Uploaded image for project: 'Couchbase Server'
  1. Couchbase Server
  2. MB-42227

Add CLI command to set TLS options at a service level

    XMLWordPrintable

Details

    • Improvement
    • Resolution: Unresolved
    • Major
    • Morpheus
    • Cheshire-Cat
    • tools
    • None
    • 1

    Description

      Problem
      Currently there is a cluster wide endpoint for setting the TLS options tlsMinVersion, cipherSuites and honorCipherOrder:

      localhost:8091/settings/security tlsMinVersion=tlsv1.2
      

      In CC most services have bumped up to support tlsv1.3 unfortunately the view-engine and ns_server cannot support tlsv1.3 because of Erlang.

      There is a different endpoint that allows each "service" to override the cluster wide setting of these settings:

      /settings/security/{service}/tlsMinVersion  
      

      With the option of tlsv1.1, tlsv1.2 or tlsv1.3, noting that clusterManager service does not support tlsv1.3

      The "services" are:

      1. Analytics
      2. Cluster Manager
      3. Data
      4. Eventing
      5. FTS
      6. GSI
      7. Query

      Generally speaking a user is require by their company security policy to set the highest possible level available. Unfortunately the global setting cannot accept 1.3 as not all services support that and it could mislead the user. i.e from a couchbase-cli:

      couchbase-cli security-settings  -tls-min-version tlsv1.3
      

      The user might believe the cluster is fully on tlsv1.3.

      It would be nice if the CLI had a way to set the TLS minimum version for each service.

      Suggestion

      One idea is to extent couchbase-cli to be able to set the tls min version per service for example:

      couchbase-cli security-settings  -tls-min-version-data tlsv1.3 -tls-min-version-cluster-manager tlsv1.2 
      

      Attachments

        Issue Links

          No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

              owend Daniel Owen
              ianmccloy Ian McCloy (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

              Dates

                Created:
                Updated:

                Gerrit Reviews

                  There are no open Gerrit changes

                  PagerDuty