SeaweedFS安全配置（Security Configuration）

详细配置参考：

Security - Security Configuration - 《SeaweedFS Wiki》 - 书栈网 · BookStack

生产配置文件：security.toml

 weed scaffold -config=security > security.toml

1、获取certstrap

1.1 方式一：

go get github.com/square/certstrap

go 安装命令

yum install golang -y

1.2 方式二：

git clone https://github.com/square/certstrap

git 安装命令

yum install git -y

构建操作

cd certstrap/
go build

设置代理，可以访问到国内资源。

go env -w GOPROXY=https://goproxy.cn,direct

密码配置为：#eY79Db

2、生成秘钥

/certstrap/certstrap init --common-name "SeaweedFS CA"

/certstrap/certstrap request-cert --common-name master
/certstrap/certstrap request-cert --common-name volume

/certstrap/certstrap sign --CA "SeaweedFS CA" master
/certstrap/certstrap sign --CA "SeaweedFS CA" volume

修改配置文件：security.toml

# Put this file to one of the location, with descending priority
# ./security.toml
# $HOME/.seaweedfs/security.toml
# /etc/seaweedfs/security.toml
# this file is read by master, volume server, and filer

# this jwt signing key is read by master and volume server, and it is used for write operations:
# - the Master server generates the JWT, which can be used to write a certain file on a volume server
# - the Volume server validates the JWT on writing
# the jwt defaults to expire after 10 seconds.
[jwt.signing]
key = "m#09Yn"
expires_after_seconds = 300 # seconds

# by default, if the signing key above is set, the Volume UI over HTTP is disabled.
# by setting ui.access to true, you can re-enable the Volume UI. Despite
# some information leakage (as the UI is not authenticated), this should not
# pose a security risk.
[access]
ui = false

# this jwt signing key is read by master and volume server, and it is used for read operations:
# - the Master server generates the JWT, which can be used to read a certain file on a volume server
# - the Volume server validates the JWT on reading
# NOTE: jwt for read is only supported with master+volume setup. Filer does not support this mode.
[jwt.signing.read]
key = "m#09Yn"
expires_after_seconds = 300 # seconds

# If this JWT key is configured, Filer only accepts writes over HTTP if they are signed with this JWT:
# - f.e. the S3 API Shim generates the JWT
# - the Filer server validates the JWT on writing
# the jwt defaults to expire after 10 seconds.
[jwt.filer_signing]
key = ""
expires_after_seconds = 10 # seconds

# If this JWT key is configured, Filer only accepts reads over HTTP if they are signed with this JWT:
# - f.e. the S3 API Shim generates the JWT
# - the Filer server validates the JWT on writing
# the jwt defaults to expire after 10 seconds.
[jwt.filer_signing.read]
key = ""
expires_after_seconds = 10 # seconds

# all grpc tls authentications are mutual
# the values for the following ca, cert, and key are paths to the PERM files.
# the host name is not checked, so the PERM files can be shared.
[grpc]
ca = "/opt/seaweedfs/out/SeaweedFS_CA.crt"
# Set wildcard domain for enable TLS authentication by common names
allowed_wildcard_domain = "" # .mycompany.com

[grpc.volume]
cert = "/opt/seaweedfs/out/volume.crt"
key = "/opt/seaweedfs/out/volume.key"
allowed_commonNames = "" # comma-separated SSL certificate common names

[grpc.master]
cert = "/opt/seaweedfs/out/master.crt"
key = "/opt/seaweedfs/out/master.key"
allowed_commonNames = "" # comma-separated SSL certificate common names

[grpc.filer]
cert = "/opt/seaweedfs/out/filer.crt"
key = "/opt/seaweedfs/out/filer.key"
allowed_commonNames = "" # comma-separated SSL certificate common names

[grpc.msg_broker]
cert = ""
key = ""
allowed_commonNames = "" # comma-separated SSL certificate common names

# use this for any place needs a grpc client
# i.e., "weed backup|benchmark|filer.copy|filer.replicate|mount|s3|upload"
[grpc.client]
cert = "/opt/seaweedfs/out/client.crt"
key = "/opt/seaweedfs/out/client.key"

# volume server https options
# Note: work in progress!
# this does not work with other clients, e.g., "weed filer|mount" etc, yet.
[https.client]
enabled = true

[https.volume]
cert = ""
key = ""
ca = ""

[https.master]
cert = ""
key = ""
ca = ""

SeaweedFS安全配置（Security Configuration）相关推荐

【文献翻译】思科路由器安全配置合规性的SCAP基准-SCAP Benchmark for Cisco Router Security Configuration Compliance
目录思科路由器安全配置合规性的SCAP基准 SCAP Benchmark for Cisco Router Security Configuration Compliance 摘要 I. 引言 II ...
springbboot加密打包_Spring Boot 配置 Security 密码加密
依赖 org.springframework.boot spring-boot-starter-security 注入bean @SpringBootApplication public class ...
老唐手把手教你配置security，并增加JWT校验（copy就用）。
老唐手把手教你配置security,并增加JWT校验(copy就用). 1.首先配置security 1.1导入security的jar包 1.2配置security配置文件(直接上代码) 2.JWT ...
4、mybatis通过配置类Configuration 实现初始化
对于初学者,如果进行mybatis的学习呢?我总结了几点,会慢慢的更新出来.首先大家需要了解mybatis是什么.用mybatis来做什么.为什么要用mybatis.有什么优缺点:当知道了为什么的时候 ...
Spring零配置之@Configuration注解详解
转载自 Spring零配置之@Configuration注解详解 @Configuration介绍 Spring3.0之前要使用Spring必须要有一个xml配置文件,这也是Spring的核心文件,而 ...
翻译 - ASP.NET Core 基本知识 - 配置（Configuration）
翻译自 https://docs.microsoft.com/en-us/aspnet/core/fundamentals/configuration/?view=aspnetcore-5.0 ASP ...
配置类Configuration
配置类@Configuration 01.概述配置类:在springboot中被@Configuration或者@SpringBootConfiguration标注的类称之为配置类. 02.作用&a ...
云客Drupal源码分析之配置系统Configuration（一）
各位<云客drupal源码分析>系列的读者: 本系列一直以每周一篇的速度进行博客原创更新,希望帮助大家理解drupal8底层原理,并缩短学习时间,但自<插件系统(上)>主题开始 ...
LTE(4G) - NR(5G) 测量配置 Measurement configuration
目录 LTE(4G) - NR(5G) 测量配置 Measurement configuration 描述流程图 Log Log中的关键子描述 LTE(4G) - NR(5G) 测量配置 Measu ...
SAP UI5 应用的全局配置(Global Configuration) 的设计和使用试读版
一套适合 SAP UI5 初学者循序渐进的学习教程作者简介 Jerry Wang,2007 年从电子科技大学计算机专业硕士毕业后加入 SAP 成都研究院工作至今.Jerry 是 SAP 社区导师,S ...

SeaweedFS安全配置（Security Configuration）

SeaweedFS安全配置（Security Configuration）相关推荐

最新文章

热门文章