Skip to main content Link Menu Expand (external link) Document Search Copy Copied
DevSecOps Guides

GlusterFS Hardening for DevSecOps

Table of contents

  1. Disable insecure management protocols
  2. Enable SSL encryption for management
  3. Limit access to trusted clients
  4. Enable client-side SSL encryption
  5. Enable authentication for client connections
  6. Set proper permissions for GlusterFS files and directories
  7. Disable root access to GlusterFS volumes
  8. Enable TLS encryption for GlusterFS traffic
  9. Monitor GlusterFS logs for security events

List of some best practices to harden GlusterFS for DevSecOps

Disable insecure management protocols

gluster volume set <volname> network.remote-dio.disable on

Enable SSL encryption for management

gluster volume set <volname> network.remote.ssl-enabled on

Limit access to trusted clients

gluster volume set <volname> auth.allow <comma-separated list of trusted IPs>

Enable client-side SSL encryption

gluster volume set <volname> client.ssl on

Enable authentication for client connections

gluster volume set <volname> client.auth on

Set proper permissions for GlusterFS files and directories

chown -R root:glusterfs /etc/glusterfs /var/lib/glusterd /var/log/glusterfs

Disable root access to GlusterFS volumes

gluster volume set <volname> auth.reject-unauthorized on

Enable TLS encryption for GlusterFS traffic

gluster volume set <volname> transport-type

Monitor GlusterFS logs for security events

tail -f /var/log/glusterfs/glusterd.log