Securing NSQ

[R.P.]

Does anyone know if there are hardening guidelines/security best practices published for NSQ?

Thanks,
-R

[Matt Reiferson]

This would be a great guide/doc to put together, if you're interested or just want to open an issue on GitHub to track it.

In the meantime, the TLS and Auth docs are the best place to start:

http://nsq.io/components/nsqd.html#tls

[Steven Hartland]

Did you every make any more progress on this?

We're considering nsq for a project but it seems that the entire architecture relies on being on a trusted network as certain key components are not secured.

Items I've noticed
1. nsqd -> Auth Server - This means that you can't auth clients securely.
2. nsqlookupd - Means a remote user can discover your nsq environment without authorisation.

[Matt Reiferson]

Hi Steven,

No, haven't yet put together a doc for this (should probably open an issue on github for this).

And yes, you're right, for communication between certain components NSQ expects a secure network.  However, nsqd -> auth can be configured to use whatever https address you want.

So really it's only nsqd -> nsqlookupd, which we could conceivably address.