mirror of
https://github.com/zulip/zulip.git
synced 2025-11-03 05:23:35 +00:00
c27324927e
The RabbitMQ docs state ([1]):
RabbitMQ nodes and CLI tools (e.g. rabbitmqctl) use a cookie to
determine whether they are allowed to communicate with each
other. [...] The cookie is just a string of alphanumeric
characters up to 255 characters in size. It is usually stored in a
local file.
...and goes on to state (emphasis ours):
If the file does not exist, Erlang VM will try to create one with
a randomly generated value when the RabbitMQ server starts
up. Using such generated cookie files are **appropriate in
development environments only.**
The auto-generated cookie does not use cryptographic sources of
randomness, and generates 20 characters of `[A-Z]`. Because of a
semi-predictable seed, the entropy of this password is thus less than
the idealized 26^20 = 94 bits of entropy; in actuality, it is 36 bits
of entropy, or potentially as low as 20 if the performance of the
server is known.
These sizes are well within the scope of remote brute-force attacks.
On provision, install, and upgrade, replace the default insecure
20-character Erlang cookie with a cryptographically secure
255-character string (the max length allowed).
[1] https://www.rabbitmq.com/clustering.html#erlang-cookie
40 lines
1.2 KiB
Bash
Executable File
40 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Delete the "guest" default user and replace it with a Zulip user
|
|
# with a real password
|
|
set -eu
|
|
|
|
if [ "$EUID" -eq 0 ]; then
|
|
sudo=()
|
|
else
|
|
sudo=(sudo)
|
|
fi
|
|
|
|
# If the RabbitMQ distribution cookie is insecure, reset it and
|
|
# restart RabbitMQ.
|
|
"${sudo[@]}" "$(dirname "$0")/generate-rabbitmq-cookie"
|
|
|
|
RABBITMQ_USERNAME=$("$(dirname "$0")/../get-django-setting" RABBITMQ_USERNAME)
|
|
RABBITMQ_PASSWORD=$("$(dirname "$0")/../get-django-setting" RABBITMQ_PASSWORD)
|
|
|
|
# Wait for RabbitMQ to start up
|
|
try_ping() {
|
|
# `rabbitmqctl ping` requires 3.7.6 or newer
|
|
out="$("${sudo[@]}" rabbitmqctl eval 'net_adm:ping(node()).')" && [ "$out" = 'pong' ]
|
|
}
|
|
retries=9
|
|
while ! try_ping 2>/dev/null; do
|
|
sleep 1
|
|
if ! ((retries -= 1)); then
|
|
try_ping
|
|
break
|
|
fi
|
|
done
|
|
|
|
"${sudo[@]}" rabbitmqctl delete_user "$RABBITMQ_USERNAME" || true
|
|
"${sudo[@]}" rabbitmqctl delete_user zulip || true
|
|
"${sudo[@]}" rabbitmqctl delete_user guest || true
|
|
"${sudo[@]}" rabbitmqctl add_user "$RABBITMQ_USERNAME" "$RABBITMQ_PASSWORD"
|
|
"${sudo[@]}" rabbitmqctl set_user_tags "$RABBITMQ_USERNAME" administrator
|
|
"${sudo[@]}" rabbitmqctl set_permissions -p / "$RABBITMQ_USERNAME" '.*' '.*' '.*'
|