Configuring IoTDB Data Encryption During Transmission

Updated on 2024-11-29 GMT+08:00

View PDF

Scenario

In security scenarios, IoTDB data transmission encryption is required to ensure data security.

NOTE:

Data transmission encryption affects performance. Therefore, you are not advised to enable this function in scenarios that require high performance.

Prerequisites

Service users of each component are created by the administrator as required. For details, see Creating a User. In security mode, machine-machine users need to download the keytab file. For details, see Exporting an Authentication Credential File. A human-machine user must change the password upon the first login.
The IoTDB client has been installed in a directory, for example, /opt/client. Choose Cluster > Services > IoTDB then choose More > Download Client. In the dialog box that is displayed, select Save to Path. The generated file is saved to the /tmp/FusionInsight-Client directory on the active management node by default.

Procedure

Perform operations on the server.
1. Log in to FusionInsight Manager and choose Cluster > Services > IoTDB. Click the Configurations tab.
2. Modify the following parameters:
  - Search for SSL_ENABLE in the upper right corner of the page and change its value to true.
  - Search for iotdb_server_kerberos_qop in the upper right corner of the page and change its value to auth-conf.
3. Click Save. In the Save Configuration dialog box, click OK.
  When Operation succeeded is displayed, click Finish.
4. Click the Dashboard tab. Choose More > Restart Service. Wait until the service is restarted.
Perform operations on the client.
1. Log in to the active management node as user root and run the following command to switch to the client installation directory, for example, /opt/client:
  cd /opt/client
2. Run the following command to configure environment variables:
  source bigdata_env
3. (Optional) Run the following command to authenticate the current user if Kerberos authentication is enabled for the cluster. If Kerberos authentication is not enabled, skip this step.
  kinit Component service user
4. Run the following commands to generate the truststore.jks file using the ca.crt certificate file in the root directory of the client:
  cd /tmp/FusionInsight-Client/FusionInsight_Cluster_*_IoTDB_ClientConfig
  
  keytool -noprompt -import -alias myservercert -file ca.crt -keystore truststore.jks
5. Run the following command to copy the generated truststore.jks file to the client installation directory, for example, /opt/client/IoTDB/iotdb/conf.
  cp truststore.jks /opt/client/IoTDB/iotdb/conf
6. Run the following command to switch to the directory where the IoTDB client running script is stored:
  cd /opt/client/IoTDB/iotdb/sbin
7. Run the vim start-cli.sh command to compile the start-cli.sh script and add iotdb_ssl_truststore=/opt/client/IoTDB/iotdb/conf/truststore.jks and iotdb_ssl_enable=true to the startup parameter exec "$JAVA" -cp "$JAVA_CLASSPATH" "$JAVA_MAIN_CLASS" $PARAMETERS in the script.
```
exec "$JAVA" -Diotdb_ssl_truststore=/opt/client/IoTDB/iotdb/conf/truststore.jks -Diotdb_ssl_enable=true -cp "$JAVA_CLASSPATH" "$JAVA_MAIN_CLASS" $PARAMETERS
```
8. Run the following command to log in to the client. If the login is successful, data transmission encryption is enabled for IoTDB.
  ./start-cli.sh -h Service IP address of node where the IoTDBServer instance is located -p IoTDBServer RPC port
  NOTE:
  - You can also log in to the client by running the ./start-cli.sh -h Service IP address of the node where the IoTDBServer instance is located -p IoTDBServer RPC port -u Service username -pw Service user password command.
  - To view the service IP address of the node where the IoTDBServer instance is located, log in to FusionInsight Manager, choose Cluster > Services > IoTDB, and click the Instance tab.
  - The default RPC port is 22260. To obtain the port number, choose Cluster > Services > IoTDB, click Configurations then All Configurations, and search for IOTDB_SERVER_RPC_PORT.