Never mind.... The issue was that I need to add authentication for kafka-acls.sh, it then create the znode with the correct permissions.
Thanks, Rob kafka-acls.sh AUTH_JVM_OPTS=" -Djava.security.auth.login.config=/opt/kafka/security/kafka_client_jaas.conf " exec $(dirname $0)/kafka-run-class.sh $AUTH_JVM_OPTS kafka.admin.AclCommand "$@" On Thu, Mar 30, 2017 at 12:24 PM, Rob Anderson <[email protected]> wrote: > Hello, > > I've implemented Authentication using SASL/Kerberos, on > kafka_2.12-0.10.2.0. Everything is working fine, however, I've noticed > that the kafka-acl znode is world readable / writable. So, couldn't anyone > just bypass security by modifying the znode via zookeeper, granting their > principle access to a given topic? You could also just delete the znode, > which would remove all of the defined acls. > > I do see permissions are proper on other znodes, for example > /brokers/topics/__consumer_offsets. Am I missing something? Are admins > manually tweaking permissions on the kafka-acl znode, to prevent this? > Any information you can offer is appreciated. > > Thanks, > > Rob > Acl set: > > [zk: kafka01.hadoop.test.com(CONNECTED) 15] getAcl /kafka-acl > > 'world,'anyone > > : cdrwa > > > [zk: kafka01.hadoop.test.com(CONNECTED) 22] getAcl > /brokers/topics/__consumer_offsets > > 'world,'anyone > > : r > > 'sasl,'[email protected] > > : cdrwa > > > >
