From 71a53f79af16ef7687e498a72f32b2337df9af8c Mon Sep 17 00:00:00 2001 From: cooper-lzy <78672629+cooper-lzy@users.noreply.github.com> Date: Tue, 12 Oct 2021 09:27:18 +0800 Subject: [PATCH 1/3] add ssl --- docs-2.0/7.data-security/4.ssl.md | 67 +++++++++++++++++++++++++++++++ mkdocs.yml | 2 + 2 files changed, 69 insertions(+) create mode 100644 docs-2.0/7.data-security/4.ssl.md diff --git a/docs-2.0/7.data-security/4.ssl.md b/docs-2.0/7.data-security/4.ssl.md new file mode 100644 index 00000000000..8895d1777f5 --- /dev/null +++ b/docs-2.0/7.data-security/4.ssl.md @@ -0,0 +1,67 @@ + \ No newline at end of file diff --git a/mkdocs.yml b/mkdocs.yml index f3ec02266a8..00bc6b6b6b5 100755 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -48,6 +48,7 @@ extra: master: master base20: 2.0 base200: 2.0.0 + branch: master version: method: mike social: @@ -320,6 +321,7 @@ nav: # - Use BR to back up data: 7.data-security/2.backup-restore/3.br-backup-data.md # - Use BR to restore data: 7.data-security/2.backup-restore/4.br-restore-data.md - Manage snapshots: 7.data-security/3.manage-snapshot.md + - SSL: 7.data-security/4.ssl.md - Service Tuning: - Compaction: 8.service-tuning/compaction.md From 07478bd6eac219ff76fe5487484f3aa86f67b2dc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=9C=B1=E6=99=93=E9=9D=92?= <86282370+izhuxiaoqing@users.noreply.github.com> Date: Tue, 12 Oct 2021 11:44:10 +0800 Subject: [PATCH 2/3] Update 4.ssl.md --- docs-2.0/7.data-security/4.ssl.md | 71 +++++++++++++++---------------- 1 file changed, 34 insertions(+), 37 deletions(-) diff --git a/docs-2.0/7.data-security/4.ssl.md b/docs-2.0/7.data-security/4.ssl.md index 8895d1777f5..acfde3d53b6 100644 --- a/docs-2.0/7.data-security/4.ssl.md +++ b/docs-2.0/7.data-security/4.ssl.md @@ -1,59 +1,58 @@ - \ No newline at end of file +3. Set the SSL and the trusted CA in clients. For code examples, see [nebula-test-run.py](https://github.com/vesoft-inc/nebula/blob/{{nebula.branch}}/tests/nebula-test-run.py). From f1a3882ca537db695da7fc834705dacf50ef6bd9 Mon Sep 17 00:00:00 2001 From: "max.zhu@vesoft.com" <86282370+izhuxiaoqing@users.noreply.github.com> Date: Tue, 12 Oct 2021 15:01:14 +0800 Subject: [PATCH 3/3] Update 4.ssl.md --- docs-2.0/7.data-security/4.ssl.md | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/docs-2.0/7.data-security/4.ssl.md b/docs-2.0/7.data-security/4.ssl.md index acfde3d53b6..a25ec1a758d 100644 --- a/docs-2.0/7.data-security/4.ssl.md +++ b/docs-2.0/7.data-security/4.ssl.md @@ -1,22 +1,22 @@ # SSL encryption -Nebula Graph supports transmission with SSL encryption between the client, Graph service, Meta service, and Storage service. This topic describes how to enable SSL encryption. +Nebula Graph supports data transmission with SSL encryption between clients, the Graph service, the Meta service, and the Storage service. This topic describes how to enable SSL encryption. ## Precaution -Enabling SSL encryption will slightly affect performance. +Enabling SSL encryption will slightly affect the performance, such as causing operation latency. ## Parameters | Parameter | Default value | Description | | ------------------ | ------- | ------------------------------| -| `cert_path` | - | The path to the pem certification. | +| `cert_path` | - | The path to the PEM certification. | | `key_path` | - | The path to the key certification. | | `password_path` | - | The path to the password file certification. | | `ca_path` | - | The path to the trusted CA file. | | `enable_ssl` | `false` | Whether to enable SSL encryption. | -| `enable_graph_ssl` | `false` | Whether to enable SSL encryption in Graph service only. | -| `enable_meta_ssl` | `false` | Whether to enable SSL encryption in Meta service only. | +| `enable_graph_ssl` | `false` | Whether to enable SSL encryption in the Graph service only. | +| `enable_meta_ssl` | `false` | Whether to enable SSL encryption in the Meta service only. | ## Certificate modes @@ -34,17 +34,17 @@ To use SSL encryption, SSL certificates are required. Nebula Graph supports two Nebula Graph supports three encryption policies. For details, see [Usage explanation](https://github.com/vesoft-inc/nebula/blob/a67d166b284cae1b534bf8d19c936ee38bf12e29/docs/rfcs/0001-ssl-transportation.md#usage-explanation). -- Encrypt the data transmission between the client, Graph service, Meta service, and Storage service. +- Encrypt the data transmission between clients, the Graph service, the Meta service, and the Storage service. - The values of `nebula-graphd.conf`, `nebula-metad.conf`, and `nebula-storaged.conf` need to be modified. And `enable_ssl` should be set to `true`. + Add `enable_ssl = true` to the configuration files of `nebula-graphd.conf`, `nebula-metad.conf`, and `nebula-storaged.conf`. -- Encrypt the data transmission between the client and Graph service. +- Encrypt the data transmission between clients and the Graph service. - This policy applies to the case that the clusters are set in the same room. Only the port of the Graph service is open to the outside because other services can communicate over the internal network without encryption. The value of `nebula-graphd.conf` needs to be modified. And `enable_graph_ssl` should be set to `true`. + This policy applies to the case that the clusters are set in the same server room. Only the port of the Graph service is open to the outside because other services can communicate over the internal network without encryption. Add `enable_graph_ssl = true` to the configuration file of `nebula-graphd.conf`. -- Encrypt the data transmission related to the Meta service in clusters. +- Encrypt the data transmission related to the Meta service in the cluster. - This policy applies to transporting classified information to the Meta service. The values of `nebula-graphd.conf`, `nebula-metad.conf`, and `nebula-storaged.conf` need to be modified. And `enable_meta_ssl` should be set to `true`. + This policy applies to transporting classified information to the Meta service. Add `enable_meta_ssl = true` to the configuration files of `nebula-graphd.conf`, `nebula-metad.conf`, and `nebula-storaged.conf`. ## Steps @@ -52,7 +52,7 @@ Nebula Graph supports three encryption policies. For details, see [Usage explana 2. Add the certificate configuration and the policy configuration in corresponding files. - For example, the three configuration files need to be set as follows when using a self-signed certificate and encrypt data transmission between the client, Graph service, Meta service, and Storage service. + For example, the three configuration files need to be set as follows when using a self-signed certificate and encrypt data transmission between clients, the Graph service, the Meta service, and the Storage service. ```bash --cert_path=xxxxxx