Where (and how) does Dremio store database credentials?

1

Hi everyone!
We have some concerns about Dremio’s security. In this specific case, how and where it stores credentials.

My questions are:

  • How and where does Dremio store database credentials (SQL and NoSQL) that we set up on it;
  • How and where does Dremio store user credentials (login and password)
2

I’m not sure about your specific case, but Dremio store metadata, jobs, etc in a embedded rocksDB

3

@Paulo_Vasconcellos, As @dacopan said, we store it in RocksDB. The user passwords are of course hashed and cannot be accessed by anyone. The database credentials are stored inside RocksDB and are used by Dremio to authenticate to the data sources. We recommend storing RocksDB on an encrypted file system or disk, and ensuring that only trusted users can access the coordinator’s file system.

1 Like
4

Hi @balaji.ramaswamy

What do you mean with “The user passwords are of course hashed and cannot be accessed by anyone.”? Are the credentials inaccessible to everyone including system admins?

I would want to have users credentials and data store configs persistent on host machine volume (I’m running Dremio docker image). Where is this Dremio’s database located in the system path?
Even better, it would be cool if users were stored in a database defined when spinning the docker image.

What is your take on this?

1 Like
5

@jaysnm

RocksDb is not as transparent as say an Oracle database where you can query DBA_USERS to find list of users and encrypted passwords

We are soon adding dictionary tables like a RDBMS that you can query and get all the information

Thanks
Bali

1 Like
6

Thanks folks.

A volume mount pointing to /opt/dremio/data makes my data persistent. The rocksdb and other custom confs data is in there!
A note to anyone who might land here: the volume must be owned by dremio:dremio UID 999 and GID 999

7

Thanks Bali. This helps.

8

Does RockDb also store S3 info, IAM Role , Access Key , Secret etc or only DB (SQL/NoSQL) info?

Thanks

9

@RXThomas, yes, it also stores information used to configure the source connectors (S3, HDFS, Azure storage etc)

1 Like
10

@balaji.ramaswamy has this table been made available in Dremio? If yes, can you let me know the details please

11

@priyanka Which table are you referring to?

12

[quote=“balaji.ramaswamy, post:5, topic:5231”]
dictionary tables like a RDBMS
[/quote] I meant the tables like “DBA_USERS” in RDBMS - it would be mighty useful to have something like this in Dremio as we continue to add more data.

13

Hi @priyanka

That is very useful feedback, we are coming up with the concept of system tables soon and is a pretty exciting story, stay tuned

Thanks
Bali

14

Balaji - is the new features available ? getting the data source credentails/ details? is that queriable?

15

@raghuj Data source credentials are stored inside the RocksDB and not queryable