Siyao Meng created HDDS-16759:
---------------------------------
Summary: Document that DB checkpoint endpoints are not
authenticated without SPNEGO
Key: HDDS-16759
URL: https://issues.apache.org/jira/browse/HDDS-16759
Project: Apache Ozone
Issue Type: Improvement
Components: documentation
Reporter: Siyao Meng
The OM and SCM web servers authenticate requests only when HTTP Kerberos
(SPNEGO) is enabled, that is {{ozone.security.http.kerberos.enabled=true}}
together with {{ozone.om.http.auth.type=kerberos}} or
{{hdds.scm.http.auth.type=kerberos}}. Both are off by default, also when
{{ozone.security.enabled=true}}.
The DB checkpoint endpoints (OM {{/dbCheckpoint}} and {{/v2/dbCheckpoint}}, SCM
{{/dbCheckpoint}}) serve a copy of the metadata DB and are restricted to
administrators. That check needs an authenticated caller, so it is applied only
with SPNEGO. Neither the docs nor the config descriptions say so.
Proposed changes, documentation only:
* {{SecuringOzoneHTTP.md}}: state that without SPNEGO the admin check of the DB
checkpoint endpoints is not applied, and that operators of a secure cluster
should enable SPNEGO for OM and SCM or restrict network access to their HTTP
ports.
* {{ozone-default.xml}}: add the same note to the descriptions of
{{ozone.om.http.auth.type}} and {{hdds.scm.http.auth.type}}, and note that
{{kerberos}} takes effect only when {{ozone.security.http.kerberos.enabled}} is
true.
* {{THREAT_MODEL.md}}: list HTTP authentication among the controls that are off
by default, and add it to the operator hardening checklist.
No behavior change.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
