secure communication between hector and cassandra?

[Yiming Sun]

Hello,

We are using Cassandra to host some confidential data, and Cassandra does support internode encryption.  However, it is not clear to us if the communication between Hector and Cassandra can also be encrypted.  A quick search on the subject seems to suggest someone has done this via openVPN.  We are just wondering if Hector has (or is planning to support) a more direct support for secure communication.  Thanks.

-- Y.

[Patricio Echagüe]

Yiming, I added Kerberos support a while ago. http://rantav.github.com/hector/build/html/content/security.html

I'm not sure if cassandra folks added it to cassandra already. At least it was part of DataStax Enterprise at that point.

[Yiming Sun]

Thanks Patricio.  Pardon my ignorance on this, but isn't this just for Authentication only? Or are all subsequent communications on data retrieval secured as well?

-- Y.

2012/2/27 Patricio Echagüe <patr...@gmail.com>

[Patricio Echagüe]

We currently don't have any other secure mechanism unfortunately. Just authentication.

Sent from my Android

[Yiming Sun]

Okay, thanks! :-)  No problem.

2012/2/27 Patricio Echagüe <patr...@gmail.com>

[Nate McCall]

SSL is not supported in Cassandra thrift API yet. I took a cursory
glance at this about 2 months ago, and I don't think it would be that
hard to hack in to one of the Cassandra thrift transports.

Unfortunately you cant use the SSLThriftTransport in libthrift out of
the box because cassandra has a few customizations on the transports
which will make it incompatible. We already have the actual transport
layer encapsulated on our side due to Patricio's efforts, so adding an
SSL impl (which you could then drive from kerberos) would be minimal
effort on our side.

[Patricio Echagüe]

Yeah. I forgot we isolated the client management in Hector core. Agree on that it will be straightforward to implement on our side.

Is there any ticket in C* JIRa about SSL ?

[Yiming Sun]

This is good to know, Nate.  Thank you both for the hard work.

[Fatema]

Yiming Sun <yiming.sun@...> writes:

>
>
> This is good to know, Nate.  Thank you both for the hard work.
>

> -- Y.2012/2/27 Patricio Echagüe <patricioe <at> gmail.com>Yeah. I forgot

we isolated the client management in Hector core. Agree on that it will be
straightforward to implement on our side.
>
>
>
> Is there any ticket in C* JIRa about SSL ?
>
>
> On Mon, Feb 27, 2012 at 1:28 PM, Nate McCall <zznate.m-
Re5JQEeQqe8...@public.gmane.org> wrote:
>
>
>
> SSL is not supported in Cassandra thrift API yet. I took a cursory
> glance at this about 2 months ago, and I don't think it would be that
> hard to hack in to one of the Cassandra thrift transports.
> Unfortunately you cant use the SSLThriftTransport in libthrift out of
> the box because cassandra has a few customizations on the transports
> which will make it incompatible. We already have the actual transport
> layer encapsulated on our side due to Patricio's efforts, so adding an
> SSL impl (which you could then drive from kerberos) would be minimal
> effort on our side.
>
>
>

> On Mon, Feb 27, 2012 at 8:46 PM, Yiming Sun <yiming.sun-
Re5JQEeQqe8...@public.gmane.org> wrote:
> > Okay, thanks!  No problem.
> >
> >
> > 2012/2/27 Patricio Echagüe <patricioe-
Re5JQEeQqe8...@public.gmane.org>

> >>
> >> We currently don't have any other secure mechanism unfortunately. Just
> >> authentication.
> >>
> >> Sent from my Android
> >>

> >> On Feb 27, 2012 12:36 PM, "Yiming Sun" <yiming.sun-

Re5JQEeQqe8...@public.gmane.org> wrote:
> >>>
> >>> Thanks Patricio.  Pardon my ignorance on this, but isn't this just for
> >>> Authentication only? Or are all subsequent communications on data
retrieval
> >>> secured as well?
> >>>
> >>> -- Y.
> >>>

> >>> 2012/2/27 Patricio Echagüe <patricioe-
Re5JQEeQqe8...@public.gmane.org>

> >>>>
> >>>> Yiming, I added Kerberos support a while
> >>>> ago. http://rantav.github.com/hector/build/html/content/security.html
> >>>>
> >>>> I'm not sure if cassandra folks added it to cassandra already. At
least
> >>>> it was part of DataStax Enterprise at that point.
> >>>>
> >>>>

> >>>> On Mon, Feb 27, 2012 at 12:23 PM, Yiming Sun <yiming.sun-
Re5JQEeQqe8...@public.gmane.org>

> >>>> wrote:
> >>>>>
> >>>>> Hello,
> >>>>>
> >>>>> We are using Cassandra to host some confidential data, and Cassandra
> >>>>> does support internode encryption.  However, it is not clear to us
if the
> >>>>> communication between Hector and Cassandra can also be encrypted.  A
quick
> >>>>> search on the subject seems to suggest someone has done this via
openVPN.
> >>>>>  We are just wondering if Hector has (or is planning to support) a
more
> >>>>> direct support for secure communication.  Thanks.
> >>>>>
> >>>>> -- Y.
> >>>>
> >>>>
> >>>
> >
>
>
>
>
>
>
>
>
>
>
>
>

Hi,
I am currently using Hector for communication with Cassandra cluster. I have
the same question that is there any way to encrypt Hector- Cassandra
communication using SSL? If yes, then how can I do that?
Any help will be appreciated.

Thanks,
Fatema.