This is an automated email from the ASF dual-hosted git repository.
adoroszlai pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ozone.git
The following commit(s) were added to refs/heads/master by this push:
new 53179f8f8b6 HDDS-16759. Document that DB checkpoint endpoints are not
authenticated without SPNEGO (#11439)
53179f8f8b6 is described below
commit 53179f8f8b643ffd3332278b54d6caa7d0f8ed9e
Author: Siyao Meng <[email protected]>
AuthorDate: Fri Oct 9 13:30:49 2026 -0700
HDDS-16759. Document that DB checkpoint endpoints are not authenticated
without SPNEGO (#11439)
Co-authored-by: Claude Opus 5.5 <[email protected]>
---
THREAT_MODEL.md | 4 +++-
hadoop-hdds/common/src/main/resources/ozone-default.xml | 4 ++++
2 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/THREAT_MODEL.md b/THREAT_MODEL.md
index 60709a2654d..bbc943054b8 100644
--- a/THREAT_MODEL.md
+++ b/THREAT_MODEL.md
@@ -195,9 +195,10 @@ stock install and must be explicitly enabled:
Hadoop `AccessControlList`.)*
- **TDE/KMS** is optional and protects data at rest only for encrypted buckets;
it requires a configured KMS, for example via
`hadoop.security.key.provider.path`.
+- **HTTP authentication (SPNEGO)** is off by default
(`ozone.security.http.kerberos.enabled=false`, and each web server's own type,
for example `ozone.om.http.auth.type=simple`). With these defaults the web
endpoints are not authenticated, and the OM and SCM DB checkpoint endpoints,
which serve the metadata DB, are served without an admin check. *(documented —
`ozone-default.xml`.)*
So a finding that assumes ACLs / block/container tokens / transport encryption
/
-TDE are active in a default build is `OUT-OF-MODEL: non-default-build` unless
the
+TDE / HTTP authentication are active in a default build is `OUT-OF-MODEL:
non-default-build` unless the
operator enabled them (§10); the §10 checklist lists these as required
production hardening. (Answers the Q-authz / Q-token / Q-tde default-state and
lifetime/rotation mechanism questions.)
@@ -326,6 +327,7 @@ Per-boundary input trust (grouped by family):
- **Protect service metadata at rest.** The OM, SCM, and Recon RocksDB stores
hold critical credential/identity data — set restrictive file permissions
and,
ideally, encrypt them on disk. *(maintainer — jojochuang, 2026-06-25.)*
+- **Enable HTTP authentication (SPNEGO)** for the OM and SCM web servers, or
network-isolate their HTTP ports. The DB checkpoint endpoints serve the
metadata DB.
- **Isolate the KMS** in a separate, firewalled network segment. *(maintainer —
jojochuang, 2026-06-25.)*
- **Client side:** treat data read from Ozone per your own trust needs; protect
diff --git a/hadoop-hdds/common/src/main/resources/ozone-default.xml
b/hadoop-hdds/common/src/main/resources/ozone-default.xml
index 4ba267b677c..a12aa411bcc 100644
--- a/hadoop-hdds/common/src/main/resources/ozone-default.xml
+++ b/hadoop-hdds/common/src/main/resources/ozone-default.xml
@@ -3515,6 +3515,8 @@
<tag>OM, SECURITY, KERBEROS</tag>
<description> simple or kerberos. If kerberos is set, SPNEGO
will be used for http authentication.
+ kerberos takes effect only when ozone.security.http.kerberos.enabled is
true.
+ With simple, requests are not authenticated, so the admin check of the
/dbCheckpoint and /v2/dbCheckpoint endpoints is not applied.
</description>
</property>
<property>
@@ -3523,6 +3525,8 @@
<tag>OM, SECURITY, KERBEROS</tag>
<description> simple or kerberos. If kerberos is set, SPNEGO
will be used for http authentication.
+ kerberos takes effect only when ozone.security.http.kerberos.enabled is
true.
+ With simple, requests are not authenticated, so the admin check of the
/dbCheckpoint endpoint is not applied.
</description>
</property>
<property>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
