Cassandra Authentication for SSL

[Taylor Thomas]

I am working on connecting Kairos to our Cassandra instance that is running SSL. For the life of me I can't find any examples on how to specify the certificate in kairosdb.properties. The only examples are "user" and "password" and I am unsure what the property name is for specifying the ssl configuration. Does anyone have experience with this?

[Benjamin Coetzer]

Hi Taylor Thomas

I'm afraid I don't have much to add in terms of troubleshooting but I'd like to mention that I too have been trying to get KairosDB configured to work with cassandra thats setup with internode and server-client SSL certificates. If you manage to find anything please do let me know - similarly I will do the same.

[Brian Hawkins]

I'm not sure you can setup an SSL connection with hector.  The CQL code I'm working on now will support ssl.

Brian

[Taylor Thomas]

That is great to hear Brian! Do you have a link to the code or a PR somewhere that I can follow along with?

[Brian Hawkins]

feature/cql branch

[Taylor Thomas]

Thanks!

[Matt Potter]

Taylor,

I hit the same issue with the current release version of KairosDB 1.1.3.  My solution probably does not apply to the new beta that uses the native protocol.  Hope it will support SSL too and mention example of how to set that up. 

Anyway here's what worked for me:

1. Grabbed the X.509 CA cert via OpsCenter via LCM link in the Cluster Details for your cluster definition and copied it to my KairosDB machine
2. On the KairosDB machine I created  a Java Keystore using this cert like this: 
1. /opt/jdk1.8.0_141/bin/keytool -import -alias cacert -file ~/.cassandra/cacert.crt -keystore truststore.jks
2. pick a password (exa: foopass)... well maybe pick a 'good' password  8)
3. enter 'yes' to Trust this certificate?
3. Alternative to 1&2 is to grab the existing JKS client truststore file from a DSE node (exa: /etc/dse/keystores/client.keystore) and share the password the admin used to make this for cassandra.   Either way you should now have a JKS truststore file specific to the target cluster you want to connect to on your KairosDB machine.
4. Edit the /opt/kairosdb/bin/kairosdb-env.sh file and add the following -D switches to JAVA_OPTS: 
1. JAVA_OPTS="-Dssl.truststore=/opt/kairosdb/ssl/truststore.jks -Dssl.truststore.password=foopass"
5. service kairosdb restart

I also got tripped up a bit on some confusing reference to the auth key name "user" and "password" in the docs, but the actual settings that worked for the authorization for Cassandra were like this:

kairosdb.datastore.cassandra.auth.username=cassandra
kairosdb.datastore.cassandra.auth.password=randomgibberishdsnfadfsa

Hope this helps.

-Matt

[Matt Potter]

Brain,

Awesome, will give it a try once its released.  Unfortunately I'm required to stick to release distro only so I posted some notes on getting the 1.1.3 over Hector/Thrift working. 

On Thursday, February 9, 2017 at 7:45:22 AM UTC-8, Brian Hawkins wrote: