post sf_detail_type: - none sf_page_title: - 1 sf_page_title_style: - standard sf_no_breadcrumbs: - 1 sf_page_title_bg: - none sf_page_title_text_style: - light sf_background_image_size: - cover sf_social_sharing: - 1 sf_sidebar_config: - left-sidebar sf_left_sidebar: - Sidebar-2 sf_right_sidebar: - Sidebar-1 sf_caption_position: - caption-right categories: - News ---

Hue has seen a slew of security improvements recently (from Hue 3.5). The most important ones have been enabling encryption when communicating with other services:

1. Secure database connection ([HUE-1638][1]) 2. HiveServer2 over SSL ([HUE-1749][2])   In addition, several other security options have been added: 1. Session timeout is now configurable ([HUE-1528][3]) 2. Cookies can be secure ([HUE-1529][4]) 3. HTTP only in session cookie if supported ([HUE-1639][5]) 4. Allowed HTTP methods can be defined in the hue.ini 5. Cipher list can be restricted when using SSL   # Secure Database Connection Connections vary depending on the database. Hue uses different clients to communicate with each database internally. They all specify a common interface known as the DBAPI version 2 interface. Client specific options, such as secure connectivity, can be passed through the interface. For example (MySQL):
[desktop]
  [[databases]]
   …
   options={"ssl":{"ca":"/tmp/ca-cert.pem"}}
# HiveServer2 over SSL By providing a CA certificate, private key, and public certificate, Hue can communicate with HiveServer2 over SSL. This is configurable in the [hue.ini][6]. For example:
[beeswax]
  [[ssl]]
  enabled=true
  cacerts=/etc/hue/cacerts.pem
  key=/etc/hue/key.pem
  cert=/etc/hue/key.pemkey=/etc/hue/publiccert.pem
# HiveServer2 over Kerberos with LDAP authentication HiveServer2 supports [LDAP authentication][7] with a client connecting under a Thrift connection with security. This means Hue can provide a LDAP password that will be used by HiveServer2 to authenticate Hue. The username is defaulting to ‘hue’ or the username of the Hue Kerberos ticket. This is configurable in the [hue.ini][6]. For example:
[desktop]
  ldap_password=MY_HUE_USER_LDAP_PASSWORD
# Session Timeout The session timeout can be set in the [hue.ini][8] at desktop->session->ttl. Example:
[desktop]
  [[session]]
  ttl=3600
# Secure Cookies Secure session cookies can be enabled in the [hue.ini][9] at desktop->session->secure. Example:
[desktop]
  [[session]]
  secure=true
The HTTPonly flag can be set via the [hue.ini][10] at desktop->session->http_only. Example:
[desktop]
  [[session]]
  http_only=true
# Allowed HTTP Methods Which HTTP request methods the server should respond to can be controlled via desktop->http_allowed_methods in the hue.ini. For example:
[desktop]
http_allowed_methods=options,get,head,post,put,delete,connect
# Restricting the Cipher List Cipher list support with HTTPS can be restricted via desktop->ssl_cipher_list in the hue.ini. The value is in [cipher list format][11]. For example:
[desktop]
ssl_cipher_list=DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2
# URL redirect whitelist Restrict to which domains or pages Hue can redirect the users.
[desktop]
redirect_whitelist=^http://www.mydomain.com/.*$
The Hue team is working hard improving security. We hope these recent improvements make your system more secure and more compliant with security standards. As always, feel free to contact us at [hue-user][12] or [@gethue][13]. [1]: https://issues.cloudera.org/browse/HUE-1638 [2]: https://issues.cloudera.org/browse/HUE-1749 [3]: https://issues.cloudera.org/browse/HUE-1528 [4]: https://issues.cloudera.org/browse/HUE-1529 [5]: https://issues.cloudera.org/browse/HUE-1639 [6]: https://github.com/cloudera/hue/blob/master/desktop/conf.dist/hue.ini#L494 [7]: http://www.cloudera.com/content/cloudera-content/cloudera-docs/CDH4/4.3.0/CDH4-Security-Guide/cdh4sg_topic_9_1.html?scroll=topic_9_1_unique_4 [8]: https://github.com/cloudera/hue/blob/master/desktop/conf.dist/hue.ini#L204 [9]: https://github.com/cloudera/hue/blob/master/desktop/conf.dist/hue.ini#L208 [10]: https://github.com/cloudera/hue/blob/master/desktop/conf.dist/hue.ini#L211 [11]: http://www.openssl.org/docs/apps/ciphers.html [12]: http://groups.google.com/a/cloudera.org/group/hue-user [13]: http://twitter.com/gethue