I agree, the behavior of ‘--dir’ is very different. You would need access to the locator host and sufficient OS privileges to stop the locator process and access the filesystem.
With ‘--name’ you are requesting the JMX manager perform a remote operation on your behalf, hence the need to secure the request. Anthony > On Jul 14, 2017, at 10:13 AM, Swapnil Bawaskar <[email protected]> wrote: > > Hi Barry, > Yes, it is intentional. stop locator --dir is an offline command (i.e. after > launching gfsh you do not have to connect to the locator). All offline > commands are not secured, because the user already has access to the > filesystem. > > Thanks! > > On Fri, Jul 14, 2017 at 10:05 AM Barry Wood <[email protected] > <mailto:[email protected]>> wrote: > Hi, > Setup user admin with CLUSTER:READ allowed operations. This prevents > gfsh>stop locator —name=locator1, Unauthorized. But, gfsh>stop locator > —dir=locator1 allows user to stop locator. Did not see any issue logged for > this. Is this intentional? > Best regards, > Barry Wood
