Bug 1568844
Summary: | [snapshot-scheduler]Prevent access of shared storage volume from the outside client | ||
---|---|---|---|
Product: | [Community] GlusterFS | Reporter: | Mohammed Rafi KC <rkavunga> |
Component: | snapshot | Assignee: | Mohammed Rafi KC <rkavunga> |
Status: | CLOSED CURRENTRELEASE | QA Contact: | |
Severity: | unspecified | Docs Contact: | |
Priority: | unspecified | ||
Version: | mainline | CC: | bugs |
Target Milestone: | --- | ||
Target Release: | --- | ||
Hardware: | Unspecified | ||
OS: | Unspecified | ||
Whiteboard: | |||
Fixed In Version: | glusterfs-v4.1.0 | Doc Type: | If docs needed, set a value |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2018-06-20 18:05:09 UTC | Type: | Bug |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | |||
Bug Blocks: | 1568832, 1568973 |
Description
Mohammed Rafi KC
2018-04-18 10:18:03 UTC
https://review.gluster.org/19898 shared storage: Prevent mounting shared storage from non-trusted client https://review.gluster.org/19899 server/auth: add option for strict authentication REVIEW: https://review.gluster.org/19898 (shared storage: Prevent mounting shared storage from non-trusted client) posted (#1) for review on master by mohammed rafi kc REVIEW: https://review.gluster.org/19899 (server/auth: add option for strict authentication) posted (#1) for review on master by mohammed rafi kc COMMIT: https://review.gluster.org/19898 committed in master by "Shyamsundar Ranganathan" <srangana> with a commit message- shared storage: Prevent mounting shared storage from non-trusted client gluster shared storage is a volume used for internal storage for various features including ganesha, geo-rep, snapshot. So this volume should not be exposed to the client, as it is a special volume for internal use. This fix wont't generate non trusted volfile for shared storage volume. Change-Id: I8ffe30ae99ec05196d75466210b84db311611a4c fixes: bz#1568844 BUG: 1568844 Signed-off-by: Mohammed Rafi KC <rkavunga> COMMIT: https://review.gluster.org/19899 committed in master by "Shyamsundar Ranganathan" <srangana> with a commit message- server/auth: add option for strict authentication When this option is enabled, we will check for a matching username and password, if not found then the connection will be rejected. This also does a checksum validation of volfile The option is invalid when SSL/TLS is in use, at which point the SSL/TLS certificate user name is used to validate and hence authorize the right user. This expects TLS allow rules to be setup correctly rather than the default *. This option is not settable, as a result this cannot be enabled for volumes using the CLI. This is used with the shared storage volume, to restrict access to the same in non-SSL/TLS environments to the gluster peers only. Tested: ./tests/bugs/protocol/bug-1321578.t ./tests/features/ssl-authz.t - Ran tests on volumes with and without strict auth checking (as brick vol file needed to be edited to test, or rather to enable the option) - Ran tests on volumes to ensure existing mounts are disconnected when we enable strict checking Change-Id: I2ac4f0cfa5b59cc789cc5a265358389b04556b59 fixes: bz#1568844 Signed-off-by: Mohammed Rafi KC <rkavunga> Signed-off-by: ShyamsundarR <srangana> This bug is getting closed because a release has been made available that should address the reported issue. In case the problem is still not fixed with glusterfs-v4.1.0, please open a new bug report. glusterfs-v4.1.0 has been announced on the Gluster mailinglists [1], packages for several distributions should become available in the near future. Keep an eye on the Gluster Users mailinglist [2] and the update infrastructure for your distribution. [1] http://lists.gluster.org/pipermail/announce/2018-June/000102.html [2] https://www.gluster.org/pipermail/gluster-users/ |