Securing a cluster

classic Classic list List threaded Threaded
8 messages Options
pgarg pgarg
Reply | Threaded
Open this post in threaded view
|

Securing a cluster

asked by steve neal

I can't see any documentation on security for Ignite.

I'd like (at least) to be able to ensure that I don't accidentally connect to prod when developing. Currently, if I accidentally load the wrong config files at start-up, this could happen.

Is there a way to whitelist the servers that can join a cluster?

Thanks, Steve.

-----
This post is migrated from now discontinued Apache Ignite forum at
http://apacheignite.readme.io/v1.0/discuss
pgarg pgarg
Reply | Threaded
Open this post in threaded view
|

Re: Securing a cluster

commented by dmitriy setrakyan

Actually, in your case I would turn off the Multicast-based IP Finder and use only TCP-based IP finder, which will allow you to specify all the IP addresses in your cluster. Please take a look at Static IP-based Discovery documentation.

-----
This post is migrated from now discontinued Apache Ignite forum at
http://apacheignite.readme.io/v1.0/discuss
pgarg pgarg
Reply | Threaded
Open this post in threaded view
|

Re: Securing a cluster

commented by steve neal

Hi Dimitry.

Our cluster is already configured to use I.P. discovery as our machines are not on the same sub-net. However, this is not sufficiently secure for our requirements as we work in a heavily audited industry.

For example, it is currently possible for a developer to releases a component in our test environment and accidentally configures it with a production I.P. address for discovery, their component would then unwittingly join the prod cluster from a test/development environment.

I've seen there are a lot of Security processors and a plugin mechanism that allows me to override the core services in the Kernal, but I do not know which of these to swap our to be able to implement a white-list policy. I've tried without much success at changing the GridSecurityProcessor. Am I looking in the right place? Is there a simpler approach? The plugins are quite complex.

Thanks.

-----
This post is migrated from now discontinued Apache Ignite forum at
http://apacheignite.readme.io/v1.0/discuss
pgarg pgarg
Reply | Threaded
Open this post in threaded view
|

Re: Securing a cluster

commented by dmitriy setrakyan

Steve,

I agree that plugins are quite involved. They are meant for other software to plug into Ignite and add features. Security is meant to be added that way.

For example, GridGain 7.0 which will be released in 2 weeks, will provide the security component on top of Ignite.

Having said that, I also find it a little unsafe that your production IPs are accessible from the staging environment. Is it possible to have a firewall in between?

-----
This post is migrated from now discontinued Apache Ignite forum at
http://apacheignite.readme.io/v1.0/discuss

pgarg pgarg
Reply | Threaded
Open this post in threaded view
|

Re: Securing a cluster

This post was updated on .
commented by steve neal

Hi Dimitry,

The segregation of staging and production environments is outside of my control. My client chooses to configure things this way and, in my experience, it is a very common set up.

I've managed to work my way through the plugin architecture and have now implemented an authentication mechanism that restricts the machines allowed to join the cluster to a white-list, as we needed.

If I get a chance, I'll write a blog entry to help others that might need to do this.

Cheers, Steve.

-----
This post is migrated from now discontinued Apache Ignite forum at
http://apacheignite.readme.io/v1.0/discuss
pgarg pgarg
Reply | Threaded
Open this post in threaded view
|

Re: Securing a cluster

commented by steve neal

I managed to get a bit of time free this afternoon and have written up how I implemented a white list security policy.

I hope this helps anyone with similar requirements.

Steve.

-----
This post is migrated from now discontinued Apache Ignite forum at
http://apacheignite.readme.io/v1.0/discuss
pgarg pgarg
Reply | Threaded
Open this post in threaded view
|

Re: Securing a cluster

commented by dmitriy setrakyan

Thanks for a very nice blog. I have also posted it on dzone: http://www.dzone.com/links/securing_an_apache_ignite_cluster.html

-----
This post is migrated from now discontinued Apache Ignite forum at
http://apacheignite.readme.io/v1.0/discuss

myset myset
Reply | Threaded
Open this post in threaded view
|

Re: Securing a cluster

This post has NOT been accepted by the mailing list yet.
In reply to this post by pgarg
Please add an update on your blog in order to match ignite-1.0.0