bitflicker64 commented on code in PR #528: URL: https://github.com/apache/hugegraph-doc/pull/528#discussion_r4303682955
########## content/en/docs/clients/restful-api/other.md: ########## @@ -273,29 +273,130 @@ PUT http://localhost:8080/whiteiplist?status=true #### 11.1.6 Start the Arthas agent -Attaches the [Arthas](https://arthas.aliyun.com/en/) agent to the running server process for diagnosis. The ports, the bind IP and the disabled commands are taken from the `arthas.telnetPort`, `arthas.httpPort`, `arthas.ip` and `arthas.disabledCommands` options, see [Config Options](/docs/config/config-option/). +Starting with HugeGraph 1.8.0, Server and Store bundle Arthas 4.1.5 (PD does not embed an Arthas agent). +You can attach it to a running JVM for live troubleshooting via the local script or the administrator HTTP endpoint. + +> [!IMPORTANT] +> **Diagnostic Access** +> - **Local by Default**: Arthas defaults to `127.0.0.1`. Administrators may explicitly bind another valid address, including `0.0.0.0`. +> - **Native Authentication Recommended**: Enable Arthas native authentication, especially before exposing diagnostic ports beyond loopback. +> HugeGraph administrator authentication protects activation only. For API credentials, set native `-Darthas.username=...` and `-Darthas.password=...` Review Comment: Important: These JVM properties are not limited to API activation. They also set the credentials of every agent that `bin/arthas.sh` attaches to that JVM, and the page says nothing about it. Combined with `-Darthas.localConnectionNonAuth=false`, which this same callout recommends, the default `bin/arthas.sh` leaves an agent running. Why: `ArthasAttach.java` in #2945 writes `arthas.username`/`arthas.password` into its private file only when the helper gets `--username`/`--password`. Arthas 4.1.5 adds that file first (`arthas.config.overrideAll=true`), but keys it omits are looked up in the target JVM's environment and system properties, so `-Darthas.username`/`-Darthas.password` from the service JVM apply. Evidence, #2945 helper at dc01d0e86 against a stub Server JVM started with `-Darthas.username=diagnostics -Darthas.password=s3cret -Darthas.localConnectionNonAuth=false`: - `bin/arthas.sh --command version` printed `command not permitted`, then `Error: Arthas credentials rejected at 127.0.0.1:3658; agent left running`, exit 1. Afterwards `auth --username diagnostics s3cret` + `session` on 3658 returned the JVM's PID, so the listener was still up. - `bin/arthas.sh --username diagnostics --password s3cret --command version` printed `4.1.5` and `Arthas listener closed`, exit 0. - With only `-Darthas.password=s3cret` on the JVM, `bin/arthas.sh --username ops --command version` generated no password (nothing in arthas.log), and `auth --username ops s3cret` succeeded. So line 347 ("With `--username` alone, native Arthas generates a password") is wrong once a JVM password is set. - Without any `-Darthas.*` properties, both commands behave as documented. Please say here and in the helper credentials paragraph (around lines 342-351) that JVM-level native credentials also apply to agents the helper attaches, so `bin/arthas.sh` then needs the same `--username`/`--password`, and limit the `--username`-alone sentence to JVMs without `-Darthas.password`. Same change in `content/cn/docs/clients/restful-api/other.md` lines 282 and 336-342, and a pointer from the credential notes in both `config-guide.md` and `config-option.md`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
