如何為Ubuntu Kafka配置SSL加密

為Ubuntu Kafka配置SSL加密可以確保數據在傳輸過程中的安全性。以下是詳細的步驟指南：

1. 生成SSL證書和密鑰

首先，你需要生成SSL證書和密鑰?？梢允褂肙penSSL工具來完成這一任務。

生成CA證書

mkdir kafka_ssl
cd kafka_ssl
openssl genrsa -des3 -out ca-key.pem 4096
openssl req -new -x509 -days 3650 -key ca-key.pem -out ca-cert.pem -subj "/C=US/ST=State/L=City/O=Organization/CN=KafkaCA"

生成服務器證書和密鑰

openssl genrsa -des3 -out server-key.pem 2048
openssl req -new -key server-key.pem -out server-req.pem -subj "/C=US/ST=State/L=City/O=Organization/CN=kafka-server"
openssl x509 -req -days 365 -in server-req.pem -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem

生成客戶端證書和密鑰

openssl genrsa -des3 -out client-key.pem 2048
openssl req -new -key client-key.pem -out client-req.pem -subj "/C=US/ST=State/L=City/O=Organization/CN=kafka-client"
openssl x509 -req -days 365 -in client-req.pem -CA ca-cert.pem -CAkey ca-key.pem -set_serial 02 -out client-cert.pem

2. 配置Kafka服務器

編輯Kafka服務器的配置文件server.properties，通常位于/etc/kafka/server.properties。

# 啟用SSL
listeners=SSL://:9093
advertised.listeners=SSL://your_server_ip:9093

# SSL配置
ssl.keystore.location=/path/to/server-keystore.jks
ssl.keystore.password=your_keystore_password
ssl.key.password=your_key_password
ssl.truststore.location=/path/to/server-truststore.jks
ssl.truststore.password=your_truststore_password

# 啟用SSL協議
ssl.protocol=TLSv1.2

# 啟用SASL_SSL
sasl.enabled.mechanisms=PLAIN
security.inter.broker.protocol=SASL_SSL
sasl.mechanism.inter.broker.protocol=PLAIN
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="admin" password="admin-secret";

3. 創建Java KeyStore和TrustStore

使用keytool工具創建Java KeyStore和TrustStore。

創建KeyStore

keytool -import -alias kafka-server -file server-cert.pem -keystore server-keystore.jks -storepass your_keystore_password -storetype JKS

創建TrustStore

keytool -import -alias kafka-ca -file ca-cert.pem -keystore server-truststore.jks -storepass your_truststore_password -storetype JKS

4. 配置Kafka客戶端

編輯Kafka客戶端的配置文件client.properties，通常位于/etc/kafka/client.properties。

# 啟用SSL
security.protocol=SSL

# SSL配置
ssl.truststore.location=/path/to/client-truststore.jks
ssl.truststore.password=your_truststore_password
ssl.keystore.location=/path/to/client-keystore.jks
ssl.keystore.password=your_keystore_password

# 啟用SASL_SSL
sasl.mechanism=PLAIN
security.inter.broker.protocol=SASL_SSL
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="admin" password="admin-secret";

5. 重啟Kafka服務器

完成配置后，重啟Kafka服務器以應用更改。

sudo systemctl restart kafka

6. 驗證SSL連接

使用Kafka客戶端工具驗證SSL連接是否成功。

kafka-console-producer --broker-list your_server_ip:9093 --topic test --property security.protocol=SSL --property ssl.truststore.location=/path/to/client-truststore.jks --property ssl.truststore.password=your_truststore_password --property ssl.keystore.location=/path/to/client-keystore.jks --property ssl.keystore.password=your_keystore_password

通過以上步驟，你應該能夠成功為Ubuntu Kafka配置SSL加密。確保所有路徑和密碼都正確無誤，并且防火墻允許相應的端口通信。