bitflicker64 commented on code in PR #528: URL: https://github.com/apache/hugegraph-doc/pull/528#discussion_r4303524717
########## content/en/docs/clients/restful-api/other.md: ########## @@ -273,29 +273,126 @@ PUT http://localhost:8080/whiteiplist?status=true #### 11.1.6 Start the Arthas agent -Attaches the [Arthas](https://arthas.aliyun.com/en/) agent to the running server process for diagnosis. The ports, the bind IP and the disabled commands are taken from the `arthas.telnetPort`, `arthas.httpPort`, `arthas.ip` and `arthas.disabledCommands` options, see [Config Options](/docs/config/config-option/). +Starting with HugeGraph 1.8.0, Server and Store bundle Arthas 4.1.5 (PD does not embed an Arthas agent). +You can attach it to a running JVM for live troubleshooting via the local script or the administrator HTTP endpoint. + +> [!IMPORTANT] +> **Diagnostic Access** +> - **Local by Default**: Arthas defaults to `127.0.0.1`. Administrators may explicitly bind another valid address, including `0.0.0.0`. +> - **Native Authentication Recommended**: Enable Arthas native authentication, especially before exposing diagnostic ports beyond loopback. +> HugeGraph administrator authentication protects activation only. Without Arthas authentication, any network-reachable client can execute commands, +> including other OS users or containers in the same pod. Administrators control firewall rules, port mappings, and forwarding access. Review Comment: Important: This callout now presents Arthas native authentication as the protection against "other OS users or containers in the same pod", but with the default `arthas.localConnectionNonAuth=true` those clients skip authentication anyway. They connect from `127.0.0.1`, and the default bind is `127.0.0.1`. Evidence: in Arthas 4.1.5, `AuthUtils.localPrincipal()` returns a `LocalConnectionPrincipal` when `isLocalConnectionNonAuth()` is true and the remote address string equals `127.0.0.1`, and `SecurityAuthenticatorImpl.login()` accepts that principal without a password. `ArthasAttach.java` in #2945 copies `arthas.localConnectionNonAuth` from the target JVM and falls back to `true`. Turning the bypass off therefore needs `-Darthas.localConnectionNonAuth=false` on the service JVM, which means a restart. Line 347 states the bypass, but this callout, the hstore pages and the config-guide note do not. This commit also removed the earlier advice to "Restrict host, pod, and port-forward access to trusted operators" here, and "other OS users or containers in the same pod can access loopback" from `hugegraph-hstore.md`. What replaced it ("Administrators control firewall rules...") is not a recommendation. Please say here, in `content/en/docs/quickstart/hugegraph/hugegraph-hstore.md` lines 289-291 and in the CN pages (`other.md` 281-283, `hugegraph-hstore.md` 284-286) that native credentials do not stop clients that connect from `127.0.0.1` unless the service JVM runs with `-Darthas.localConnectionNonAuth=false`. Also bring back the instruction to limit host, Pod and port-forward access to trusted operators. ########## content/en/docs/config/config-option.md: ########## @@ -327,14 +327,23 @@ Basic Config Options and Backend Config Options correspond to configuration file > | k8s.internal_algorithm_image_url | Empty | Image URL for built-in > Kubernetes algorithms. | > [!DETAILS]- **Arthas Diagnostic Config Options (Optional)** -> Corresponding configuration file `rest-server.properties` +> Corresponding configuration file: `rest-server.properties`. +> Starting with HugeGraph 1.8.0. +> +> | Config option | Default value | Description | +> |---------------|---------------|-------------| +> | arthas.telnet_port | 8562 | Arthas telnet port for administrator activation through `PUT /arthas`. | +> | arthas.http_port | 8561 | Arthas HTTP port for administrator activation. | +> | arthas.ip | 127.0.0.1 | Bind address; administrators may explicitly select another valid address, including `0.0.0.0`. | Review Comment: Important: This row and the callout in `other.md` invite administrators to set a non-loopback `arthas.ip` for `PUT /arthas` and recommend native authentication first. But nothing on these pages, and nothing in the Server, lets you set credentials for API activation, so the recommendation cannot be followed on this path. Evidence: in #2945 at a7e994dd, `ArthasAPI.startArthas()` builds the agent config from `arthasConfig()` (telnet port, HTTP port, ip, disabled commands) plus `mcpEndpoint`, `tunnelServer` and `config.overrideAll=false`. It sets no `arthas.username` or `arthas.password`, and `ServerOptions`/`rest-server.properties` have no credential option. In Arthas 4.1.5, `ArthasBootstrap` generates a password only when `IPUtils.isAllZeroIP(ip)` is true (`0.0.0.0`, `::`). So `arthas.ip=10.0.0.5` followed by `PUT /arthas` leaves telnet 8562 and HTTP 8561 on that interface with no login. The only credential instructions on these pages are the helper's `--username`/`--password`. Please state, here (and in CN `config-option.md` line 335) and in the `other.md` callout, that API activation has no native credential setting. A specific non-loopback address gives an agent with no login on both ports, and a wildcard address gets a generated password printed in the Server output. For authenticated access beyond loopback, point readers to `bin/arthas.sh --target-ip ... --username ... --password ...`. If JVM system properties such as `-Darthas.password` are the intended route for the API path, document that instead, and note that it needs a restart. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
