Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Server agents with TLS enabled accept non-TLS client RPC connections #2525

Closed
schmichael opened this issue Apr 5, 2017 · 1 comment
Closed

Server agents with TLS enabled accept non-TLS client RPC connections #2525

schmichael opened this issue Apr 5, 2017 · 1 comment
Labels
theme/security theme/tls type/bug

Comments

@schmichael
Copy link
Member

schmichael commented Apr 5, 2017 •
edited
Loading

If you configure TLS on Nomad server agents they still accept non-TLS RPC connections from Nomad client agents.

This means as of 0.5.6 TLS can only be required for communication between servers. Clients will still properly use TLS when configured to do so, but clients with no TLS configuration will still be able to communicate with servers and participate in the cluster.

Since the HTTP API does not require a client certificate even with TLS enabled, this bug does not significantly change the security guarantees of Nomad's TLS implementation.

Nomad agents should be network isolated from untrusted access regardless of TLS configuration.

Desired behavior

The desired behavior is that RPC TLS is all-or-nothing: if it's configured on servers then they should require TLS for all RPC communications.

Optionally we may allow requiring mTLS for the HTTP API to allow network isolation.

Originally reported to the mailing list here: https://groups.google.com/d/msg/nomad-tool/jhkLr8XQRgE/cgxOm0x3AAAJ
@schmichael schmichael added this to the v0.6.0 milestone Apr 5, 2017
@schmichael schmichael mentioned this issue Apr 6, 2017
Merged
schmichael added a commit that referenced this issue Apr 6, 2017
@schmichael
Require TLS for server RPC when enabled
11206c7 
Fixes #2525

We used to be checking a RequireTLS field that was never set. Instead we
can just check the TLSConfig.EnableRPC field and require TLS if it's
enabled.

Added a few unfortunately slow integration tests to assert the intended
behavior of misconfigured RPC TLS.

Also disable a lot of noisy test logging when -v isn't specified.
schmichael added a commit that referenced this issue Apr 7, 2017
@schmichael
Mention #2525 was fixed by #2526
da14164
@github-actions
Copy link

I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Dec 14, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
theme/security theme/tls type/bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@schmichael