[
https://issues.apache.org/jira/browse/HDDS-16759?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Siyao Meng updated HDDS-16759:
------------------------------
Description:
The OM and SCM web servers authenticate requests only when HTTP Kerberos
(SPNEGO) is enabled, that is {{ozone.security.http.kerberos.enabled=true}}
together with {{ozone.om.http.auth.type=kerberos}} or
{{hdds.scm.http.auth.type=kerberos}}. Both are off by default, also when
{{ozone.security.enabled=true}}.
The DB checkpoint endpoints (OM {{/dbCheckpoint}} and {{/v2/dbCheckpoint}}, SCM
{{/dbCheckpoint}}) serve a copy of the metadata DB and are restricted to
administrators. That check needs an authenticated caller, so it is applied only
with SPNEGO. Neither the docs nor the config descriptions say so.
Proposed changes, documentation only:
* Website (ozone-site), "Configuring HTTP authentication using Kerberos SPNEGO"
page: state that without SPNEGO the admin check of the DB checkpoint endpoints
is not applied, and that operators of a secure cluster should enable SPNEGO for
OM and SCM or restrict network access to their HTTP ports.
* {{ozone-default.xml}}: add the same note to the descriptions of
{{ozone.om.http.auth.type}} and {{hdds.scm.http.auth.type}}, and note that
{{kerberos}} takes effect only when {{ozone.security.http.kerberos.enabled}} is
true.
* {{THREAT_MODEL.md}}: list HTTP authentication among the controls that are off
by default, and add it to the operator hardening checklist.
No behavior change.
was:
The OM and SCM web servers authenticate requests only when HTTP Kerberos
(SPNEGO) is enabled, that is {{ozone.security.http.kerberos.enabled=true}}
together with {{ozone.om.http.auth.type=kerberos}} or
{{hdds.scm.http.auth.type=kerberos}}. Both are off by default, also when
{{ozone.security.enabled=true}}.
The DB checkpoint endpoints (OM {{/dbCheckpoint}} and {{/v2/dbCheckpoint}}, SCM
{{/dbCheckpoint}}) serve a copy of the metadata DB and are restricted to
administrators. That check needs an authenticated caller, so it is applied only
with SPNEGO. Neither the docs nor the config descriptions say so.
Proposed changes, documentation only:
* {{SecuringOzoneHTTP.md}}: state that without SPNEGO the admin check of the DB
checkpoint endpoints is not applied, and that operators of a secure cluster
should enable SPNEGO for OM and SCM or restrict network access to their HTTP
ports.
* {{ozone-default.xml}}: add the same note to the descriptions of
{{ozone.om.http.auth.type}} and {{hdds.scm.http.auth.type}}, and note that
{{kerberos}} takes effect only when {{ozone.security.http.kerberos.enabled}} is
true.
* {{THREAT_MODEL.md}}: list HTTP authentication among the controls that are off
by default, and add it to the operator hardening checklist.
No behavior change.
> Document that DB checkpoint endpoints are not authenticated without SPNEGO
> --------------------------------------------------------------------------
>
> Key: HDDS-16759
> URL: https://issues.apache.org/jira/browse/HDDS-16759
> Project: Apache Ozone
> Issue Type: Improvement
> Components: documentation
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
> Labels: pull-request-available
>
> The OM and SCM web servers authenticate requests only when HTTP Kerberos
> (SPNEGO) is enabled, that is {{ozone.security.http.kerberos.enabled=true}}
> together with {{ozone.om.http.auth.type=kerberos}} or
> {{hdds.scm.http.auth.type=kerberos}}. Both are off by default, also when
> {{ozone.security.enabled=true}}.
> The DB checkpoint endpoints (OM {{/dbCheckpoint}} and {{/v2/dbCheckpoint}},
> SCM {{/dbCheckpoint}}) serve a copy of the metadata DB and are restricted to
> administrators. That check needs an authenticated caller, so it is applied
> only with SPNEGO. Neither the docs nor the config descriptions say so.
> Proposed changes, documentation only:
> * Website (ozone-site), "Configuring HTTP authentication using Kerberos
> SPNEGO" page: state that without SPNEGO the admin check of the DB checkpoint
> endpoints is not applied, and that operators of a secure cluster should
> enable SPNEGO for OM and SCM or restrict network access to their HTTP ports.
> * {{ozone-default.xml}}: add the same note to the descriptions of
> {{ozone.om.http.auth.type}} and {{hdds.scm.http.auth.type}}, and note that
> {{kerberos}} takes effect only when {{ozone.security.http.kerberos.enabled}}
> is true.
> * {{THREAT_MODEL.md}}: list HTTP authentication among the controls that are
> off by default, and add it to the operator hardening checklist.
> No behavior change.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
