diff --git a/hetu-docs/en/index.md b/hetu-docs/en/index.md index 782b6e265..e991e8c59 100644 --- a/hetu-docs/en/index.md +++ b/hetu-docs/en/index.md @@ -26,6 +26,7 @@ headless: true - [Built-in System Access Control]({{< relref "./docs/security/built-in-system-access-control.md" >}}) - [Secure Internal Communication]({{< relref "./docs/security/internal-communication.md" >}}) - [Password Encryption]({{< relref "./docs/security/password-encryption.md" >}}) + - [HAZELCAST Authentication]({{< relref "./docs/security/hazelcast.md" >}}) - [Administration]("#") - [Web Interface]({{< relref "./docs/admin/web-interface.md" >}}) - [Tuning openLooKeng]({{< relref "./docs/admin/tuning.md" >}}) diff --git a/hetu-docs/en/security/hazelcast.md b/hetu-docs/en/security/hazelcast.md new file mode 100644 index 000000000..87f9b9811 --- /dev/null +++ b/hetu-docs/en/security/hazelcast.md @@ -0,0 +1,104 @@ + +Hazelcast安全 +=================================== + +Hazelcast is embedded in the openLooKeng. When hazelcast is used in openLooKeng, in order to ensure the communication +security between the client and the server of hazelcast, as well as between the members of each server, +It is recommended to enable hazelcast authentication and SSL/TLS channel encryption. + +## Hazelcast Authentication + +Hazelcast only supports Kerberos authentication. Because the hazelcast is used by state-store module, so user wants to +enable Hazelcast authentication, the state-store has to enable first. + +When state-store enabled, add the following configuration in the state-store.properties: + +> ```properties +> hazelcast.kerberos.enable=true +> hazelcast.kerberos.login.context.name=Hazelcast +> hazelcast.kerberos.service.principal=openlookeng +> hazelcast.kerberos.krb5.conf=/etc/krb5.conf +> hazelcast.kerberos.auth.login.config=/etc/jaas.conf +> ``` + +| Property | Description | +| :--------------------------------------------------- | :----------------------------------------------------------- | +| `hazelcast.kerberos.enable` | Enable Hazelcast authentication, the default value is `false`.| +| `hazelcast.kerberos.login.context.name` | The context name to login the kerberos.| +| `hazelcast.kerberos.service.principal` | The service principal name of kerberos| +| `hazelcast.kerberos.krb5.conf` | The location of the Kerberos configuration file.| +| `hazelcast.kerberos.auth.login.config` |The location of the configuration file to login the kerberos| + +The format of the configuration file `jass.conf` to login the kerberos is as the following. User has to create a +principal in the kerberos first and configure the principal and the keytab. + +> ```properties +> Hazelcast { +> com.sun.security.auth.module.Krb5LoginModule required +> useKeyTab=true +> principal="openlookeng" +> keyTab="/etc/openlookeng.keytab" +> useTicketCache=false +> storeKey=true; +> }; +> ``` + +| Property | Description | +| :--------------------------------------------------- | :----------------------------------------------------------- | +| `principal` | The principal name to login the Kerberos| +| `keyTab` | The location of the keytab that can be used to authenticate the Kerberos principal.| + + +Note + +All of the nodes must use the same configuration, including the kerberos principal and keytab. + + +## Hazelcast SSL/TLS + +SSL/TLS is configured in the `state-store.properties`. The same configuration is used on all nodes that need to use +state store. After SSL/TLS is enabled, nodes that have not been configured SSL/ TLS is or configured incorrectly, will not be +able to communicate with other nodes. + +To enable SSL/TLS for Hazelcast, do the following: + +1. Generate Java keystore file. You can use the fully-qualified host name of each host to create a unique certificate +for each node, which contains the key store of all public keys of all hosts, and provides a specifies the keystore. +In most cases, it is more convenient to use wildcards to create certificates, as follows: + + > ``` + > keytool -genkeypair -alias openLooKeng -keyalg EC -keysize 256 -validity 365 -keystore keystore.jks -storepass + > What is your first and last name? + > [Unknown]: *.example.com + > What is the name of your organizational unit? + > [Unknown]: + > What is the name of your organization? + > [Unknown]: + > What is the name of your City or Locality? + > [Unknown]: + > What is the name of your State or Province? + > [Unknown]: + > What is the two-letter country code for this unit? + > [Unknown]: + > Is CN=*.example.com, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown correct? + > [no]: yes + > + > Enter key password for + > (RETURN if same as keystore password): + > ``` + > + +2. Distribute the Java keystore file to other nodes. +3. Enable the SSL/TLS of Hazelcast in `state-store.properties`. + + > ``` + > hazelcast.ssl.enabled=true + > hazelcast.ssl.keystore.path= + > hazelcast.ssl.keystore.password= + > hazelcast.ssl.cipher.suites= + > hazelcast.ssl.protocols= + > ``` + > Suggested cipher suite is TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256. + > + > Suggested ssl protocol is TLS1.2 or TLS1.3. + diff --git a/hetu-docs/zh/index.md b/hetu-docs/zh/index.md index 5c6e66799..fb6e58f99 100644 --- a/hetu-docs/zh/index.md +++ b/hetu-docs/zh/index.md @@ -26,6 +26,7 @@ headless: true - [内置系统访问控制]({{< relref "./docs/security/built-in-system-access-control.md" >}}) - [内部通信安全]({{< relref "./docs/security/internal-communication.md" >}}) - [密码加密]({{< relref "./docs/security/password-encryption.md" >}}) + - [HAZELCAST认证]({{< relref "./docs/security/hazelcast.md" >}}) - [管理]("#") - [Web界面]({{< relref "./docs/admin/web-interface.md" >}}) - [openLooKeng调优]({{< relref "./docs/admin/tuning.md" >}}) diff --git a/hetu-docs/zh/security/hazelcast.md b/hetu-docs/zh/security/hazelcast.md new file mode 100644 index 000000000..7d4da7d9f --- /dev/null +++ b/hetu-docs/zh/security/hazelcast.md @@ -0,0 +1,96 @@ + +Hazelcast安全 +=================================== +Hazelcast是内嵌在openLooKeng进程中，在openLooKeng中使用Hazelcast时，为了保障Hazelcast的客户端与服务端，以及各个服务端成员之间的通信安全， +建议开启Hazelcast的认证与SSL/TLS通道加密。 + +## Hazelcast认证 +Hazelcast当前只支持Kerberos认证。由于Hazelcast是由state-store模块调用，因此开启Hazelcast认证，需先启用state-store。 + + +state-store启用后，在state-store的配置文件state-store.properties中增加如下配置： + +> ```properties +> hazelcast.kerberos.enable=true +> hazelcast.kerberos.login.context.name=Hazelcast +> hazelcast.kerberos.service.principal=openlookeng +> hazelcast.kerberos.krb5.conf=/etc/krb5.conf +> hazelcast.kerberos.auth.login.config=/etc/jaas.conf +> ``` + +| 属性 | 描述 | +| :--------------------------------------------------- | :----------------------------------------------------------- | +| `hazelcast.kerberos.enable` | 为Hazelcast开启Kerberos认证功能。默认设置为`false`。| +| `hazelcast.kerberos.login.context.name` | 登陆Kerberos的context名。| +| `hazelcast.kerberos.service.principal` | Hazelcast的Kerberos服务主体名。| +| `hazelcast.kerberos.krb5.conf` | kerberos配置文件所在的位置。 | +| `hazelcast.kerberos.auth.login.config` |登陆Kerberos配置文件所在的位置。| + + +登陆Kerberos配置文件jaas.conf格式如下，配置时需先在Kerberos创建机机用户，并将创建的用户的principal，keytab按照如下格式配置 + +> ```properties +> Hazelcast { +> com.sun.security.auth.module.Krb5LoginModule required +> useKeyTab=true +> principal="openlookeng" +> keyTab="/etc/openlookeng.keytab" +> useTicketCache=false +> storeKey=true; +> }; +> ``` + +| 属性 | 描述 | +| :--------------------------------------------------- | :----------------------------------------------------------- | +| `principal` | 登陆Kerberos的主体名。| +| `keyTab` | 登陆Kerberos主体进行身份验证的keytab文件的位置。| + + +注意： +所有节点的配置文件相同，包括机机用户的principal，ketTab。 + +## Hazelcast SSL/TLS + +在`state-store.properties`文件中进行SSL/TLS配置。所有需要使用state-store的节点上均采用相同的配置。开启SSL/TLS后，未配置SSL/TLS或配置错 +误的节点将无法与其他节点进行通信。 + +为了Hazelcast通信启用SSL/TLS功能，需要执行以下步骤： +1. 生成Java密钥库文件。可以使用每台主机的fully-qualified主机名为每个节点创建唯一的证书，创建时包含所有主机的所有公钥的密钥库，并为客户端 +指定密钥库。在大多数情况下，使用通配符进行证书的创建更加方便，如下所示： + + > ``` + > keytool -genkeypair -alias openLooKeng -keyalg EC -keysize 256 -validity 365 -keystore keystore.jks -storepass + > What is your first and last name? + > [Unknown]: *.example.com + > What is the name of your organizational unit? + > [Unknown]: + > What is the name of your organization? + > [Unknown]: + > What is the name of your City or Locality? + > [Unknown]: + > What is the name of your State or Province? + > [Unknown]: + > What is the two-letter country code for this unit? + > [Unknown]: + > Is CN=*.example.com, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown correct? + > [no]: yes + > + > Enter key password for + > (RETURN if same as keystore password): + > ``` + > + +2. 将Java keystore文件分发到其他节点上。 +3. 在`state-store.properties`配置启用SSL/TLS。 + + > ``` + > hazelcast.ssl.enabled=true + > hazelcast.ssl.keystore.path= + > hazelcast.ssl.keystore.password= + > hazelcast.ssl.cipher.suites= + > hazelcast.ssl.protocols= + > ``` + > 推荐的加密套件为TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + > + > 推荐的SSL协议为TLS1.2或TLS1.3 +