[
https://issues.apache.org/jira/browse/ZOOKEEPER-5050?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18090001#comment-18090001
]
Piotr Karwasz edited comment on ZOOKEEPER-5050 at 6/18/26 7:52 PM:
-------------------------------------------------------------------
Thanks [~andor],
I generated a threat model using the [threat model generating
skill|https://gist.github.com/potiuk/da14a826283038ddfe38cc9fe6310573]
[~potiuk] uses for the Glasswing program and mentioned it in [~yurii] PR:
[https://gist.github.com/ppkarwasz/f5be1b5c0182fe665252101c5f24d39f]
Looking at it, the most important notions that you should stress out to
reporters should be:
* ZooKeeper is *not* meant to be deployed as-is and certainly not on the open
Internet,
* Contribution in {{zookeeper-contrib}} and recipes in {{zookeeper-recipes}}
are out of scope.
was (Author: pkarwasz):
Thanks [~andor],
I generated a threat model using the skill [~potiuk] uses for the Glasswing
program and mentioned it in [~yurii] PR:
[https://gist.github.com/potiuk/da14a826283038ddfe38cc9fe6310573]
Looking at it, the most important notions that you should stress out to
reporters should be:
* ZooKeeper is *not* meant to be deployed as-is and certainly not on the open
Internet,
* Contribution in {{zookeeper-contrib}} and recipes in {{zookeeper-recipes}}
are out of scope.
> Disable AdminServer and enhance documentation to highlight security
> considerations
> ----------------------------------------------------------------------------------
>
> Key: ZOOKEEPER-5050
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-5050
> Project: ZooKeeper
> Issue Type: Improvement
> Components: documentation, server
> Affects Versions: 3.10.0, 3.9.5, 3.8.6
> Reporter: Andor Molnar
> Assignee: Andor Molnar
> Priority: Major
> Labels: pull-request-available
> Time Spent: 1h 20m
> Remaining Estimate: 0h
>
> Disable Admin Server in the default configuration.
> Add new section to highlight the security considerations that administrators
> should follow when deploying ZooKeeper with Admin Server enabled.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
