Uploaded image for project: 'MariaDB MaxScale'
  1. MariaDB MaxScale
  2. MXS-1551

Ip white list for proxy

Details

    • New Feature
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Done
    • None
    • 2.2.0
    • mariadbmon
    • None

    Description

      Current MaxScale's Authentication mechanism has a limit, MaxScale's host should be added to every

      {Username, Password}

      tuple, as descriped in the Configuration Docments;

      If there is a ip white list mechanism, put MaxScale's host in the white list, Server Authentication skip those host in the list will let MaxScale be much easier to use, especially in cloud environment;

      Proposal:
      1. server privide a white ip list variable;
      2. In mysql monitor, after connected to backend, set host to the white list;

      Attachments

        Issue Links

          is blocked by

          Task - A task that needs to be done. MDEV-15501 Dynamic config `proxy_protocol_networks`

          • Major - Major loss of function.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            markus makela markus makela added a comment -

            Fixed in 10.3 when PROXY protocol is added.

            markus makela markus makela added a comment - Fixed in 10.3 when PROXY protocol is added.
            markus makela markus makela added a comment - - edited

            dapeng Can you check if the PROXY protocol (MDEV-11159) is something that would solve your problem?

            markus makela markus makela added a comment - - edited dapeng Can you check if the PROXY protocol ( MDEV-11159 ) is something that would solve your problem?
            dapeng dapeng huang added a comment -

            thanks it exactly what we need, but if MySQLMon can add host to @@GLOBAL.proxy_protocol_networks could be better, cause we may dynamically add or remove mxs nodes for a mysql cluster;

            dapeng dapeng huang added a comment - thanks it exactly what we need, but if MySQLMon can add host to @@GLOBAL.proxy_protocol_networks could be better, cause we may dynamically add or remove mxs nodes for a mysql cluster;
            markus makela markus makela added a comment -

            That's a slightly dangerous thing from a security perspective as it depends only on the authentication of the monitor user but it should be doable. This assumes that the MaxScale user has the permissions to add itself into the list of allowed proxied networks.

            markus makela markus makela added a comment - That's a slightly dangerous thing from a security perspective as it depends only on the authentication of the monitor user but it should be doable. This assumes that the MaxScale user has the permissions to add itself into the list of allowed proxied networks.
            markus makela markus makela added a comment -

            Closing this as Done since 2.2 implemented PROXY Protocol support. If you want MaxScale to automatically add itself to the list of proxied hosts, please open a separate feature request for it.

            markus makela markus makela added a comment - Closing this as Done since 2.2 implemented PROXY Protocol support. If you want MaxScale to automatically add itself to the list of proxied hosts, please open a separate feature request for it.

            People

              Unassigned Unassigned
              dapeng dapeng huang
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.