Copilot commented on code in PR #401: URL: https://github.com/apache/ozone-site/pull/401#discussion_r4353626964
########## docs/03-core-concepts/04-security/00-security-model.md: ########## @@ -0,0 +1,70 @@ +--- +sidebar_label: Security model +--- + +# Ozone security model + +This page summarizes the security assumptions, trust boundaries, and guarantees of Apache Ozone for administrators and users. The project's [threat model](https://github.com/apache/ozone/blob/master/THREAT_MODEL.md) defines the security properties and scope used to evaluate vulnerability reports. It evolves with the project; reports against a released version are evaluated against the model for that version. + +For configuration instructions, see the [Security](../../administrator-guide/configuration/security) section of the Administrator Guide. For individual mechanisms, see [Kerberos](./kerberos), [Native ACLs](./acls/native-acls), [Ranger ACLs](./acls/ranger-acls), and [Users and groups](./users-and-groups). + +## Secure mode and separate controls + +**Secure mode (`ozone.security.enabled=true`) is the supported production posture.** Non-secure mode provides no authentication and is intended for development and sandbox clusters. In secure mode, the S3 Gateway rejects anonymous access and verifies requests using AWS Signature Version 4 and the user's S3 secret. + +Enabling secure mode does not enable every security control. Operators must configure the controls needed for their deployment: + +- **Object authorization:** `ozone.acl.enabled` defaults to `false`. When enabled, Native ACLs are the default authorizer; Ranger is an alternative configured through `ozone.acl.authorizer.class`. S3 multi-tenancy requires Ranger. +- **Block and container access:** `hdds.block.token.enabled` and `hdds.container.token.enabled` default to `false`. Enable them to require valid tokens on the corresponding Datanode access paths. +- **RPC service authorization:** `hadoop.security.authorization` defaults to `false`. When enabled, protocol service ACLs default to `*` and must be restricted to the intended users and groups. These are separate from volume, bucket, and key ACLs. +- **Transport encryption:** Configure Hadoop RPC privacy, gRPC TLS, and HTTPS for the relevant paths. Authentication alone does not encrypt traffic; `hdds.grpc.tls.enabled` defaults to `false`. +- **Data encryption:** Transparent Data Encryption (TDE) is optional and protects data in encrypted buckets using keys managed by an external Key Management Service (KMS). See [bucket encryption](../namespace/buckets/encryption). +- **Web authentication:** HTTP authentication (SPNEGO) is disabled by default. Enable it for the OM and SCM web servers, or isolate their HTTP ports. Their DB checkpoint endpoints expose the metadata database and, with default HTTP authentication settings, are served without an administrator check. Review Comment: This is a high-impact security warning (metadata DB exposure) and would be easy to miss inside a bullet list. Consider turning this into a dedicated admonition/callout (e.g., `:::caution`) and naming the concrete endpoint(s) (paths) plus the exact config knobs/operators should use to secure/disable them. That makes the risk and mitigation unambiguous and reduces the chance of accidental insecure deployments. ########## docs/03-core-concepts/04-security/00-security-model.md: ########## @@ -0,0 +1,70 @@ +--- +sidebar_label: Security model +--- + +# Ozone security model + +This page summarizes the security assumptions, trust boundaries, and guarantees of Apache Ozone for administrators and users. The project's [threat model](https://github.com/apache/ozone/blob/master/THREAT_MODEL.md) defines the security properties and scope used to evaluate vulnerability reports. It evolves with the project; reports against a released version are evaluated against the model for that version. Review Comment: These links point at `master`, but this doc also explains that reports should be evaluated against the threat model for the *released version*. On versioned docs pages, pointing to `master` can be misleading. Consider either (a) linking to a stable permalink (tag/commit) matching the docs version, or (b) explicitly noting that the GitHub links target the development branch and readers should consult the threat model/security policy for their release tag. ########## docs/03-core-concepts/04-security/README.mdx: ########## @@ -6,6 +6,6 @@ sidebar_label: Security import DocCardList from '@theme/DocCardList'; -This section documents the primary mechanisms Ozone uses for authentication and authorization of users and administrators. To configure encryption and other security mechanisms within an Ozone cluster, see the [Administrator Guide](../../administrator-guide/configuration/security). +This section documents the primary mechanisms Ozone uses for authentication and authorization of users and administrators. For trust boundaries, assumptions, and what Ozone does **not** try to guarantee, read [Security model](./security-model) first. To configure encryption and other security mechanisms within an Ozone cluster, see the [Administrator Guide](../../administrator-guide/configuration/security). Review Comment: This paragraph is doing three different jobs (section purpose, a strong ‘read first’ prerequisite, and a config pointer) in one long line, which makes it hard to scan on the category landing page. Consider splitting it into two sentences/paragraphs (or a short bullet list) so the ‘read Security model first’ guidance is more prominent and the Admin Guide link remains easy to find. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
