Zookeeper security configuration guide on CentOS

Detailed explanation of the installation and configuration of Apache ZooKeeper under CentOS system

This article introduces in detail how to configure Apache ZooKeeper on CentOS system, covering Java environment installation, ZooKeeper download and decompression, configuration, booting and security configuration.

1. Preparation

1. Installing Java environment: ZooKeeper relies on the Java Runtime Environment (JRE) or Java Development Kit (JDK). It is recommended to install OpenJDK 8 or higher:

    sudo yum install java-1.8.0-openjdk-devel

2. Download and unzip ZooKeeper: Download the required version, such as zookeeper-3.4.14 from the Apache ZooKeeper official website, and unzip it to the specified directory (such as /usr/local/ ):

    wget https://archive.apache.org/dist/zookeeper/zookeeper-3.4.14/zookeeper-3.4.14.tar.gz
   tar -zxvf zookeeper-3.4.14.tar.gz -C /usr/local/

2. ZooKeeper configuration

1. Modify the configuration file: Enter the unzipped ZooKeeper directory, copy and modify zoo_sample.cfg to zoo.cfg . Key configuration items include dataDir (data directory), clientPort (client connection port), etc.

    cd /usr/local/zookeeper
   cp conf/zoo_sample.cfg conf/zoo.cfg
   vi conf/zoo.cfg

   Sample configuration:

    <code>tickTime=2000 dataDir=/var/lib/zookeeper clientPort=2181 server.1=192.168.0.11:2888:3888 server.2=192.168.0.12:2888:3888 server.3=192.168.0.13:2888:3888</code>

2. Cluster node configuration: If you configure the cluster, you need to set server.N attribute, N is the node number.

3. Create myid file: Create a myid file for each node in dataDir directory, and the file content is the node number (for example, the content of myid file of node 1 is 1 ).

    cd /var/lib/zookeeper
   vi myid # Execute on each node, the myid content is numbered to the node

3. Set up the startup

Create and edit the zookeeper.service file to realize the startup of the ZooKeeper service:

 [Unit]
Description=ZooKeeper Service
After=network.target

[Service]
Type=forking
ExecStart=/usr/local/zookeeper/bin/zkServer.sh start
ExecStop=/usr/local/zookeeper/bin/zkServer.sh stop
PrivateTmp=true
Environment=JAVA_HOME=/usr/local/java/jdk1.8.0_202 # Please replace it with your JAVA_HOME path User=zookeeper # It is recommended to use dedicated user Group=zookeeper # It is recommended to use dedicated user group PIDFile=/var/run/zookeeper/zookeeper.pid
Restart=always

[Install]
WantedBy=multi-user.target

Copy the file to the /etc/systemd/system/ directory and execute the following command:

 sudo systemctl enable zookeeper.service
sudo systemctl start zookeeper.service
sudo systemctl status zookeeper.service

4. Startup and Verification

Start ZooKeeper with the following command and check the status:

 /usr/local/zookeeper/bin/zkServer.sh start
/usr/local/zookeeper/bin/zkServer.sh status

5. Safety enhanced configuration (production environment recommendation)

• SASL authentication: Configure ZooKeeper to use SASL for authentication to enhance security.
• ACL Access Control: Configure an access control list (ACL) to limit access to specific nodes.
• SSL/TLS encryption: Use SSL/TLS to encrypt communication between the client and the server.
• Limit client connections: Avoid resource exhaustion and performance degradation.
• Monitoring and Auditing: Implement monitoring and auditing policies to track access and operations of ZooKeeper resources.

Note: The above steps and configurations are for reference only. In the production environment, it is necessary to adjust and optimize according to actual needs, such as setting of user permissions and more detailed security policy configuration. Please make sure the /var/lib/zookeeper directory exists and the ZooKeeper user has the corresponding permissions. Please modify the JAVA_HOME path according to the actual installation situation. It is recommended to use dedicated users and user groups to run the ZooKeeper service to improve security.

The above is the detailed content of Zookeeper security configuration guide on CentOS. For more information, please follow other related articles on the PHP Chinese website!