Implement ZooKeeper Security in Spring Boot Microservices

Apache ZooKeeper is widely used for distributed coordination, configuration management, and service discovery in microservices architectures. However, its core design doesn’t inherently prioritize security, making ZooKeeper instances vulnerable to attacks if not properly secured. From enabling encrypted communication to implementing strict authentication and authorization mechanisms, you can ensure your ZooKeeper nodes and interactions are safeguarded in exposed environments.

This blog explores critical aspects of securing Apache ZooKeeper within Spring-based microservices, including TLS/SSL encryption, SASL authentication, znode access control, and integration with Spring Security.

Table of Contents

1. Why Security in ZooKeeper Matters
2. Enabling TLS/SSL in ZooKeeper
3. Using SASL for Authentication
4. Securing Znode Access
5. Integrating Spring Security with ZooKeeper
6. Official Documentation Links
7. Summary

Why Security in ZooKeeper Matters

By default, ZooKeeper communication occurs in plaintext, making it susceptible to man-in-the-middle (MITM) attacks, eavesdropping, and unauthorized modifications. Similarly, without authentication and access control, users or services can maliciously modify or delete znodes, potentially destabilizing entire applications.

Critical threats include:

• Unauthorized Access: Attackers can write to znodes or delete critical metadata, causing service disruptions.
• Data Theft: Without encryption, sensitive configuration data transmitted between ZooKeeper servers can be intercepted.
• Exploitation of Open Connections: Public-facing ZooKeeper instances can be exploited by attackers to bring down services.

These risks make ZooKeeper security non-negotiable for production-grade Spring microservices.

Key Principles of ZooKeeper Security:

1. Encrypted Communication: Prevent eavesdropping during data transmission using TLS/SSL.
2. Authentication: Ensure only authorized clients can interact with ZooKeeper using SASL.
3. Access Control: Restrict access to znodes based on roles and permissions.
4. Integration with Application Security: Leverage Spring Security for controlled ZooKeeper interactions.

With these fundamentals in mind, let’s explore each aspect of ZooKeeper security in detail.

Enabling TLS/SSL in ZooKeeper

Securing communication between ZooKeeper clients and servers begins with enabling TLS/SSL encryption.

Step 1. Generate TLS Certificates

Use tools like OpenSSL to create a certificate and private key. For production, ensure the certificates are signed by a trusted Certificate Authority (CA).

Generate a Self-Signed Certificate:

openssl genrsa -out zookeeper-key.pem 2048
openssl req -new -key zookeeper-key.pem -out zookeeper.csr
openssl x509 -req -days 365 -in zookeeper.csr -signkey zookeeper-key.pem -out zookeeper-cert.pem

Step 2. Update ZooKeeper Configuration

Edit the ZooKeeper configuration file (zoo.cfg) to enable TLS:

tickTime=2000
dataDir=/var/lib/zookeeper
clientPort=2181

secureClientPort=2281
serverCnxnFactory=org.apache.zookeeper.server.NettyServerCnxnFactory
ssl.keyStore.location=/path/to/keystore.jks
ssl.keyStore.password=your-keystore-password
ssl.trustStore.location=/path/to/truststore.jks
ssl.trustStore.password=your-truststore-password

• secureClientPort: Specifies the port for secure communication.
• KeyStore and TrustStore: Store client and server certificates securely.

Step 3. Configure Client-Side TLS

Clients connecting to ZooKeeper must also be configured for SSL. With Apache Curator:

CuratorFramework client = CuratorFrameworkFactory.builder()
    .connectString("localhost:2281")
    .namespace("secure-namespace")
    .sslContext(SSLContext.getDefault())
    .retryPolicy(new ExponentialBackoffRetry(1000, 3))
    .build();
client.start();

Enabling TLS ensures all communication is encrypted, reducing exposure to network-level attacks.

Using SASL for Authentication

ZooKeeper can authenticate clients using the Simple Authentication and Security Layer (SASL), commonly integrated with Kerberos for enterprise environments.

Step 1. Enable SASL on ZooKeeper Servers

Modify the zoo.cfg file to enable SASL-based authentication:

authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider
requireClientAuthScheme=sasl

Step 2. Create a JAAS Configuration File

Configure the jaas.conf file for both ZooKeeper servers and clients.

JAAS Configuration for Servers:

Server {
    com.sun.security.auth.module.Krb5LoginModule required
    useKeyTab=true
    keyTab="/etc/security/keytabs/zookeeper.keytab"
    storeKey=true
    useTicketCache=false
    principal="zookeeper/[email protected]";
};

JAAS Configuration for Clients:

Client {
    com.sun.security.auth.module.Krb5LoginModule required
    useTicketCache=true
    principal="[email protected]";
};

Step 3. Pass SASL Settings to ZooKeeper

Set the java.security.auth.login.config system property to point to the JAAS configuration:

-Djava.security.auth.login.config=/path/to/jaas.conf

SASL ensures only authenticated clients can interact with ZooKeeper, preventing unauthorized access.

Securing Znode Access

Even with authentication, unauthorized clients might still attempt to manipulate znodes. You can restrict znode access using ZooKeeper’s Access Control List (ACL) mechanism.

Znode Permissions

ZooKeeper ACLs define who can:

• READ (view the node data and its children)
• WRITE (modify the node’s data)
• CREATE (add children znodes)
• DELETE (remove the node)
• ADMIN (set ACLs)

Example of Setting ACLs

Define ACL permissions programmatically:

List<ACL> acls = ZooDefs.Ids.CREATOR_ALL_ACL;
client.create().withACL(acls).forPath("/secure-node", "data".getBytes());

• Use Ids.READ_ACL_UNSAFE for read-only access.
• Use Ids.CREATOR_ALL_ACL to restrict access to the creator.

Applying ACLs to Existing Nodes

Update ACLs for an existing znode:

client.setACL().withACL(ZooDefs.Ids.READ_ACL_UNSAFE).forPath("/secure-node");

By securing znodes, you prevent sensitive configuration data or metadata from being tampered with.

Integrating Spring Security with ZooKeeper

For applications relying on secure ZooKeeper interactions, you can integrate Spring Security to manage access to ZooKeeper resources.

Step 1. Define Roles for ZooKeeper Access

Create custom roles such as ZK_ADMIN or ZK_USER for users interacting with ZooKeeper.

Step 2. Protect Services Using Spring Security

Use method-level security annotations to restrict ZooKeeper actions to authorized users:

@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .antMatchers("/zookeeper/admin/**").hasRole("ZK_ADMIN")
            .antMatchers("/zookeeper/read/**").hasRole("ZK_USER")
            .anyRequest().authenticated();
    }
}

Step 3. Secure Key ZooKeeper Operations

Use @PreAuthorize to protect ZooKeeper methods:

@PreAuthorize("hasRole('ZK_ADMIN')")
public void createZnode(String path, String data) throws Exception {
    client.create().forPath(path, data.getBytes());
}

Spring Security adds an application-level layer of protection for ZooKeeper interactions, enforcing granular access control.

Official Documentation Links

1. Apache ZooKeeper Documentation: ZooKeeper Docs
2. Spring Security Documentation: Spring Security Docs

Refer to these resources for more details on implementing security in Apache ZooKeeper and Spring.

Summary

Securing Apache ZooKeeper is essential to prevent unauthorized access, tampering, and data breaches in distributed systems. From encrypted communication to fine-grained access control, implementing these security measures ensures a robust architecture.

Key Takeaways:

1. TLS/SSL Encryption: Encrypt all ZooKeeper communication to safeguard data in transit.
2. SASL Authentication: Authenticate ZooKeeper clients using Kerberos and JAAS.
3. Znode Access Control: Use ACLs to limit sensitive znode operations based on roles.
4. Spring Security Integration: Extend application-level security controls to ZooKeeper actions.

Implement these strategies to strengthen your ZooKeeper-backed Spring microservices architecture against evolving security threats. Start adopting these practices today for a secure and reliable environment!