Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-27246

Implement a method to add IPs to allowlist for Galera Cluster node addresses that can make SST/IST requests

    XMLWordPrintable

    Details

      Description

      Currently, as long as a node has access to Galera Cluster's TCP ports, it is allowed to make SST/IST requests. In general, no authentication is performed.

      Current Security Methods

      Currently, there are basically two ways to prevent an unauthorized node from making SST/IST requests:

      1.) Use firewall rules to prevent unauthorized hosts from accessing the Galera Cluster ports.

      https://mariadb.com/kb/en/library/configuring-mariadb-galera-cluster/#network-ports

      2.) Configure your nodes to require TLS with certificate validation. This would have to be done separately for SSTs and ISTs.

      For mariabackup SSTs, there is some information about how to configure TLS here:

      https://mariadb.com/kb/en/library/mariabackup-sst-method/#tls

      For rsync SSTs, there is some information about how to configure TLS here:

      https://mariadb.com/kb/en/library/introduction-to-state-snapshot-transfers-ssts/#rsync

      For ISTs, there is some information about how to configure TLS here:

      https://mariadb.com/kb/en/library/securing-communications-in-galera-cluster/#securing-galera-cluster-replication-traffic

      New Requested SST/IST Allowlist

      Some users do not think that any of the current methods are sufficient. They would like MariaDB to implement some method that can be used to allowlist the addresses that are allowed to make SST/IST requests.

      How could this be implemented?

      Introduced a new variable called wsrep_allowlist to store Galera node IPs in the cluster. If the joiner node IP is not in the wsrep_allowlist, the Galera cluster will not allow the joiner node to join the cluster. This will help prevent unauthorized access to the cluster

      The most intuitive method would probably be to treat wsrep_cluster_address as a allowlist of the addresses that can make SST/IST requests., This system variable is already used to configure the addresses of the nodes in the cluster, so it would work out-of-the-box for most users.

      -https://mariadb.com/kb/en/library/galera-cluster-system-variables/#wsrep_cluster_address-

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              jplindst Jan Lindström
              Reporter:
              GeoffMontee Geoff Montee
              Votes:
              3 Vote for this issue
              Watchers:
              7 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.