docs: Document how to turn off quorum hostname verification #818
Conversation
docs/modules/zookeeper/pages/usage_guide/configuration_environment_overrides.adoc
Outdated
Show resolved
Hide resolved
…ment_overrides.adoc Co-authored-by: Lars Francke <[email protected]>
100% agreed. I didn't find where to locate it best :/ |
|
It's especially hard as I don't have an error message or similar. Guess I need to search the customer issue |
|
I added a troubleshooting guide, happy about @fhennig comments |
|
Thank you. I think this can wait for Felix to come back from vacation. Let's park it until next week. |
| ssl.quorum.hostnameVerification: "false" | ||
| ---- | ||
|
|
||
| WARNING: This imposes a security risk, so we don't disable the check by default. |
There was a problem hiding this comment.
This is a very empty statement, what risk does it expose you to?
There was a problem hiding this comment.
WDYT of
WARNING: This imposes a security risk, so we don't disable the check by default. Any possessor of a certificate signed by the ca (even for a totally different host) can pretend to be a Zookeeper server to a Zookeeper server.
There was a problem hiding this comment.
@nightkr can you please have another look?
There was a problem hiding this comment.
I think that covers the issue better, yes, and would be better if we do merge this.
Preliminarily I'd rather just solve #760 than document the workaround, unless we're running out of time for the release.
There was a problem hiding this comment.
I only raised this PR because it was on the tasklist. Happy to move it to Track for now.
Updated the section anyway
|
Good stuff! I like it. I think it's good where it is placed. Just resolve the discussion about the warning, I'd also like it to be more specific. |
|
Moving to Track because
|
|
So for 24.7 our only green version will be 3.9.2 where this issue is already "solved" by FIPS mode being enabled by default (see #760 (comment)). I would propose closing this PR, or changing it to only mention enabling FIPS mode on 3.8.4. |
|
Works for me |
Description
Please add a description here. This will become the commit message of the merge request later.
Definition of Done Checklist
Author
Reviewer
Acceptance