ETCD未授权访问风险安全漏洞修复方案
ETCD未授权访问风险介绍
未授权访问可能产生的风险为攻击者可以从ETCD中拿到节点的注册信息
http://IP:2379/v2/keys
http://IP:2379/v2/keys/?recursive=true
常规修复方案有以下两种:
- 方案一:基于角色认证的访问控制(BASIC认证)
- 方案二:基于ca证书的https访问控制(TLS传输)
简单点理解:
方案一就是添加用户密码认证,后续访问需要用户密码才能正常访问
方案二就是使用ca证书,将原先的http通信改成https,后续访问需要使用证书才能正常访问
备注:基于角色认证和ca证书的访问控制支持同时配置
基于角色认证的访问控制(BASIC认证)
sql
# 创建测试数据
etcdctl set /testkey testvalue
# 可直接查看测试数据
etcdctl ls
etcdctl get testkey
sql
# 创建root用户(etcd V2客户端版本输入密码间期时间很短,且只输入一次)
etcdctl user add root
# 启用认证
etcdctl auth enable
此处测试我们把root用户密码设置为root
sql
# 开启 Basic Auth 默认会启用拥有所有权限的两个角色 root 和 guest ,并默认用 guest 角色进行的操作,不能删除,得收回 guest 的权限进行限制
etcdctl --username root:password role revoke guest --path '/*' --rw
# 检查 guest 角色权限
etcdctl --username root:password role get guest
sql
# 再次查看测试数据失败,需要加上用户密码才能正常查看
etcdctl --username root:password get testkey
至此基于角色认证的访问控制配置结束,还是比较简单的。
基于ca证书的https访问控制(TLS传输)
下载cfssl认证配置工具
cfssl认证配置工具下载网址:https://github.com/cloudflare/cfssl
若github网站打不开或下载太慢可关注公众号「 钥道不止 」并于后台回复关键字: cfssl 获取X86和ARM架构版本的工具
sql
# X86 版本
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64
授予可执行权限并加入bin目录
sql
chmod +x cfssl*
cp -v cfssl_linux-amd64 /usr/local/bin/cfssl
cp -v cfssljson_linux-amd64 /usr/local/bin/cfssljson
cp -v cfssl-certinfo_linux-amd64 /usr/local/bin/cfssl-certinfo
ls /usr/local/bin/cfssl*
生成ca认证证书
有多个节点,ca证书的生成在任意节点上操作即可
sql
mkdir -p /etc/etcd/etcdSSL
cd /etc/etcd/etcdSSL
1)、创建 CA 配置文件(ca-config.json),可配置证书有效期(100年)
vi ca-config.json
sql
{
"signing": {
"default": {
"expiry": "876000h"
},
"profiles": {
"etcd": {
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
],
"expiry": "876000h"
}
}
}
}
字段说明:
- ca-config.json:可以定义多个 profiles,分别指定不同的过期时间、使用场景等参数;后续在签名证书时使用某个 profile;此处只定义一个etcd通用认证的profile
- signing:表示该证书可用于签名其它证书;生成的 ca.pem 证书中 CA=TRUE
- server auth:表示client可以用该CA对server提供的证书进行验证
- client auth:表示server可以用该CA对client提供的证书进行验证
2)、创建 CA 证书签名请求文件(ca-csr.json)
vi ca-csr.json
sql
{
"CN": "etcd",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "shenzhen",
"L": "shenzhen",
"O": "etcd",
"OU": "System"
}
]
}
字段说明:
- CN:Common Name,etcd 从证书中提取该字段作为请求的用户名 (User Name);浏览器使用该字段验证网站是否合法
- O:Organization,etcd 从证书中提取该字段作为请求用户所属的组 (Group)
3)、生成 CA 证书和私钥(ca-key.pem ca.pem)
sql
cfssl gencert -initca ca-csr.json | cfssljson -bare ca
4)、创建 etcd 证书签名请求(修改配置节点的IP)文件(etcd-csr.json)
vi etcd-csr.json
sql
{
"CN": "etcd",
"hosts": [
"127.0.0.1",
"192.168.56.101",
"192.168.56.102",
"192.168.56.103"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "shenzhen",
"L": "shenzhen",
"O": "etcd",
"OU": "System"
}
]
}
5)、生成 etcd 证书和私钥(etcd-key.pem etcd.pem)
sql
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=etcd etcd-csr.json | cfssljson -bare etcd
将生成的证书文件拷贝至其他节点:
sql
scp /etc/etcd/etcdSSL/*.pem 192.168.56.102:/etc/etcd/etcdSSL/
scp /etc/etcd/etcdSSL/*.pem 192.168.56.103:/etc/etcd/etcdSSL/
修改etcd配置
从官网的说明介绍可以看到这里有两种配置方式:用 --config-file 指定配置文件路径 或 用ETCD_CONFIG_FILE环境变量
https://etcd.io/docs/v3.5/op-guide/configuration/
方式一
配置 etcd 的 service 服务文件(修改3个节点IP、--name配置)
sql
[root@dba01 ~]# vi /usr/lib/systemd/system/etcd.service
[Unit]
Description=Etcd Server
After=network.target network-online.target
Wants=network-online.target
[Service]
Type=notify
# Environment="ETCD_UNSUPPORTED_ARCH=arm64" #Just for ARM
WorkingDirectory=/var/lib/etcd/
EnvironmentFile=-/etc/etcd/etcd.conf
# set GOMAXPROCS to number of processors
ExecStart=/usr/bin/etcd \
--name etcd01 \
--data-dir=/etc/etcd/etcd01 \
--initial-advertise-peer-urls https://192.168.56.101:2380 \
--listen-peer-urls https://192.168.56.101:2380 \
--listen-client-urls https://192.168.56.101:2379,http://127.0.0.1:2379 \
--advertise-client-urls https://192.168.56.101:2379 \
--initial-cluster-token etcd-cluster \
--initial-cluster etcd01=https://192.168.56.101:2380,etcd02=https://192.168.56.102:2380,etcd03=https://192.168.56.103:2380 \
--initial-cluster-state new \
--cert-file=/etc/etcd/etcdSSL/etcd.pem \
--key-file=/etc/etcd/etcdSSL/etcd-key.pem \
--peer-cert-file=/etc/etcd/etcdSSL/etcd.pem \
--peer-key-file=/etc/etcd/etcdSSL/etcd-key.pem \
--trusted-ca-file=/etc/etcd/etcdSSL/ca.pem \
--peer-trusted-ca-file=/etc/etcd/etcdSSL/ca.pem
Restart=on-failure
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target
方式二
配置 etcd 的 service 服务文件,采用 --config-file所有参数配置都从配置文件里读取
sql
[root@dba01 ~]# vi /usr/lib/systemd/system/etcd.service
[Unit]
Description=Etcd Server
After=network.target network-online.target
Wants=network-online.target
[Service]
Type=notify
# Environment="ETCD_UNSUPPORTED_ARCH=arm64" #Just for ARM
ExecStart=/usr/bin/etcd --config-file /etc/etcd/etcd.conf
Restart=on-failure
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target
在etcd原配置基础上追加如下ca证书 配置并调整网络协议http为https
sql
[root@dba01 ~]# cat /etc/etcd/etcd.conf
name: etcd01
data-dir: /etc/etcd/etcd01
initial-advertise-peer-urls: https://192.168.56.101:2380
listen-peer-urls: https://192.168.56.101:2380
listen-client-urls: https://192.168.56.101:2379,http://127.0.0.1:2379
advertise-client-urls: https://192.168.56.101:2379
initial-cluster-token: dcs-cluster
initial-cluster: etcd01=https://192.168.56.101:2380,etcd02=https://192.168.56.102:2380,etcd03=https://192.168.56.103:2380
enable-v2: true
initial-cluster-state: new
#[Security]
client-transport-security:
cert-file: /etc/etcd/etcdSSL/etcd.pem
key-file: /etc/etcd/etcdSSL/etcd-key.pem
client-cert-auth: true
trusted-ca-file: /etc/etcd/etcdSSL/ca.pem
peer-transport-security:
cert-file: /etc/etcd/etcdSSL/etcd.pem
key-file: /etc/etcd/etcdSSL/etcd-key.pem
client-cert-auth: true
trusted-ca-file: /etc/etcd/etcdSSL/ca.pem
若是已经运行过存在缓存的,需要先清理etcd缓存,三个节点都要清理(物理缓存文件清理后会导致方案一配置的角色认证失效,若要开启用户密码认证需重新操作上述步骤)
sql
rm -rf /etc/etcd/etcd0*
然后重启 etcd 服务
sql
systemctl daemon-reload
systemctl start etcd
systemctl status etcd
至此基于ca证书的https访问控制配置结束。
访问etcd节点信息
检查etcd集群服务的健康,不带证书将无法正常访问
sql
# 不带ca证书访问
etcdctl cluster-health
# 带ca证书访问
etcdctl \
--ca-file=/etc/etcd/etcdSSL/ca.pem \
--cert-file=/etc/etcd/etcdSSL/etcd.pem \
--key-file=/etc/etcd/etcdSSL/etcd-key.pem \
cluster-health
patroni使用配置调整
在PostgreSQL+etcd+patroni的高可用架构中,etcd开启访问控制后patroni得相应的做调整,期间涉及patronide重启,也就是涉及PostgreSQL数据库的重启,需要窗口时间操作
- 方案一:基于角色认证的访问控制(BASIC认证)
sql
# patroni
username: root
password: root
- 方案二:基于ca证书的https访问控制(TLS传输)
sql
chown -R postgres.postgres /etc/etcd/etcdSSL/*.pem
# patroni
protocol: https
cacert: /etc/etcd/etcdSSL/ca.pem
cert: /etc/etcd/etcdSSL/etcd.pem
key: /etc/etcd/etcdSSL/etcd-key.pem
patroni配置文件更新etcd的配置:
https://patroni.readthedocs.io/en/latest/yaml_configuration.html#etcd
sql
# 同时开启用户认证和ca证书的访问
etcdctl \
--ca-file=/etc/etcd/etcdSSL/ca.pem \
--cert-file=/etc/etcd/etcdSSL/etcd.pem \
--key-file=/etc/etcd/etcdSSL/etcd-key.pem \
--username root:root
cluster-health
参考链接
etcd 的实现原理:https://draveness.me/etcd-introduction/
RAFT协议工作原理:http://thesecretlivesofdata.com/raft/
etcd单台部署,启用https以及ca自签名:
https://cloud.tencent.com/developer/article/1441188
etcd多台部署,启用https以及ca自签名:
https://cloud.tencent.com/developer/article/1441194
etcd的配置参数:
https://github.com/etcd-io/etcd/blob/main/etcd.conf.yml.sample