Mailing-List: contact user-help@zookeeper.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@zookeeper.apache.org
Received-SPF: pass (nike.apache.org: domain of juergen.wagner@devoteam.com
 designates 209.85.192.51 as permitted sender)
Message-ID: <541BCE98.4090808@devoteam.com>
Date: Fri, 19 Sep 2014 08:35:04 +0200
From: =?UTF-8?B?IkrDvHJnZW4gV2FnbmVyIChEVlQpIg==?=
 <juergen.wagner@devoteam.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
 rv:31.0) Gecko/20100101 Thunderbird/31.1.1
MIME-Version: 1.0
To: user@zookeeper.apache.org
Subject: Re: authorize and authenticate zookeeper nodes
References: <1411009659613-7580303.post@n2.nabble.com>
 <C2496325850AA74C92AAF83AA9662D26458D64C2@szxeml561-mbx.china.huawei.com>
In-Reply-To: 
 <C2496325850AA74C92AAF83AA9662D26458D64C2@szxeml561-mbx.china.huawei.com>
Content-Type: multipart/mixed;
 boundary="------------000100040809050704060301"

--------------000100040809050704060301
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit

Sucheta,
  depending on what you have in mind, you could use the ACL mechanism of
Zookeeper right away, or augment it by additional measures outside
Zookeeper.

Unfortunately, Zookeeper still does not support client authentication on
the connection level, not does it have SSL for the ensemble-internal
connections. I do hope it will soon be on the radar of the Zookeeper
maintainers, so I can drop some other measures employed currently.

For some cases, you may want to generally restrict the access to
Zookeeper to certain IP addresses and then apply per-user ACLs for
individual znodes. In that case, I suggest you use a wrapper around
Zookeeper or a decent firewall to provide basic IP-address filtering, in
combination with the described ACL scheme. IP filtering (unless there
really is a wide variety of permitted addresses across all znodes)
inside Zookeeper does not seem like a good idea to me.

Otherwise, your Zookeeper won't be safe against DOS attacks or overloads
from too many requests (that may be denied, but still keep Zookeeper busy).

Also, the communication between Zookeeper services is not encrypted.
Therefore, the vanilla Zookeeper setup is not at all suited for any open
network. Consequently, you would have that firewall in front of the
subnet with Zookeepers, anyway. Why not employ a basic filtering there
already?

Cheers,
--Jürgen


--------------000100040809050704060301--