Flink Security Authentication

Flink Authentication and Encryption

• In a Flink cluster, all components support authentication.
  • The kerberos authentication is supported between Flink cluster components and external components, such as YARN, HDFS, and ZooKeeper.
  • The security cookie authentication between Flink cluster components, for example, Flink client and JobManager, JobManager and TaskManager, and TaskManager and TaskManager, are supported.

• SSL encrypted transmission is supported by components of a Flink cluster and between components in a cluster, such as Flink client and JobManager, JobManager and TaskManager, as well as TaskManager and TaskManager.

ACL Control

In HA mode, ACL control is supported.

In HA mode of Flink, ZooKeeper can be used to manage clusters and discover services. Zookeeper supports SASL ACL control. Only users who have passed the SASL (Kerberos) authentication have the permission to operate files on ZooKeeper. To enable SASL ACL control, perform following configurations in the Flink configuration file.

high-availability.zookeeper.client.acl: creator
zookeeper.sasl.disable: false

For details about configuration items, see HA.

Web Security

Security of the Flink web UI is hardened, the whitelist filtering feature is provided, the Flink web UI is accessible only through a YARN proxy, and security headers are enhanced. In Flink clusters, listening ports of components can be configured.

• Encoding rules
  • Description: The same encoding mode is used on the web service client and server to prevent garbled characters and to implement input verification.
  • Security hardening: Response messages of web servers are encoded using UTF-8.
• Whitelist-based filter of IP addresses
  • Note: IP filter must be added to the web server to filter unauthorized requests from the source IP address and prevent unauthorized login.
  • Security hardening: Add jobmanager.web.allow-access-address to enable the IP filter. By default, only YARN users are supported.
    

    After the client is installed, you need to add the IP address of the client node to the jobmanager.web.allow-access-address configuration item.

• Preventing sending the absolute paths to the client
  • Note: If an absolute path is sent to a client, the directory structure of the server is exposed, increasing the risk that attackers know and attack the system.
  • Security hardening: If the Flink configuration file contains a parameter starting with a slash (/), the first-level directory is deleted.
• Same-origin policy
  • If two URL protocols have same hosts and ports, they are of the same origin. Protocols of different origins cannot access each other, unless the source of the visitor is specified on the host of the service to be visited.
  • Security hardening: The default value of the header of the response header Access-Control-Allow-Origin is the IP address of ResourceManager on Yarn clusters. If the IP address is not from Yarn, mutual access is not allowed.
• Preventing sensitive information disclosure
  • Web pages containing sensitive data must not be cached, to avoid leakage of sensitive information or data crosstalk among users who visit the internet through the proxy server.
  • Security hardening: Add Cache-control, Pragma, Expires security header. The default value is Cache-Control: no-store, Pragma: no-cache, and Expires: 0. The security hardening stops contents interacted between Flink and web server from being cached.
• Anti-hijacking
  • Since hotlinking and clickjacking use framing technologies, security hardening is required to prevent attacks.
  • Security hardening: Add X-Frame-Options security header to specify whether the browser will load the pages from iframe, frame or object. The default value is X-Frame-Options: DENY, indicating that no pages can be nested to iframe, frame or object.
• Logging calls of the Web Service APIs
  • Calls of the Flink webmonitor restful APIs are logged.
  • The jobmanager.web.accesslog.enable can be added in the access log. The default value is true. Logs are stored in a separate webaccess.log file.
• Cross-site request forgery prevention
  • In Browser/Server applications, CSRF must be prevented for operations involving server data modification, such as adding, modifying, and deleting. The CSRF forces end users to execute non-intended operations on the current web application.
  • Security hardening: Only two post APIs, one delete API, and get interfaces are reserve for modification requests. All other APIs are deleted.
• Troubleshooting:
  • When the application is abnormal, exception information is filtered, logged, and returned to the client.
  • Security hardening: A default error message page to filter information and log detailed error information. Four configuration parameters are added to ensure that the error page is switched to a specified URL provided by FusionInsight, preventing exposure of unnecessary information.

    Table 1 Parameters

    Parameter	Description	Mandatory
    jobmanager.web.403-redirect-url	Web page access error 403. If 403 error occurs, the specified page will be redirected to.	Yes
    jobmanager.web.404-redirect-url	Web page access error 404. If 404 error occurs, the specified page will be redirected to.	Yes
    jobmanager.web.415-redirect-url	Web page access error 415. If 415 error occurs, the specified page will be redirected to.	Yes
    jobmanager.web.500-redirect-url	Web page access error 500. If 500 error occurs, the specified page will be redirected to.	Yes

• HTML5 security
  • HTML5 is a next generation web development specification that provides new functions and extend the labels for developers. These new labels and functions increase the attack surface and pose attack risks (such as cross-domain resource sharing, client storage, WebWorker, WebRTC, and WebSocket).
  • Security hardening: Add the Access-Control-Allow-Origin parameter. For example, if you want to enable the cross-domain resource sharing, configure the Access-Control-Allow-Origin parameter of the HTTP response header.
    

    Flink does not involve security risks of functions such as storage on the client, WebWorker, WebRTC, and WebSocket.

Security Statement

• All security functions of Flink are provided by the open source community or self-developed. Security features that need to be configured by users, such as authentication and SSL encrypted transmission, may affect performance.
• As a big data computing and analysis platform, Flink does not detect sensitive information. Therefore, you need to ensure that the input data is not sensitive.
• You can evaluate whether configurations are secure as required.
• For any security-related problems, contact O&M support.