title: How can I prevent user from displaying content of the shiro.ini file in Zeppelin
body: <p>I followed the turorial from <a href="https://www.vultr.com/docs/how-to-install-apache-zeppelin-on-ubuntu-16-04" rel="nofollow noreferrer">here</a> on how to install and use Zeppelin. I also created users with passwords by specifying them in the <code>conf/shiro.ini</code> file. </p>
  
  <p>The problem however is that a user can write this simple script to see the contents of the shiro file. </p>
  
  <pre><code>%python
  import os
  os.system("cat &lt;path_to_zeppelin_folder&gt;conf/shiro.ini")
  </code></pre>
  
  <p>My question is, how can I prevent the user from seeing this file, as this file is accessed by the Zeppelin program and therefore I can't just make it unreadable by removing read permissions.</p>
  
  <p>What I am doing now is to remove read/write permissions of the <code>shiro.ini</code> file after starting Zeppelin, but there should be a more elegant way of preventing such a thing.</p>