|
| 1 | +Security audit |
| 2 | +============== |
| 3 | + |
| 4 | +This document will help you audit the security of a Tarantool cluster. |
| 5 | +It explains certain security aspects, their rationale, and the ways to check them. |
| 6 | +For details on how to configure Tarantool Enterprise Edition and its infrastructure for each aspect, |
| 7 | +refer to the :doc:`security hardening guide <security>`. |
| 8 | + |
| 9 | +Encryption of external iproto traffic |
| 10 | +------------------------------------- |
| 11 | + |
| 12 | +Tarantool uses the |
| 13 | +:doc:`iproto binary protocol </dev_guide/internals/box_protocol>` |
| 14 | +for replicating data between instances and also in the connector libraries. |
| 15 | + |
| 16 | +Since version 2.10.0, the Enterprise Edition has the built-in support for using SSL to encrypt the client-server communications over binary connections. |
| 17 | +For details on enabling SSL encryption, see the :ref:`enterprise-iproto-encryption` section of this document. |
| 18 | + |
| 19 | +In case the built-in encryption is not enabled, we recommend using VPN to secure data exchange between data centers. |
| 20 | + |
| 21 | +Closed iproto ports |
| 22 | +------------------- |
| 23 | + |
| 24 | +When a Tarantool cluster does not use iproto for external requests, |
| 25 | +connections to the iproto ports should be allowed only between Tarantool instances. |
| 26 | + |
| 27 | +For more details on configuring ports for iproto, |
| 28 | +see the ``advertise_uri`` section in the Cartridge documentation. |
| 29 | + |
| 30 | + |
| 31 | +HTTPS connection termination |
| 32 | +---------------------------- |
| 33 | + |
| 34 | +A Tarantool instance can accept HTTP connections from external services |
| 35 | +or access the administrative web UI. |
| 36 | +All such connections must go through an HTTPS-providing web server, |
| 37 | +running on the same host, such as nginx. |
| 38 | +This requirement is for both virtual and physical hosts. |
| 39 | +Running HTTP traffic through a few separate hosts with HTTPS termination |
| 40 | +is not sufficiently secure. |
| 41 | + |
| 42 | + |
| 43 | +Closed HTTP ports |
| 44 | +----------------- |
| 45 | + |
| 46 | +Tarantool accepts HTTP connections on a specific port, configured with |
| 47 | +``http_port: <number>`` value |
| 48 | +(see :ref:`configuring Cartridge instances <cartridge-config>`). |
| 49 | +It must be only available on the same host for nginx to connect to it. |
| 50 | + |
| 51 | +Check that the configured HTTP port is closed |
| 52 | +and that the HTTPS port (``443`` by default) is open. |
| 53 | + |
| 54 | +Restricted access to the administrative console |
| 55 | +----------------------------------------------- |
| 56 | + |
| 57 | +The :doc:`console </reference/reference_lua/console>` module provides |
| 58 | +a way to connect to a running instance and run custom Lua code. |
| 59 | +This can be useful for development and administration. |
| 60 | +The following code examples open connections on a TCP port and on a UNIX socket. |
| 61 | + |
| 62 | +.. code-block:: lua |
| 63 | +
|
| 64 | + console.listen(<port number>) |
| 65 | + console.listen('/var/lib/tarantool/socket_name.sock') |
| 66 | +
|
| 67 | +Opening an administrative console through a TCP port is always unsafe. |
| 68 | +Check that there are no calls like ``console.listen(<port_number>)`` |
| 69 | +in the code. |
| 70 | + |
| 71 | +Connecting through a socket requires having the write permission on the |
| 72 | +``/var/lib/tarantool`` directory. |
| 73 | +Check that write permission to this directory is limited to the ``tarantool`` user. |
| 74 | + |
| 75 | +Limiting the guest user |
| 76 | +----------------------- |
| 77 | + |
| 78 | +Connecting to the instance with ``tt connect`` or ``tarantoolctl connect`` without |
| 79 | +user credentials (under the ``guest`` user) must be disabled. |
| 80 | + |
| 81 | +There are two ways to check this vulnerability: |
| 82 | + |
| 83 | +* Check that the source code doesn't grant access to the ``guest`` user. |
| 84 | + The corresponding code can look like this: |
| 85 | + |
| 86 | + .. code-block:: lua |
| 87 | +
|
| 88 | + box.schema.user.grant('guest', |
| 89 | + 'read,write', |
| 90 | + 'universe', |
| 91 | + nil, { if_not_exists = true } |
| 92 | + ) |
| 93 | +
|
| 94 | + Besides searching for the whole code pattern, |
| 95 | + search for any entries of ``'universe'``. |
| 96 | + |
| 97 | +* Try connecting with ``tt connect`` to each Tarantool node. |
| 98 | + |
| 99 | +For more details, refer to the documentation on |
| 100 | +:ref:`access control <authentication>`. |
| 101 | + |
| 102 | +Authorization in the web UI |
| 103 | +--------------------------- |
| 104 | + |
| 105 | +Using the web interface must require logging in with a username and password. |
| 106 | +See more details in the documentation on |
| 107 | +:ref:`configuring web interface authorization <cartridge-auth-enable>`. |
| 108 | + |
| 109 | +Running under the tarantool user |
| 110 | +-------------------------------- |
| 111 | + |
| 112 | +All Tarantool instances should be running under the ``tarantool`` user. |
| 113 | + |
| 114 | +Limiting access to the tarantool user |
| 115 | +------------------------------------- |
| 116 | + |
| 117 | +The ``tarantool`` user must be a non-privileged user without the ``sudo`` permission. |
| 118 | +Also, it must not have a password set to prevent logging in via SSH or ``su``. |
| 119 | + |
| 120 | + |
| 121 | +Keeping two or more snapshots |
| 122 | +----------------------------- |
| 123 | + |
| 124 | +In order to have a reliable backup, a Tarantool instance must keep |
| 125 | +two or more latest snapshots. |
| 126 | +This should be checked on each Tarantool instance. |
| 127 | + |
| 128 | +The :ref:`snapshot_count <cfg_checkpoint_daemon-checkpoint_count>` value |
| 129 | +determines the number of kept snapshots. |
| 130 | +Configuration values are primarily set in the configuration files |
| 131 | +but :doc:`can be overridden </book/cartridge/cartridge_api/modules/cartridge.argparse>` |
| 132 | +with environment variables and command-line arguments. |
| 133 | +So, it's best to check both the values in the configuration files and the actual values |
| 134 | +using the console: |
| 135 | + |
| 136 | +.. code-block:: tarantoolsession |
| 137 | +
|
| 138 | + tarantool> box.cfg.checkpoint_count |
| 139 | + --- |
| 140 | + - 2 |
| 141 | +
|
| 142 | +
|
| 143 | +Enabled write-ahead logging (WAL) |
| 144 | +--------------------------------- |
| 145 | + |
| 146 | +Tarantool records all incoming data in the write-ahead log (WAL). |
| 147 | +The WAL must be enabled to ensure that data will be recovered in case of |
| 148 | +a possible instance restart. |
| 149 | + |
| 150 | +Secure values of ``wal_mode`` are ``write`` and ``fsync``: |
| 151 | + |
| 152 | +.. code-block:: tarantoolsession |
| 153 | +
|
| 154 | + tarantool> box.cfg.wal_mode |
| 155 | + --- |
| 156 | + - write |
| 157 | +
|
| 158 | +An exclusion from this requirement is when the instance is processing data, |
| 159 | +which can be freely rejected. |
| 160 | +For example, when Tarantool is used for caching. |
| 161 | +Then WAL can be disabled to reduce i/o load. |
| 162 | + |
| 163 | +For more details, see the |
| 164 | +:ref:`wal_mode reference <cfg_binary_logging_snapshots-wal_mode>`. |
| 165 | + |
| 166 | +The logging level is INFO or higher |
| 167 | +----------------------------------- |
| 168 | + |
| 169 | +The logging level should be set to 5 (``INFO``), 6 (``VERBOSE``), or 7 (``DEBUG``). |
| 170 | +Application logs will then have enough information to research a possible security breach. |
| 171 | + |
| 172 | +.. code-block:: tarantoolsession |
| 173 | +
|
| 174 | + tarantool> box.cfg.log_level |
| 175 | + --- |
| 176 | + - 5 |
| 177 | +
|
| 178 | +For a full list of logging levels, see the |
| 179 | +:ref:`log_level reference <cfg_logging-log_level>`. |
| 180 | + |
| 181 | + |
| 182 | +Logging with journald |
| 183 | +--------------------- |
| 184 | + |
| 185 | +Tarantool should use ``journald`` for logging. |
0 commit comments