kafka-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From ij...@apache.org
Subject kafka-site git commit: Minor security and streams documentation updates from Kafka's 0.10.0 branch
Date Mon, 08 Aug 2016 15:46:03 GMT
Repository: kafka-site
Updated Branches:
  refs/heads/asf-site 37e8deb8f -> 8f55a94ed


Minor security and streams documentation updates from Kafka's 0.10.0 branch


Project: http://git-wip-us.apache.org/repos/asf/kafka-site/repo
Commit: http://git-wip-us.apache.org/repos/asf/kafka-site/commit/8f55a94e
Tree: http://git-wip-us.apache.org/repos/asf/kafka-site/tree/8f55a94e
Diff: http://git-wip-us.apache.org/repos/asf/kafka-site/diff/8f55a94e

Branch: refs/heads/asf-site
Commit: 8f55a94eddba1e311104cb538d46b854abdfeff8
Parents: 37e8deb
Author: Ismael Juma <ismael@juma.me.uk>
Authored: Mon Aug 8 16:45:44 2016 +0100
Committer: Ismael Juma <ismael@juma.me.uk>
Committed: Mon Aug 8 16:45:44 2016 +0100

----------------------------------------------------------------------
 0100/security.html | 22 ++++++++++++++++++++--
 0100/streams.html  |  2 +-
 2 files changed, 21 insertions(+), 3 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/kafka-site/blob/8f55a94e/0100/security.html
----------------------------------------------------------------------
diff --git a/0100/security.html b/0100/security.html
index 2459f54..0bd5f87 100644
--- a/0100/security.html
+++ b/0100/security.html
@@ -45,8 +45,26 @@ Apache Kafka allows clients to connect over SSL. By default SSL is disabled
but
             <li>keystore: the keystore file that stores the certificate. The keystore
file contains the private key of the certificate; therefore, it needs to be kept safely.</li>
             <li>validity: the valid time of the certificate in days.</li>
         </ol>
-        Ensure that common name (CN) matches exactly with the fully qualified domain name
(FQDN) of the server. The client compares the CN with the DNS domain name to ensure that it
is indeed connecting to the desired server, not the malicious one.</li>
-
+        <br>
+	Note: By default the property <code>ssl.endpoint.identification.algorithm</code>
is not defined, so hostname verification is not performed. In order to enable hostname verification,
set the following property:
+
+	<pre>	ssl.endpoint.identification.algorithm=HTTPS </pre>
+
+	Once enabled, clients will verify the server's fully qualified domain name (FQDN) against
one of the following two fields:
+	<ol>
+		<li>Common Name (CN)
+		<li>Subject Alternative Name (SAN)
+	</ol>
+	<br>
+	Both fields are valid, RFC-2818 recommends the use of SAN however. SAN is also more flexible,
allowing for multiple DNS entries to be declared. Another advantage is that the CN can be
set to a more meaningful value for authorization purposes. To add a SAN field  append the
following argument <code> -ext SAN=DNS:{FQDN} </code> to the keytool command:
+	<pre>
+	keytool -keystore server.keystore.jks -alias localhost -validity {validity} -genkey -ext
SAN=DNS:{FQDN}
+	</pre>
+	The following command can be run afterwards to verify the contents of the generated certificate:
+	<pre>
+	keytool -list -v -keystore server.keystore.jks
+	</pre>
+    </li>
     <li><h4><a id="security_ssl_ca" href="#security_ssl_ca">Creating your
own CA</a></h4>
         After the first step, each machine in the cluster has a public-private key pair,
and a certificate to identify the machine. The certificate, however, is unsigned, which means
that an attacker can create such a certificate to pretend to be any machine.<p>
         Therefore, it is important to prevent forged certificates by signing them for each
machine in the cluster. A certificate authority (CA) is responsible for signing certificates.
CA works likes a government that issues passports—the government stamps (signs) each passport
so that the passport becomes difficult to forge. Other governments verify the stamps to ensure
the passport is authentic. Similarly, the CA signs the certificates, and the cryptography
guarantees that a signed certificate is computationally difficult to forge. Thus, as long
as the CA is a genuine and trusted authority, the clients have high assurance that they are
connecting to the authentic machines.

http://git-wip-us.apache.org/repos/asf/kafka-site/blob/8f55a94e/0100/streams.html
----------------------------------------------------------------------
diff --git a/0100/streams.html b/0100/streams.html
index 91fda36..8231975 100644
--- a/0100/streams.html
+++ b/0100/streams.html
@@ -301,7 +301,7 @@ based on them.
     KTable<Windowed<String>, Long> counts = source1.aggregateByKey(
         () -> 0L,  // initial value
         (aggKey, value, aggregate) -> aggregate + 1L,   // aggregating value
-        HoppingWindows.of("counts").with(5000L).every(1000L), // intervals in milliseconds
+        TimeWindows.of("counts",5000L).advanceBy(1000L), // intervals in milliseconds
     );
 
     KStream<String, String> joined = source1.leftJoin(source2,


Mime
View raw message