zookeeper digest + acl
server-server
每个zookeeper节点都要配置
- 在zoo.cfg下添加
quorum.auth.enableSasl=true
quorum.auth.learnerRequireSasl=true
quorum.auth.serverRequireSasl=true
quorum.auth.learner.saslLoginContext=QuorumLearner
quorum.auth.server.saslLoginContext=QuorumServer
quorum.cnxn.threads.size=20
- 编写jaas.conf
QuorumServer {
org.apache.zookeeper.server.auth.DigestLoginModule required
user_admin="admin";
};
QuorumLearner {
org.apache.zookeeper.server.auth.DigestLoginModule required
username="admin"
password="123456";
};
- 在conf下创建java.env并指定jaas.conf：
SERVER_JVMFLAGS="-Djava.security.auth.login.config=/mnt/e/libs/zookeeper/zk1/zk/conf/jaas.conf"
client-server
server
每个zookeeper节点都要配置
- 在zoo.cfg下添加
authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider
- 编写jaas.conf
Server {
org.apache.zookeeper.server.auth.DigestLoginModule required
user_hello="123456";
};
- 在conf下创建java.env并指定jaas.conf：
SERVER_JVMFLAGS="-Djava.security.auth.login.config=/mnt/e/libs/zookeeper/zk1/zk/conf/jaas.conf"
client
选择一个zookeeper节点配置
- 编写jaas.conf
Client {
org.apache.zookeeper.server.auth.DigestLoginModule required
username="hello"
password="123456";
};
- 在conf下创建java.env并指定jaas.conf：
CLIENT_JVMFLAGS="-Djava.security.auth.login.config=/mnt/e/libs/zookeeper/zk1/zk/conf/jaas.conf"
- 执行 zkCli.sh
WatchedEvent state:SaslAuthenticated type:None path:null
表示sasl认证成功 创建一个节点
create /t ni sasl:hello:cdrwa
getAcl /t
在另一个没有配置client的节点执行zkCli.sh并删除该节点
[zk: localhost:2181(CONNECTED) 22] get /t
org.apache.zookeeper.KeeperException$NoAuthException: KeeperErrorCode = NoAuth for /t
[zk: localhost:2181(CONNECTED) 23] set /t a
Authentication is not valid : /t
[zk: localhost:2181(CONNECTED) 24] create /t/t
Authentication is not valid : /t/t
[zk: localhost:2181(CONNECTED) 25] rmr /t
The command 'rmr' has been deprecated. Please use 'deleteall' instead.
Authentication is not valid : /t
kafka连接zk
- server.properties添加
zookeeper.set.acl=true
- 编写jaas.conf
Client {
org.apache.zookeeper.server.auth.DigestLoginModule required
username="hello"
password="123456";
};
- 指定jaas.conf 在bin/kafka-run-class.sh第一行添加
export KAFKA_AUTH_OPTS=" -Djava.security.auth.login.config=/mnt/e/libs/kafka/kafka/010/1/config/jaas.conf"
在启动命令中指定KAFKA_AUTH_OPTS
if [ "x$DAEMON_MODE" = "xtrue" ]; then
nohup $JAVA $KAFKA_HEAP_OPTS $KAFKA_JVM_PERFORMANCE_OPTS $KAFKA_GC_LOG_OPTS $KAFKA_JMX_OPTS $KAFKA_LOG4J_OPTS $KAFKA_AUTH_OPTS -cp $CLASSPATH $KAFKA_OPTS "$@" > "$CONSOLE_OUTPUT_FILE" 2>&1 < /dev/null &
else
exec $JAVA $KAFKA_HEAP_OPTS $KAFKA_JVM_PERFORMANCE_OPTS $KAFKA_GC_LOG_OPTS $KAFKA_JMX_OPTS $KAFKA_LOG4J_OPTS $KAFKA_AUTH_OPTS -cp $CLASSPATH $KAFKA_OPTS "$@"
fi
- 查看kafka创建的节点均已添加了acl
