[
https://issues.apache.org/jira/browse/TS-3358?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14333746#comment-14333746
]
ASF subversion and git services commented on TS-3358:
-----------------------------------------------------
Commit 5f332c4b9a9f471af4a043f041e02ab8766f0c50 in trafficserver's branch
refs/heads/master from [[email protected]]
[ https://git-wip-us.apache.org/repos/asf?p=trafficserver.git;h=5f332c4 ]
TS-3358: peer credential checking on the management socket
Add peer credential checking to the management API socket. This
allows non-privileged processes to perform read-only operations,
reducing the need to run traffic_line as root, and reducing the
level of privilege needed by monitoring tools.
Factor out common unix domain socket creation. Add
proxy.config.admin.api.restricted configuration option to retain
the original socket permissions.
> add access checking to the management API
> -----------------------------------------
>
> Key: TS-3358
> URL: https://issues.apache.org/jira/browse/TS-3358
> Project: Traffic Server
> Issue Type: Improvement
> Components: Configuration, Management API
> Reporter: James Peach
> Assignee: James Peach
> Fix For: 5.3.0
>
>
> Many of the most common uses of the management API are checking metrics and
> configuration values. For these read-only cases, running {{traffic_line}} as
> root is overkill. Add unix domain socket credential checking so that we can
> allow read-only operations to be performed by unprivileged processes. This
> change also adds a configuration option to retain the current behaviour
> (retained by default).
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
