Skip to content

TheOpenPrep

Phase 7: Security, Multi-Scheme ACLs, SASL/Kerberos & TLS

Phase 7: Security, Multi-Scheme ACLs, SASL/Kerberos & TLS¶

Audience: Principal Security Architect & Distributed Infrastructure Specialist
Source References: zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/

1. Cellular ACL Architecture (`scheme:id:permissions`)¶

Unlike Unix file permissions (owner, group, other), ZooKeeper defines Access Control Lists (ACLs) per znode as a list of Id and Permissions pairs:

ACL Bitmask Layout (32-Bit Integer):
┌───────────┬───────────┬───────────┬───────────┬───────────┐
│ CREATE (c)│ READ (r)  │ WRITE (w) │ DELETE (d)│ ADMIN (a) │
│ Bit 0 (1) │ Bit 1 (2) │ Bit 2 (4) │ Bit 3 (8) │ Bit 4 (16)│
└───────────┴───────────┴───────────┴───────────┴───────────┘

1.1 The Crucial Scope Difference: `CREATE` vs. `DELETE`¶

CREATE permission: Grants the right to create child znodes under this parent path.
DELETE permission: Grants the right to delete child znodes under this parent path.
Crucial: To delete a znode itself, you do NOT need DELETE on the znode; you must have DELETE on the parent znode!

2. Authentication Schemes Compared¶

┌──────────┬─────────────────────────────────────────────────────────────────────┐
│ Scheme   │ ID Format & Validation                                              │
├──────────┼─────────────────────────────────────────────────────────────────────┤
│ world    │ Single ID: world:anyone (Public access; default on creation)        │
│ auth     │ Any authenticated session: auth: (Implicitly maps to current user)  │
│ digest   │ digest:username:Base64(SHA1(password))                              │
│ ip       │ Client IP address or CIDR network: ip:192.168.1.0/24                │
│ sasl     │ Kerberos principal: sasl:app_service@ENTERPRISE.REALM               │
└──────────┴─────────────────────────────────────────────────────────────────────┘

2.1 Hardening with Digest Authentication¶

# Generate Base64 SHA-1 password digest
java -cp zookeeper.jar:lib/* org.apache.zookeeper.server.auth.DigestAuthenticationProvider \
     app_admin:SecretPassword2026

# Output: app_admin:SecretPassword2026 -> app_admin:x89Fq14vN...=

# Apply ACL in zkCli
setAcl /services/production digest:app_admin:x89Fq14vN...=:crwda

3. SASL/Kerberos Enterprise Integration¶

In secure enterprise environments (e.g. Apache Hadoop/HBase/Kafka), ZooKeeper uses Kerberos authentication via Java JAAS (Java Authentication and Authorization Service):

// /etc/zookeeper/conf/jaas.conf
Server {
    com.sun.security.auth.module.Krb5LoginModule required
    useKeyTab=true
    keyTab="/etc/zookeeper/conf/zookeeper.keytab"
    storeKey=true
    useTicketCache=false
    principal="zookeeper/zk1.datacenter.internal@REALM.COM";
};

Client {
    com.sun.security.auth.module.Krb5LoginModule required
    useKeyTab=true
    keyTab="/etc/security/keytabs/app.keytab"
    storeKey=true
    useTicketCache=false
    principal="app_worker/host1.datacenter.internal@REALM.COM";
};

4. Netty TLS/SSL Encryption & Administrative Whitelisting¶

4.1 Securing Client and Quorum Communication (`zoo.cfg`)¶

# Enforce Netty as communication factory (ZooKeeper 3.5+)
serverCnxnFactory=org.apache.zookeeper.server.NettyServerCnxnFactory

# Enable Secure Client Port
secureClientPort=2281
ssl.keyStore.location=/etc/zookeeper/conf/server.keystore.jks
ssl.keyStore.password=KeystoreSecretPass
ssl.trustStore.location=/etc/zookeeper/conf/server.truststore.jks
ssl.trustStore.password=TruststoreSecretPass

# Enable mTLS for Quorum Inter-Server Communication
sslQuorum=true

4.2 Restricting Four-Letter Word Commands (4LW)¶

Historically, anyone could query ZooKeeper's administration interface using unauthenticated 4LW commands (echo dump | nc zk 2181).
ZooKeeper mandates strict whitelisting:

# Only allow safe diagnostic commands
4lw.commands.whitelist=stat,ruok,mntr,conf

(Commands like dump or kill are blocked to prevent denial-of-service memory dumps).