通过Openresty拦截Cerebro界面的危险操作

保持热爱奔赴山海

发布于 2022-01-11 13:33:36

5290

发布于 2022-01-11 13:33:36

文章被收录于专栏：饮水机管理员饮水机管理员

背景：

最近出现一起因为误操作导致ES Index数据丢失的事件，引发一些列的反思和复盘。

需求：

拦截掉cerebro界面上，对后端ES可能造成危险的操作，避免再出现类似情况出现。

实现：

这里使用nginx+lua来根据query来拦截。简单起见我们直接安装openresty来实现本次需求。

架构调整：

实现细节：

nginx.conf 配置文件如下：

user nginx;
worker_processes  4;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
error_log  logs/error.log  info;

pid        logs/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
                      
    # 增加一个log_format，注意这里我开启了request_body的记录功能（生产的nginx的vserver上一般不开的，因为body可能比较大，影响nginx的性能）
    log_format  cerebro  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"  "$request_body"';     
                                             
    access_log  logs/access.log  main;

    sendfile        on;
    keepalive_timeout  120;


    gzip on;
    gzip_min_length 1k;
    gzip_buffers 4 32k;
    gzip_http_version 1.1;
    gzip_comp_level 5;
    gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript;
    gzip_vary on;
    gzip_proxied any;
    gzip_disable "MSIE [1-6]\.";

	proxy_buffer_size 8k;
	proxy_buffering on;
	client_header_buffer_size 8k;
	client_body_buffer_size 8k;
	proxy_request_buffering on;
	proxy_cache_lock on;
	proxy_cache_use_stale updating;

	include /usr/local/openresty-1.19.3.2/nginx/conf/conf.d/*.conf;


}

cerebro_proxy.conf 配置文件如下：

server {
  listen 9111;
  access_log /var/log/nginx/cerebro_proxy_access.log cerebro ;
  error_log /var/log/nginx/cerebro_proxy_err.log;

  root /usr/share/nginx/html;

  location / {
	default_type application/json;
	       # 说明： 192.168.2.4:9001 是我的cerebro的监听地址
        proxy_pass http://192.168.2.4:9001;
        proxy_set_header   Host             $host;
        proxy_set_header   X-Real-IP        $remote_addr;
        proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
  }

	# overview界面的危险操作全部拦截掉
	location /overview/delete_indices {
		return 403;
	}
	location /overview/close_indices {
		return 403;
	}
	location /overview/force_merge {
		return 403;
	}
	location /overview/flush_indices {
		return 403;
	}
	location /overview/refresh_indices {
		return 403;
	}
	location /overview/clear_indices_cache {
		return 403;
	}

  # 对于rest界面的请求进行的拦截
  location /rest/request {
	default_type application/json;

	lua_need_request_body on;
	access_by_lua_block {
		local data1 = ngx.req.get_body_data()

		-- 拦截纯DELETE操作
		result1 = string.match(data1, "DELETE")
		if result1 == "DELETE" then
			ngx.exit(403)
		end

		-- 拦截_delete_by_query并且是match_all的操作
		result2 = string.match(data1, "_delete_by_query")
		result3 = string.match(data1, "match_all")
		result4 = string.match(data1, "POST")
		if result2 == "_delete_by_query" and result3 == "match_all" and result4 == "POST" then
			ngx.exit(403)
		end
	}

  proxy_pass http://192.168.2.4:9001;
  proxy_set_header   Host             $host;
  proxy_set_header   X-Real-IP        $remote_addr;
  proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
  }

}

核心配置就上面的access_by_lua_block段内的内容。

效果演示：

1、原始数据有3条