Security

Overview
General security considerations are described below.
For data security features, such as encryption via KMS, refer to the KMS Management section.
For security around mounting and separation of organizations, refer to the Organizations section.
Different user roles and AD/LDAP authentication is described in the User Management section.
Obtaining an Authentication Token
An authentication token is used to access the Weka cluster API, and allow mounting secure filesystems.
It is first required to log in to obtain an access token. Log in via the CLI (using the weka user login CLI command, a token file is created in ~/.weka/auth-token.json) or via the API (using the POST /login API).
This provides an access token to be used to authenticate the command, as long as a longer-lived refresh-token, to allow re-obtaining additional access-tokens without providing the username/password again.
Access-Token for API usage
When working with REST API, it is sometimes desired to use a longer-lived token (one that doesn't require a refresh every 5 minutes). It is possible to generate such a token for internal Weka users using the weka user generate-token [--access-token-timeout timeout] CLI command (default to  30 days).
Access-tokens are revoked when calling the weka user revoke-tokens CLI command. 
TLS
By default, the Weka system deploys a self-signed certificate to access the GUI, CLI, and API via HTTPS.
The Weka system allows using only TLS 1.2 and higher with at least 128-bit ciphers.
You can deploy your certificates using the weka security tls set CLI command. The command receives an unencrypted private key.
For example, this is a similar command to what Weka uses to generate the self-signed certificate using  OpenSSL:openssl req -x509 -newkey rsa:1024 -keyout key.pem -out cert.pem -days <days> -nodes
Certificate Replacement/Rotation
To replace the certificate, use the weka security tls set CLI command to set a new one. Once a certificate has been issued, it is used for connecting to the cluster (for the time it has been issued), while the revocation is handled by the CA and propagating its revocation lists into the various clients.
Custom CA Certificates
Weka uses well-known CAs to establish trust with external services, e.g., when using a KMS. If a different CA is required for Weka servers to establish trust, use weka security ca-cert set CLI command to install this custom CA certificate on the Weka servers.
Password Management
Password Requirements
at least 8 characters
an uppercase letter
a lowercase letter
a number or a special character
The First User created by default is admin (with admin password), and the password is prompt to change on the first login.
Account Lockout
To prevent brute force attacks, if several login attempts fail (5 by default), the user account will be locked out for several minutes (2 by default).
The defaults can be controlled using the weka security lockout-config show/set/reset CLI commands. 
GUI
The Weka GUI is (only) accessible from the backend servers via port 14000.
The GUI session will automatically be terminated, and the user will get logged out after 30 minutes of inactivity.
Security Login Statement
It is possible to set a security/legal login statement that will add a banner with that statement on the GUI login page.
To set the statement, use the weka security login-banner set|show|reset|enable|disable CLI command or the GUI Login Banner menu. 

Operation Guide - Previous

System Congestion

User Management

Last modified 3mo ago

Copy link

Contents

Overview

Obtaining an Authentication Token

TLS

Certificate Replacement/Rotation

Custom CA Certificates

Password Management

Password Requirements

Account Lockout

GUI

Security Login Statement