gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-09 06:39:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(config): restore default credential startup (#3114)

Browse Source 
* fix(config): restore default credential startup

* fix: align e2e credentials with server env

* fix(config): restore default credential consistency

---------

Co-authored-by: houseme <housemecn@gmail.com>
This commit is contained in:
安正超
2026-05-29 19:52:46 +08:00
committed by GitHub
parent 5d74637968
commit ac97ceb744
18 changed files with 87 additions and 139 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rustfs/src/config/config_struct.rs
-5
View File
@@ -24,7 +24,6 @@ use rustfs_config::{
};
use rustfs_credentials::{DEFAULT_ACCESS_KEY, DEFAULT_SECRET_KEY, Masked};
use std::collections::HashSet;
use std::net::SocketAddr;
use std::sync::{Mutex, OnceLock};
pub(crate) const LEGACY_ENV_RUSTFS_ROOT_USER: &str = "RUSTFS_ROOT_USER";
@@ -179,10 +178,6 @@ impl Config {
DEFAULT_ACCESS_KEY.eq(&self.access_key) && DEFAULT_SECRET_KEY.eq(&self.secret_key)
}
pub fn default_credentials_allowed_for_addr(&self, server_addr: SocketAddr, allow_insecure_defaults: bool) -> bool {
!self.is_using_default_credentials() || server_addr.ip().is_loopback() || allow_insecure_defaults
}
/// Create Config from Opt
pub(super) fn from_opt(opt: Opt) -> std::io::Result<Self> {
let Opt {
rustfs/src/config/config_test.rs
-18
View File
@@ -141,24 +141,6 @@ mod tests {
assert_eq!(config.buffer_profile, "GeneralPurpose");
}
#[test]
fn default_credentials_allowed_only_for_loopback_or_explicit_opt_in() {
let config = Config::new("0.0.0.0:9000", vec!["/tmp/rustfs-vol1".to_string()]);
assert!(!config.default_credentials_allowed_for_addr("0.0.0.0:9000".parse().unwrap(), false));
assert!(config.default_credentials_allowed_for_addr("127.0.0.1:9000".parse().unwrap(), false));
assert!(config.default_credentials_allowed_for_addr("0.0.0.0:9000".parse().unwrap(), true));
}
#[test]
fn custom_credentials_allowed_on_non_loopback() {
let mut config = Config::new("0.0.0.0:9000", vec!["/tmp/rustfs-vol1".to_string()]);
config.access_key = "custom-access-key".to_string();
config.secret_key = "custom-secret-key".to_string();
assert!(config.default_credentials_allowed_for_addr("0.0.0.0:9000".parse().unwrap(), false));
}
#[test]
#[serial]
fn test_custom_console_configuration() {
rustfs/src/embedded.rs
+2 -12
View File
@@ -55,7 +55,6 @@ use crate::server::{
};
use crate::startup_fs_guard::enforce_unsupported_fs_policy;
use rustfs_common::{GlobalReadiness, SystemStage, set_global_addr};
use rustfs_config::ENV_RUSTFS_ALLOW_INSECURE_DEFAULT_CREDENTIALS;
use rustfs_credentials::init_global_action_credentials;
use rustfs_ecstore::store::init_lock_clients;
use rustfs_ecstore::{
@@ -77,7 +76,7 @@ use rustfs_ecstore::{
};
use rustfs_iam::init_iam_sys;
use rustfs_obs::{init_obs, set_global_guard};
use rustfs_utils::{get_env_bool, net::parse_and_resolve_address};
use rustfs_utils::net::parse_and_resolve_address;
use rustls::crypto::aws_lc_rs::default_provider;
use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr};
use std::path::{Path, PathBuf};
@@ -308,8 +307,7 @@ impl RustFSServerBuilder {
// Trusted proxies.
rustfs_trusted_proxies::init();
// Resolve listen address before credential initialization so unsafe
// default credentials can fail before the server binds a listener.
// Resolve listen address before endpoint/global initialization.
let server_addr =
parse_and_resolve_address(config.address.as_str()).map_err(|e| ServerError::Init(format!("address: {e}")))?;
@@ -322,14 +320,6 @@ impl RustFSServerBuilder {
));
}
let allow_insecure_defaults = get_env_bool(ENV_RUSTFS_ALLOW_INSECURE_DEFAULT_CREDENTIALS, false);
if !config.default_credentials_allowed_for_addr(server_addr, allow_insecure_defaults) {
return Err(ServerError::Init(
"default root credentials are not allowed on non-loopback listeners; set access_key and secret_key to non-default values, bind to loopback, or set RUSTFS_ALLOW_INSECURE_DEFAULT_CREDENTIALS=true for local development only"
.to_string(),
));
}
// Credentials.
init_global_action_credentials(Some(config.access_key.clone()), Some(config.secret_key.clone()))
.map_err(|e| ServerError::Init(format!("credentials: {e:?}")))?;
rustfs/src/main.rs
+6 -20
View File
@@ -36,7 +36,6 @@ use rustfs::server::{
};
use rustfs::startup_fs_guard::enforce_unsupported_fs_policy;
use rustfs_common::{GlobalReadiness, SystemStage, set_global_addr};
use rustfs_config::ENV_RUSTFS_ALLOW_INSECURE_DEFAULT_CREDENTIALS;
use rustfs_credentials::init_global_action_credentials;
use rustfs_ecstore::store::init_lock_clients;
use rustfs_ecstore::{
@@ -62,7 +61,7 @@ use rustfs_iam::{init_iam_sys, init_oidc_sys};
use rustfs_obs::{init_metrics_runtime, init_obs, set_global_guard};
use rustfs_scanner::init_data_scanner;
use rustfs_utils::{
ExternalEnvCompatReport, apply_external_env_compat, get_env_bool, get_env_bool_with_aliases, net::parse_and_resolve_address,
ExternalEnvCompatReport, apply_external_env_compat, get_env_bool_with_aliases, net::parse_and_resolve_address,
};
use rustls::crypto::aws_lc_rs::default_provider;
use std::io::{Error, Result};
@@ -135,12 +134,7 @@ fn is_using_default_credentials(config: &rustfs::config::Config) -> bool {
config.is_using_default_credentials()
}
const DEFAULT_CREDENTIALS_WARNING_MESSAGE: &str = "Detected default root credentials; set RUSTFS_ACCESS_KEY and RUSTFS_SECRET_KEY to non-default values, or use RUSTFS_ALLOW_INSECURE_DEFAULT_CREDENTIALS=true only for local development";
const DEFAULT_CREDENTIALS_ERROR_MESSAGE: &str = "Default root credentials are not allowed on non-loopback listeners; set RUSTFS_ACCESS_KEY and RUSTFS_SECRET_KEY to non-default values, bind to loopback, or set RUSTFS_ALLOW_INSECURE_DEFAULT_CREDENTIALS=true for local development only";
fn allow_insecure_default_credentials() -> bool {
get_env_bool(ENV_RUSTFS_ALLOW_INSECURE_DEFAULT_CREDENTIALS, false)
}
const DEFAULT_CREDENTIALS_WARNING_MESSAGE: &str = "Detected default root credentials; set RUSTFS_ACCESS_KEY and RUSTFS_SECRET_KEY to non-default values for production deployments";
async fn async_main() -> Result<()> {
// Parse command line arguments
@@ -275,11 +269,6 @@ async fn run(config: rustfs::config::Config) -> Result<()> {
let server_port = server_addr.port();
let server_address = server_addr.to_string();
if !config.default_credentials_allowed_for_addr(server_addr, allow_insecure_default_credentials()) {
error!("{DEFAULT_CREDENTIALS_ERROR_MESSAGE}");
return Err(Error::other(DEFAULT_CREDENTIALS_ERROR_MESSAGE));
}
if is_using_default_credentials(&config) {
warn!("{}", DEFAULT_CREDENTIALS_WARNING_MESSAGE);
}
@@ -826,12 +815,9 @@ mod tests {
#[test]
fn default_credentials_messages_are_actionable_without_exposing_values() {
for message in [DEFAULT_CREDENTIALS_WARNING_MESSAGE, DEFAULT_CREDENTIALS_ERROR_MESSAGE] {
assert!(message.contains(rustfs_config::ENV_RUSTFS_ACCESS_KEY));
assert!(message.contains(rustfs_config::ENV_RUSTFS_SECRET_KEY));
assert!(message.contains(ENV_RUSTFS_ALLOW_INSECURE_DEFAULT_CREDENTIALS));
assert!(!message.contains(rustfs_credentials::DEFAULT_ACCESS_KEY));
assert!(!message.contains(rustfs_credentials::DEFAULT_SECRET_KEY));
}
assert!(DEFAULT_CREDENTIALS_WARNING_MESSAGE.contains(rustfs_config::ENV_RUSTFS_ACCESS_KEY));
assert!(DEFAULT_CREDENTIALS_WARNING_MESSAGE.contains(rustfs_config::ENV_RUSTFS_SECRET_KEY));
assert!(!DEFAULT_CREDENTIALS_WARNING_MESSAGE.contains(rustfs_credentials::DEFAULT_ACCESS_KEY));
assert!(!DEFAULT_CREDENTIALS_WARNING_MESSAGE.contains(rustfs_credentials::DEFAULT_SECRET_KEY));
}
}