Kafka 安全配置实战：SASL/SSL 认证、ACL 授权与 TLS 加密传输
Kafka 作为分布式消息队列系统，在生产环境中需要确保数据的安全性和访问控制。本文将详细介绍 Kafka 安全配置的三个关键方面：SASL/SSL 认证、ACL 授权与 TLS 加密传输。这些机制共同构建了一个完整的 Kafka 安全体系，保护数据传输过程中的机密性、完整性和访问权限控制。
1. SASL/SSL 认证配置实战
SASL (Simple Authentication and Security Layer) 是一种用于认证的网络协议，而 SSL (Secure Sockets Layer) 提供加密通信。在 Kafka 中，SASL/SSL 结合使用可以确保客户端与代理之间的安全通信。
配置步骤
# 创建 CA
openssl req -x509 -newkey rsa:4096 -keyout ca-key -out ca-cert -days 365 -nodes -subj "/CN=Kafka-CA"
# 创建服务器证书
openssl req -newkey rsa:2048 -nodes -keyout server-key -out server-req -subj "/CN=kafka-server"
openssl x509 -req -in server-req -CA ca-cert -CAkey ca-key -CAcreateserial -out server-cert -days 365
# 创建客户端证书
openssl req -newkey rsa:2048 -nodes -keyout client-key -out client-req -subj "/CN=kafka-client"
openssl x509 -req -in client-req -CA ca-cert -CAkey ca-key -CAcreateserial -out client-cert -days 365
# server.properties
listeners=SASL_SSL://:9093
security.protocol=SASL_SSL
ssl.truststore.location=/path/to/truststore.jks
ssl.truststore.password=truststore-password
ssl.keystore.location=/path/to/keystore.jks
ssl.keystore.password=keystore-password
ssl.key.password=key-password
sasl.enabled.mechanisms=PLAIN,SCRAM-SHA-256,SCRAM-SHA-512
sasl.mechanism.inter.broker.protocol=PLAIN
# JAAS 配置 (kafka_server_jaas.conf)
KafkaServer {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="admin"
password="admin-secret"
user_admin="admin-secret"
user_alice="alice-secret";
};
# producer.properties 和 consumer.properties
security.protocol=SASL_SSL
sasl.mechanism=PLAIN
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="alice" password="alice-secret";
ssl.truststore.location=/path/to/truststore.jks
ssl.truststore.password=truststore-password
2. ACL 授权策略实现
ACL (Access Control List) 是 Kafka 中的访问控制机制，用于精细化管理用户对主题、消费者组等资源的访问权限。
配置步骤
# server.properties
authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer
allow.everyone.if.no.acl.found=false
super.users=User:admin
# 为用户 Alice 授予主题 test-topic 的读写权限
kafka-acls –authorizer-properties zookeeper.connect=localhost:2181 \\
–add –allow-principal User:alice –allow-host * \\
–operation Read –operation Write –topic test-topic
# 为用户 Bob 授予消费者组的消费权限
kafka-acls –authorizer-properties zookeeper.connect=localhost:2181 \\
–add –allow-principal User:bob –allow-host * \\
–operation Read –group test-group
# 列出所有 ACL 规则
kafka-acls –authorizer-properties zookeeper.connect=localhost:2181 –list
# 删除 ACL 规则
kafka-acls –authorizer-properties zookeeper.connect=localhost:2181 \\
–remove –allow-principal User:alice –allow-host * \\
–operation Read –topic test-topic
3. TLS 加密传输配置指南
TLS (Transport Layer Security) 用于加密客户端与 Kafka 服务器之间的通信，防止数据在传输过程中被窃听或篡改。
配置步骤
# server.properties
listeners=SSL://:9092
security.protocol=SSL
ssl.truststore.location=/path/to/truststore.jks
ssl.truststore.password=truststore-password
ssl.keystore.location=/path/to/keystore.jks
ssl.keystore.password=keystore-password
ssl.key.password=key-password
ssl.enabled.protocols=TLSv1.2,TLSv1.3
ssl.keystore.type=JKS
ssl.truststore.type=JKS
# producer.properties 和 consumer.properties
security.protocol=SSL
ssl.truststore.location=/path/to/truststore.jks
ssl.truststore.password=truststore-password
ssl.keystore.location=/path/to/keystore.jks
ssl.keystore.password=keystore-password
ssl.key.password=key-password
ssl.endpoint.identification.algorithm=https
4. 完整示例与注意事项
下面是一个结合 SASL/SSL 认证、ACL 授权与 TLS 加密传输的完整配置示例：
服务器配置示例
# server.properties
listeners=SASL_SSL://:9093
security.protocol=SASL_SSL
ssl.truststore.location=/path/to/kafka-truststore.jks
ssl.truststore.password=123456
ssl.keystore.location=/path/to/kafka-keystore.jks
ssl.keystore.password=123456
ssl.key.password=123456
sasl.enabled.mechanisms=PLAIN
sasl.mechanism.inter.broker.protocol=PLAIN
authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer
allow.everyone.if.no.acl.found=false
super.users=User:admin
客户端配置示例
# producer.properties 和 consumer.properties
bootstrap.servers=kafka1:9093,kafka2:9093,kafka3:9093
security.protocol=SASL_SSL
sasl.mechanism=PLAIN
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="alice" password="alice-secret";
ssl.truststore.location=/path/to/client-truststore.jks
ssl.truststore.password=123456
生产者代码示例
Properties props = new Properties();
props.put("bootstrap.servers", "kafka1:9093,kafka2:9093,kafka3:9093");
props.put("security.protocol", "SASL_SSL");
props.put("sasl.mechanism", "PLAIN");
props.put("sasl.jaas.config", "org.apache.kafka.common.security.plain.PlainLoginModule required username=\\"alice\\" password=\\"alice-secret\\"");
props.put("ssl.truststore.location", "/path/to/client-truststore.jks");
props.put("ssl.truststore.password", "123456");
props.put("key.serializer", "org.apache.kafka.common.serialization.StringSerializer");
props.put("value.serializer", "org.apache.kafka.common.serialization.StringSerializer");
Producer<String, String> producer = new KafkaProducer<>(props);
producer.send(new ProducerRecord<>("test-topic", "key", "value"));
producer.close();
注意事项
安全配置工作流程
#publish-mermaid-1788402889880-0{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#publish-mermaid-1788402889880-0 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#publish-mermaid-1788402889880-0 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#publish-mermaid-1788402889880-0 .error-icon{fill:#552222;}#publish-mermaid-1788402889880-0 .error-text{fill:#552222;stroke:#552222;}#publish-mermaid-1788402889880-0 .edge-thickness-normal{stroke-width:1px;}#publish-mermaid-1788402889880-0 .edge-thickness-thick{stroke-width:3.5px;}#publish-mermaid-1788402889880-0 .edge-pattern-solid{stroke-dasharray:0;}#publish-mermaid-1788402889880-0 .edge-thickness-invisible{stroke-width:0;fill:none;}#publish-mermaid-1788402889880-0 .edge-pattern-dashed{stroke-dasharray:3;}#publish-mermaid-1788402889880-0 .edge-pattern-dotted{stroke-dasharray:2;}#publish-mermaid-1788402889880-0 .marker{fill:#333333;stroke:#333333;}#publish-mermaid-1788402889880-0 .marker.cross{stroke:#333333;}#publish-mermaid-1788402889880-0 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#publish-mermaid-1788402889880-0 p{margin:0;}#publish-mermaid-1788402889880-0 .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#publish-mermaid-1788402889880-0 .cluster-label text{fill:#333;}#publish-mermaid-1788402889880-0 .cluster-label span{color:#333;}#publish-mermaid-1788402889880-0 .cluster-label span p{background-color:transparent;}#publish-mermaid-1788402889880-0 .label text,#publish-mermaid-1788402889880-0 span{fill:#333;color:#333;}#publish-mermaid-1788402889880-0 .node rect,#publish-mermaid-1788402889880-0 .node circle,#publish-mermaid-1788402889880-0 .node ellipse,#publish-mermaid-1788402889880-0 .node polygon,#publish-mermaid-1788402889880-0 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#publish-mermaid-1788402889880-0 .rough-node .label text,#publish-mermaid-1788402889880-0 .node .label text,#publish-mermaid-1788402889880-0 .image-shape .label,#publish-mermaid-1788402889880-0 .icon-shape .label{text-anchor:middle;}#publish-mermaid-1788402889880-0 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#publish-mermaid-1788402889880-0 .rough-node .label,#publish-mermaid-1788402889880-0 .node .label,#publish-mermaid-1788402889880-0 .image-shape .label,#publish-mermaid-1788402889880-0 .icon-shape .label{text-align:center;}#publish-mermaid-1788402889880-0 .node.clickable{cursor:pointer;}#publish-mermaid-1788402889880-0 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#publish-mermaid-1788402889880-0 .arrowheadPath{fill:#333333;}#publish-mermaid-1788402889880-0 .edgePath .path{stroke:#333333;stroke-width:1px;}#publish-mermaid-1788402889880-0 .flowchart-link{stroke:#333333;fill:none;}#publish-mermaid-1788402889880-0 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-1788402889880-0 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#publish-mermaid-1788402889880-0 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-1788402889880-0 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#publish-mermaid-1788402889880-0 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#publish-mermaid-1788402889880-0 .cluster text{fill:#333;}#publish-mermaid-1788402889880-0 .cluster span{color:#333;}#publish-mermaid-1788402889880-0 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#publish-mermaid-1788402889880-0 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#publish-mermaid-1788402889880-0 rect.text{fill:none;stroke-width:0;}#publish-mermaid-1788402889880-0 .icon-shape,#publish-mermaid-1788402889880-0 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-1788402889880-0 .icon-shape p,#publish-mermaid-1788402889880-0 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#publish-mermaid-1788402889880-0 .icon-shape .label rect,#publish-mermaid-1788402889880-0 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-1788402889880-0 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#publish-mermaid-1788402889880-0 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#publish-mermaid-1788402889880-0 .node .neo-node{stroke:#9370DB;}#publish-mermaid-1788402889880-0 [data-look=\”neo\”].node rect,#publish-mermaid-1788402889880-0 [data-look=\”neo\”].cluster rect,#publish-mermaid-1788402889880-0 [data-look=\”neo\”].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1788402889880-0 [data-look=\”neo\”].swimlane.cluster rect{filter:none;}#publish-mermaid-1788402889880-0 [data-look=\”neo\”].node path{stroke:#9370DB;stroke-width:1px;}#publish-mermaid-1788402889880-0 [data-look=\”neo\”].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1788402889880-0 [data-look=\”neo\”].node .neo-line path{stroke:#9370DB;filter:none;}#publish-mermaid-1788402889880-0 [data-look=\”neo\”].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1788402889880-0 [data-look=\”neo\”].node circle .state-start{fill:#000000;}#publish-mermaid-1788402889880-0 [data-look=\”neo\”].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1788402889880-0 [data-look=\”neo\”].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1788402889880-0 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}是否是否
客户端发起请求
SSL/TLS握手建立加密通道
SASL身份验证
验证用户身份
身份是否有效？
应用ACL规则检查权限
拒绝访问并记录日志
用户是否有权限？
处理请求并返回结果
安全配置参数对比表
| 安全机制 | 关键参数 | 用途 | 常见配置值 |
|———|———|——|———–|
| SASL/SSL | security.protocol | 定义客户端与代理之间的通信协议 | SASL_SSL, SSL |
| SASL/SSL | sasl.mechanism | 定义SASL认证机制 | PLAIN, SCRAM-SHA-256, SCRAM-SHA-512 |
| SASL/SSL | ssl.truststore.location | 指定信任库文件路径 | /path/to/truststore.jks |
| SASL/SSL | ssl.keystore.location | 指定密钥库文件路径 | /path/to/keystore.jks |
| ACL | authorizer.class.name | 指定ACL实现类 | kafka.security.auth.SimpleAclAuthorizer |
| ACL | allow.everyone.if.no.acl.found | 是否在没有ACL时允许所有访问 | false |
| ACL | super.users | 指定超级用户 | User:admin |
| TLS | ssl.enabled.protocols | 启用的SSL/TLS协议版本 | TLSv1.2,TLSv1.3 |
