apache / apache/accumulo

Configuring Monitor for SSL does not disable non-SSL connections

Open
#4,974 0 comments 0 reactions 0 assignees View on GitHub
question
Dominant language
Java
Stars
1.2k
Forks
487
Avg merge
4d 5h
Merged PRs (30d)
13

Description

If the monitor is configured for SSL/TLS (https), is the intention for non-SSL (http) connections to also be allowed? Looking at EmbeddedWebServer, that appears to be what is happening. It looks like this [change](https://github.com/apache/accumulo/commit/7bb91ede4804ce72b7dbf295588bdfa130599e0c#diff-3f45dc66d2fbab477712887fdc887b44b1e6484eb4fbaa9bb6e96576f7e03c03) was made in 2.0 and closed a ticket having to do with MonitorSslIT failing.

Contributor guide

Open the contributing guide

Research direction

Start by reading EmbeddedWebServer and the MonitorSslIT test, then review commit 7bb91ede4804ce72b7dbf295588bdfa130599e0c to understand the current SSL configuration behavior. Confirm the intended policy for HTTP when HTTPS is configured and make the test and implementation agree; done means the monitor’s accepted connections match that policy.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.