release-20.2: cli: report on the undesirability of --insecure differently
#55025
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Two changes here:
- do not report a penalty in client commands using a warning;
the choice to use insecure mode is done by the server's
administrator and clients cannot influence it.
- make the command-line flag visible in the `--help` text again,
but with a clearer explanation of its effects.
Example server warning, in v20.1 ("before"):
```
* WARNING: RUNNING IN INSECURE MODE!
*
* - Your cluster is open for any client that can access <all your IP addresses>.
* - Any user, even root, can log in without providing a password.
* - Any user, connecting as root, can read or write any data in your cluster.
* - There is no network encryption nor authentication, and thus no confidentiality.
*
* Check out how to secure your cluster: https://www.cockroachlabs.com/docs/v20.1/secure-a-cluster.html
```
Example server warning, in v20.2 ("after"):
```
* WARNING: ALL SECURITY CONTROLS HAVE BEEN DISABLED!
*
* This mode is intended for non-production testing only.
*
* In this mode:
* - Your cluster is open to any client that can access any of your IP addresses.
* - Intruders with access to your machine or network can observe client-server traffic.
* - Intruders can log in without password and read or write any data in the cluster.
* - Intruders can consume all your server's resources and cause unavailability.
*
*
* INFO: To start a secure server without mandating TLS for clients,
* consider --accept-sql-without-tls instead. For other options, see:
*
* - https://go.crdb.dev/issue-v/53404/v20.2
* - https://www.cockroachlabs.com/docs/v20.2/secure-a-cluster.html
```
Example `--help` text for *client* commands, before:
```
Connect to an insecure cluster. This is strongly discouraged for
production usage.
```
After:
```
Connect to a cluster without using TLS nor authentication. This makes
the client-server connection vulnerable to MITM attacks. Use with care.
```
Example `--help` text for *server* commands, before:
```
Start an insecure node, using unencrypted (non-TLS) connections,
listening on all IP addresses (unless --listen-addr is provided) and
disabling password authentication for all database users. This is
strongly discouraged for production usage and should never be used on a
public network without combining it with --listen-addr.
```
After:
```
Start a node with all security controls disabled. There is no
encryption, no authentication and internal security checks are also
disabled. This makes any client able to take over the entire cluster.
This flag is only intended for non-production testing.
Beware that using this flag on a public network without --listen-addr
is likely to cause the entire host server to become compromised.
To simply accept non-TLS connections for SQL clients while keeping the
cluster secure, consider using --accept-sql-without-tls instead. Also
see: https://go.crdb.dev/issue-v/53404/v20.2
```
Release note (cli change): The `--help` texts and informational
messages upon server start-up have been modified to better inform
the user about the nature and risks of the `--insecure` flag.
|
This change is |
tbg
approved these changes
Sep 30, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport 1/1 commits from #54927.
/cc @cockroachdb/release