I am not really good at gluster as I just started using this yesterday.

I have 2 servers. Both are running glusterfs-servers.

From server 1: I run sudo glusterfs peer probe server2 and it is added to the cluster. There was no questions asked. I did nothing to tell server2 to allow server1 to add it to the cluster. Does not make sense to me.

This confuses me. I mean, what if someone adds my glusterfs servers to their cluster. Seemed like there was absolutely no security. It is insane and I do not get it.

up vote 4 down vote accepted

TL,DR: It's safe, 3rd party cannot join an existing cluster on it's own, it needs to be invited from within.

There was no questions asked. I did nothing to tell server2 to allow server1 to add it to the cluster.

I had this question myself so I went to take a look at the documentation.

When you are creating a new cluster, you start on one server and add others using gluster peer probe OTHER_SERVER. Additional security isn't strictly required, because you are adding new, uninitialized glusterfs servers. (Unless you leave a freshly installed, uninitialized gluster running with public access - then you are in trouble).

So what prevents an attacker from joining your existing cluster? The key is the following paragraph:

Once this pool has been established, only trusted members may probe new servers into the pool. A new server cannot probe the pool, it must be probed from the pool. (source)

As the documentation says, a 3rd party/adversary cannot join your cluster, it needs to be invited from within.

Gluster also provides other security mechanisms to mitigate against related attacks:

  • IP allow/deny on volume level, gluster volume set VOL_NAME auth.allow IP1,IP2
  • TLS - transport encryption as well as using identities from certificates instead of IP addresses for authorization (not enabled by default, see link)

For anything important you can also consider private links between servers (IPSec/VPN) with a firewall setup that does not allow any connections from the outside.

  • It should be worth mentioning that the protocol will apparently not be encrypted by default, inversely indicated by gluster.readthedocs.io/en/latest/Administrator%20Guide/SSL - so saying it's safe would be a very long stretch in my book. – dualed Apr 5 '17 at 12:36
  • Thanks for mentioning it is not enabled by default - it is in the link that I included, but I will specifically mention it in the text too. However I still recommend running it over IPSec. It is easier to maintain a cipher list and other security configuration in one place than to watch out for TLS implementation specifics of each application such as glusterfs. – Matej Snoha Apr 6 '17 at 13:47

Your Gluster servers should be on their own, firewalled off section of your infrastructure. They are not intended to be exposed to the public internet.

  • Well, GlusterFS sports geo-replication, and does not mention VPNs or dedicated links even once, and they never mention what you're saying in their documentation. They simply never address the issue of authentication and authorization, as if it doesn't exist, which doesn't make sense for me. – haimg Jun 13 '15 at 2:19
  • 1
    @haimg I'd say if you're big enough to need Gluster you're big enough to figure out the security side of things on your own. Anyone doing multiple datacenters with replication between them should already have VPN/dedicated links well in hand. – ceejayoz Jun 13 '15 at 2:42

I agree that this is insane: security is an add-on to glusterfs. As pointed out by @ceejayoz, glusterfs is designed to only be run on a physically secured and isolated network.

Fortunately, glusterfs has added on ssl support, which is sadly almost completely undocumented. Presumably using ssl will make things better, although since it's undocumented it's hard to say for certain. What documentation exists is in this blog. Sadly, it only gives a sequence of steps.

  • I'd add that nowadays GlusterFS SSL documentation has got much better. – Luke404 Oct 27 '17 at 5:44

In my opinion, there are some ways to solve the problem:

  1. firewalld or iptables
  2. SELinux
  3. SSL/TLS

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.