How to secure JMX and GFSH

Geode is introducing additional security features which allow finer grained control for JMX operations as well as GFSH commands. This functionality is automatically activated when the Geode properties security-client-authenticator and security-client-accessor are set.

Permissions are designed to be noun-verby and are in the form of RESOURCE:OPERATION[:REGION] tuples. The following values are valid:

Resource

• CLUSTER
• DATA

Operation

• MANAGE
• READ
• WRITE

At the end of this document is a reference list of all JMX and GFSH operations with their corresponding permissions.

To quickly get started using permissions for JMX and GFSH a sample implementation of com.gemstone.gemfire.security.Authenticator and com.gemstone.gemfire.security.AccessControl is provided by the class blah.blah.ExampleJSONAuthorization. This implementation requires a JSON file which defines the allowed users and their corresponding permissions. For example:

{
  "roles": [
    {
      "name": "cluster",
      "operationsAllowed": [
        "CLUSTER:MANAGE",
        "CLUSTER:WRITE",
        "CLUSTER:READ"
      ]
    },
    {
      "name": "data",
      "operationsAllowed": [
        "DATA:MANAGE",
        "DATA:WRITE",
        "DATA:READ"
      ],
      "regions": ["region1", "region2"]
    }
  ]
  "users": [
    {
      "name": "super-user",
      "password": "1234567",
      "roles": [
        "cluster",
        "data"
      ]
    },
    {
      "name": "joebloggs",
      "password": "1234567",
      "roles": [
        "data"
      ]
    }
  ]
}

In this example we have two roles defined: cluster and data. The data role only has access to two regions: region1 and region2.

To start using this sample perform the following steps:

1. Using gfsh, start a locator with security activated.

   start locator --name=locator1 \
       --J=-Dgemfire.security-client-authenticator=blah.blah.ExampleJSONAuthorization.create \
       --J=-Dgemfire.security-client-accessor=blah.blah.ExampleJSONAuthorization.create

2. Similarly, start a server

   start server --name=server1 --locators=localhost[10334]

3. asdfsadfsa
4. type stuff
5. run stuff
6. do more stuff

sdfdsfsdg

Reference

Following are lists for gfsh commands, (highlighted in green), and JMX operations with their corresponding permissions.

Related articles

• Page:
  Releasing Apache Geode
• Page:
  Running a Geode cluster in docker
• Page:
  Adding REST Cluster Management Operations
• Page:
  Creating a persistent cache service
• Page:
  Publishing Geode Metrics to External Monitoring Systems