jbonofre opened a new pull request, #159:
URL: https://github.com/apache/karaf-cellar/pull/159
## Summary
The shipped `etc/hazelcast.xml` enables multicast discovery with the
well-known group
name/password (`cellar`/`pass`) and no SSL, symmetric-encryption or
socket-interceptor. In
Hazelcast OSS, the group password is not an authentication mechanism - it
isn't verified at
join. Combined with `groups.cfg` shipping
`default.bundle.whitelist.inbound=*` and
`default.bundle.sync=cluster`, any host that can reach the multicast group
can join the
cluster and push a bundle-install cluster event that other nodes will
execute.
This PR does **not** change any default values (multicast, group
name/password, or the
`groups.cfg` whitelist) - that's a separate, more disruptive discussion. It
only makes the
risk impossible to miss and gives operators concrete hardening steps:
* `HazelcastServiceFactory` now logs a loud, non-blocking `WARN` at startup
if the group
name/password are still the shipped defaults, and/or if multicast is
enabled with no
SSL/symmetric-encryption/socket-interceptor protecting it.
* The shipped `hazelcast.xml` gets explanatory comments next to the
`<group>` and
`<multicast>` elements.
* `hazelcast.adoc` no longer implies the group password is a real
credential, and gains a
new "Security considerations" section with hardening recommendations
(network isolation,
tcp-ip with an explicit member list instead of multicast,
SSL/symmetric-encryption).
## Test plan
- [x] `mvn -pl hazelcast -am test` - all tests pass, including a new
`HazelcastServiceFactorySecurityTest` covering both detection conditions
(default group,
unprotected multicast) and their negative cases, plus a regression guard
that asserts the
shipped `assembly/src/main/resources/hazelcast.xml` is still detected as
insecure today.
- [x] Confirmed the existing `HazelcastServiceFactoryTest`, which spins up a
real
`HazelcastInstance`, still passes with the new check wired into
`buildInstance()`.
- [x] Manually reviewed the rendered `hazelcast.adoc` changes for correct
AsciiDoc syntax.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
