python - 如何让 Riak 2.0 安全性与 riak-python-client 一起使用？

Question

Riak 2.0 以默认设置安装在 Ubuntu 14.04 上

Riak python 客户端取自 dev 分支:https://github.com/basho/riak-python-client/tree/feature/bch/security

我所做的步骤:

1.启用安全性:

> riak-admin security enable

2.检查状态:

> riak-admin security status
> Enabled

3.添加示例用户、组并应用一些基本权限

4.总体看起来如下:

用户:

riak-admin security print-users

+----------+---------------+----------------------------------------+------------------------------+
| username |   member of   |                password                |           options            |
+----------+---------------+----------------------------------------+------------------------------+
| user_sec |   group_sec   |ce055fe0a2d621a650c293a56996ee504054ea1d|              []              |
+----------+---------------+----------------------------------------+------------------------------+

用户的授权:

riak-admin security print-grants user_sec
Inherited permissions (user/user_sec)

+--------------------+----------+----------+----------------------------------------+
|       group        |   type   |  bucket  |                 grants                 |
+--------------------+----------+----------+----------------------------------------+
|     group_sec      | default  |    *     |              riak_kv.get               |
|     group_sec      |bucket_sec|    *     |              riak_kv.get               |
+--------------------+----------+----------+----------------------------------------+

Cumulative permissions (user/user_sec)

+----------+----------+----------------------------------------+
|   type   |  bucket  |                 grants                 |
+----------+----------+----------------------------------------+
| default  |    *     |              riak_kv.get               |
|bucket_sec|    *     |              riak_kv.get               |
+----------+----------+----------------------------------------+

授权来源:

riak-admin security print-sources

+--------------------+------------+----------+----------+
|       users        |    cidr    |  source  | options  |
+--------------------+------------+----------+----------+
|      user_sec      | 0.0.0.0/32 | password |    []    |
|      user_sec      |127.0.0.1/32|  trust   |    []    |
+--------------------+------------+----------+----------+

我尝试运行的简单 python 脚本(在 Riak 运行的同一主机上):

import riak
from riak.security import SecurityCreds
pbc_port = 8002
riak_host = "127.0.0.1"
creds = riak.security.SecurityCreds('user_sec', 'secure_password')
riak_client = riak.RiakClient(pb_port=pbc_port, host=riak_host, protocol='pbc', security_creds=creds)
bucket = riak_client.bucket('test')
data = bucket.get("42")
print data.data

我得到的堆栈跟踪:python riak_test.py

Traceback (most recent call last):
  File "riak_test.py", line 8, in <module>
    data = bucket.get("42")
  File "/usr/local/lib/python2.7/dist-packages/riak/bucket.py", line 214, in get
    return obj.reload(r=r, pr=pr, timeout=timeout)
  File "/usr/local/lib/python2.7/dist-packages/riak/riak_object.py", line 307, in reload
    self.client.get(self, r=r, pr=pr, timeout=timeout)
  File "/usr/local/lib/python2.7/dist-packages/riak/client/transport.py", line 184, in wrapper
    return self._with_retries(pool, thunk)
  File "/usr/local/lib/python2.7/dist-packages/riak/client/transport.py", line 126, in _with_retries
    return fn(transport)
  File "/usr/local/lib/python2.7/dist-packages/riak/client/transport.py", line 182, in thunk
    return fn(self, transport, *args, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/riak/client/operations.py", line 382, in get
    return transport.get(robj, r=r, pr=pr, timeout=timeout)
  File "/usr/local/lib/python2.7/dist-packages/riak/transports/pbc/transport.py", line 148, in get
    if self.quorum_controls() and pr:
  File "/usr/local/lib/python2.7/dist-packages/riak/transports/feature_detect.py", line 102, in quorum_controls
    return self.server_version >= versions[1]
  File "/usr/local/lib/python2.7/dist-packages/riak/util.py", line 148, in __get__
    value = self.fget(obj)
  File "/usr/local/lib/python2.7/dist-packages/riak/transports/feature_detect.py", line 189, in server_version
    return LooseVersion(self._server_version())
  File "/usr/local/lib/python2.7/dist-packages/riak/transports/pbc/transport.py", line 101, in _server_version
    return self.get_server_info()['server_version']
  File "/usr/local/lib/python2.7/dist-packages/riak/transports/pbc/transport.py", line 119, in get_server_info
    expect=MSG_CODE_GET_SERVER_INFO_RESP)
  File "/usr/local/lib/python2.7/dist-packages/riak/transports/pbc/connection.py", line 51, in _request
    return self._recv_msg(expect)
  File "/usr/local/lib/python2.7/dist-packages/riak/transports/pbc/connection.py", line 137, in _recv_msg
    raise RiakError(err.errmsg)
riak.RiakError: 'Security is enabled, please STARTTLS first'

当安全性被禁用时，相同的脚本工作得很好:

python riak_test.py
{u'question': u"what's the sense of universe?"}

我还尝试使用此工具生成示例证书:https://github.com/basho-labs/riak-ruby-ca并在riak.conf中设置它们:

grep ssl /etc/riak/riak.conf
## with the ssl config variable, for example:
ssl.certfile = $(platform_etc_dir)/server.crt
## Default key location for https can be overridden with the ssl
ssl.keyfile = $(platform_etc_dir)/server.key
## with the ssl config variable, for example:
ssl.cacertfile = $(platform_etc_dir)/ca.crt

并在Python脚本中使用ca.crt:

creds = riak.security.SecurityCreds('user_sec', 'secure_password', 'ca.crt')

它没有改变任何东西。我仍然遇到同样的异常。我想这个问题可能是微不足道的，但我现在没有任何线索。

更新:

我使用了错误的参数名称。几次提交前，它是:security_creds，现在称为:credentials。当我在脚本中修复此问题时，SSL 握手已初始化。接下来的异常是由错误的 SecurityCreds 初始化引起的。构造函数使用命名参数，因此应该是:

creds = riak.security.SecurityCreds(username='user_sec', password='secure_password', cacert_file='ca.crt')

握手已初始化，但执行此命令失败:

ssl_socket.do_handshake()

来自riak/transport/pbc/connection.py(第134行)

我收到这两个错误(随机):

    File "/home/gta/riak-python-client/riak/transports/pbc/connection.py", line 77, in _init_security
    self._ssl_handshake()
  File "/home/gta/riak-python-client/riak/transports/pbc/connection.py", line 145, in _ssl_handshake
    raise e
OpenSSL.SSL.SysCallError: (104, 'ECONNRESET')


    File "/home/gta/riak-python-client/riak/transports/pbc/connection.py", line 77, in _init_security
    self._ssl_handshake()
  File "/home/gta/riak-python-client/riak/transports/pbc/connection.py", line 145, in _ssl_handshake
    raise e
OpenSSL.SSL.SysCallError: (-1, 'Unexpected EOF')

我还在 Riak 日志 (/var/log/riak/error.log) 中观察到错误:

2014-06-02 15:09:33.954 [error] <0.1995.1> gen_fsm <0.1995.1> in state wait_for_tls terminated with reason: {error,{startls_failed,{certfile,badarg}}}
2014-06-02 15:09:33.955 [error] <0.1995.1> CRASH REPORT Process <0.1995.1> with 0 neighbours exited with reason: {error,{startls_failed,{certfile,badarg}}} in gen_fsm:terminate/7 line 622
2014-06-02 15:09:33.955 [error] <0.28750.0> Supervisor riak_api_pb_sup had child undefined started with {riak_api_pb_server,start_link,undefined} at <0.1995.1> exit with reason {error,{startls_failed,{certfile,badarg}}} in context child_terminated

两种方法都会发生这种情况:cacert (ca.crt) 和客户端证书 (client.crt)/key (client.key)。我尝试了各种按键组合:

• 来自测试/资源的 key

• 使用 riak-ruby-ca 脚本生成的 key

• 在测试/资源中使用 make 生成的 key

• 使用 pyOpenSSL 的帮助程序脚本生成的 key

• ...它们都不适合我

我正在使用riak_2.0.0beta1-1_amd64.deb

Answer 1

感谢您的热情测试!您拉出的分支是一项未经审查的正在进行中的工作，我今天添加了一些更新。

我会再次尝试最新的 2.0.0 beta 版和对此分支所做的更改。 riak/tests/resources 中有一些测试证书，这对于开始测试您的配置很有用。

现在，您还需要命名您的 cacert 参数，因为添加了其他几个选项。

基本设置看起来相当不错。尝试最新的并让我知道它对您有何作用。