Authentication? HTTPS?

[isbm]

Hi!
Is there any way to secure the cluster? Because running it all plain open is a complete dealbreaker...

[mosuka]

Hi @isbm ,
Unfortunately, authentication does not support yet.
However, I'm working on supporting TLS now.
#25

[isbm]

Well, security first, before anything else. Actually it would be a big push up for this project if you add TLS and authentication, at least password-based. Because having a cluster of whatever store that everyone can write random garbage in it so easily — is of absolutely no use. Currently I am looking for something like TiKV, but tinier, simpler and in Go. Cete is exactly what it could be... I could potentially contribute that, but TLS and auth is quite simple to add, and yet you know your code very good already, while I don't have enough bandwidth to do this.

お願いします m(._.)m

[mosuka]

Hi @isbm ,
Sorry for the late reply and thank you for your comment. :)
You said "at least password-based", but does that mean Basic Auth?
https://tools.ietf.org/html/rfc2617

[isbm]

Osuka-san, yeah, it can be Basic Auth. For all the endpoints, like gRPC (examples), HTTPS etc. Just don't do that Google-based auth, because what if your Cete cluster is offline in some datacenter... 😉

Essentially would be cool if you could move all the CLI options also to some YAML-like config and so we could just run it as so:

cete -c /etc/cete.conf`

Done! And so then you have inside something like:

auth:
  token: some_very_secret_token_to_connect_to_everything

general:
  mode: master
  grpc: :8888
  https: :8080
  ssl: true

...and so on.

So as a start, we could just share that very secrect token across the cluster (e.g in HTTPS you can carry it on in header) in configs and that's it for starter. Then later on we could add RSA-based auth.

Since you are basically resembling TiKV (which makes your effort very cool!), then why not just steal the authentication ideas from them? :-) Essentially, for my project I need something like TiKV, but it is written in Rust and is a pig-size binary (about 0.5GB !!!). So Cete could do the job perfectly and I think do it very well.

[mosuka]

Hi @isbm ,
I released v0.3.1.
https://github.com/mosuka/cete/releases/tag/v0.3.1

I have implemented a simple TLS Authentication.
https://github.com/mosuka/cete#secure-cluster-example

Also, the CLI has been changed to support YAML configuration files.
https://github.com/mosuka/cete/blob/master/etc/cete.yaml

This is the first time I've implemented TLS support, so I'm not sure it meets your needs. Would you try it out?