绕过kafka对端口9092的授权(明文)

Question

我想添加身份验证和授权，我的合流卡夫卡运行与码头。这应该只发生在端口9093,9092应该像以前一样工作，因为ip表规则阻塞了外部客户端的端口。因此，我使用了以下配置：

=> 9093 SASL_SSL

=> 9092明文

下面是我配置的一部分：

卡夫卡容器环境变量

  - KAFKA_ADVERTISED_LISTENERS=PLAINTEXT://my.host.ip:9092,SASL_SSL://my.host.ip:9093
  - KAFKA_ALLOW_EVERYONE_IF_NO_ACL_FOUND=false
  - KAFKA_SSL_CLIENT_AUTH=required
  - KAFKA_SECURITY_INTER_BROKER_PROTOCOL=SASL_SSL
  - KAFKA_SASL_MECHANISM_INTER_BROKER_PROTOCOL=PLAIN
  - KAFKA_SASL_ENABLED_MECHANISMS=PLAIN
  - KAFKA_AUTHORIZER_CLASS_NAME=kafka.security.authorizer.AclAuthorizer
  - KAFKA_SUPER_USERS="User:admin"
  - KAFKA_OPTS=-Djava.security.auth.login.config=/etc/kafka/secrets

动物园管理员容器环境变量

  - ZOOKEEPER_SERVERS=0.0.0.0:2888:3888;my.host.ip:2888:3888
  - ZOOKEEPER_SERVER_ID=1
  - ZOOKEEPER_CLIENT_PORT=2181
  - ZOOKEEPER_STANDALONE_ENABLED=false
  - ZOOKEEPER_DATA_DIR=/kafka/data
  - ZOOKEEPER_AUTH_PROVIDER_SASL=org.apache.zookeeper.server.auth.SASLAuthenticationProvider
  - KAFKA_OPTS=-Djava.security.auth.login.config=/etc/kafka/secrets/zookeeper_jaas.conf

由于我只想为SASL_SSL侦听器配置身份验证机制，所以我使用以下jaas，如下所述：https://docs.confluent.io/platform/current/kafka/authentication_sasl/index.html#recommended-broker-jaas-configuration。

kafka_jaas.config

KafkaServer {
listener.name.sasl_ssl.plain.sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required
  username="admin"
  password="admin"
  user_admin="admin"
};

Client {
org.apache.kafka.common.security.plain.PlainLoginModule required
 username="admin"
 password="admin";
};

zookeeper_jaas.config

Server {
       org.apache.zookeeper.server.auth.DigestLoginModule required
       user_admin="admin";
};

当我运行kafka时，会得到以下错误：

[main-SendThread(s415vm2140.detss.corpintra.net:2181)] WARN org.apache.zookeeper.ClientCnxn - SASL configuration failed: javax.security.auth.login.LoginException: Zookeeper client cannot authenticate using the 'Client' section of the supplied JAAS configuration: '/etc/kafka/secrets/kafka_jaas.conf' because of a RuntimeException: java.lang.SecurityException: java.io.IOException: Configuration Error:
    Line 2: expected [controlFlag] Will continue connection to Zookeeper server without SASL authentication, if Zookeeper server allows it.

如何实现客户端在连接到端口9092时不需要身份验证？

Answer 1

在这里阅读更多信息：https://docs.confluent.io/platform/current/security/zk-security.html

在kafka_jaas上，您将设置为使用摘要，将客户端设置为Plain

KafkaServer {
org.apache.kafka.common.security.plain.PlainLoginModule required
     username="admin"
      password="admin"
      user_admin="admin";
};

Client {
       org.apache.zookeeper.server.auth.DigestLoginModule required
       username="admin"
       password="admin";
};

在zookeeper_jaas中

Server {
   org.apache.zookeeper.server.auth.DigestLoginModule required
       username="admin"
       password="admin"
       user_admin="admin";
};

附注：1.listener.name.sasl_ssl.plain.sasl.jaas.config=在KafkaServer中是不正确的

“

”，“你失踪了”

这里还有一个使用Plain配置的示例

Kafka SASL zookeeper authentication