預設情況下Erlang的叢集訪問是全授權的，只要cookie認證過了後，新加入的節點可以訪問叢集裡面的任何機器，這給運維帶來很大風險。目前erlang有二種方法可以限制 1. IP網段限制，參看這裡 2. 節點名稱限制。這個是通過net_kernel:allow來實現的，參看：

allow/1
Limits access to the specified set of nodes. Any access attempts made from (or to) nodes not in Nodes will be rejected.

Returns error if any element in Nodes is not an atom.

我們假設叢集有節點x,y,z, foo：
1. 有個節點叫foo, 它只允許來自x,y節點的請求，其他的節點訪問被拒;
2. z只能訪問x,其他拒

我們來試驗下：

$ erl -name [email protected]
Erlang R14B04 (erts-5.8.5)  [smp:2:2] [rq:2] [async-threads:0] [hipe] [kernel-poll:false]

Eshell V5.8.5  (abort with ^G)
([email protected])1> net_kernel:allow(['[email protected]
 
', '[email protected]']).
ok
([email protected])2> 

在其他終端執行：

$ erl -name [email protected]
Erlang R14B04 (erts-5.8.5)  [smp:2:2] [rq:2] [async-threads:0] [hipe] [kernel-poll:false]

Eshell V5.8.5  (abort with ^G)
([email protected])1> net_adm:ping('[email protected]').
pong
(
 
[email protected])2> 

$ erl -name [email protected]
Erlang R14B04 (erts-5.8.5)  [smp:2:2] [rq:2] [async-threads:0] [hipe] [kernel-poll:false]

Eshell V5.8.5  (abort with ^G)
([email protected])1> net_adm:ping('[email protected]').
pong
([email protected])2> 

$ erl -name [email protected]
Erlang R14B04 (erts-5.8.5)  [smp:2:2] [rq:2] [async-threads:0] [hipe] [kernel-poll:false]

Eshell V5.8.5  (abort with ^G)
([email protected])1> net_adm:ping('[email protected]').
pang
([email protected])2> net_adm:ping('[email protected]').
pong
([email protected])3> net_kernel:disconnect('[email protected]').
true
([email protected])4> net_kernel:allow(['[email protected]']).
ok
([email protected])5> net_adm:ping('[email protected]').         

=ERROR REPORT==== 24-Oct-2011::01:23:34 ===
** Connection attempt with disallowed node '[email protected]' ** 
pang

同時我們會在foo的終端上看到：

=ERROR REPORT==== 24-Oct-2011::01:08:20 ===
** Connection attempt from disallowed node '[email protected]' ** 
([email protected])2>

看程式碼：

...
%% dist_util.erl
%%                                                                                                                           
%% check if connecting node is allowed to connect                                                                            
%% with allow-node-scheme                                                                                                    
%%                                                                                                                           
is_allowed(#hs_data{other_node = Node,
                    allowed = Allowed} = HSData) ->
    case lists:member(Node, Allowed) of
        false when Allowed =/= [] ->
            send_status(HSData, not_allowed),
            error_msg("** Connection attempt from "
                      "disallowed node ~w ** ~n", [Node]),
            ?shutdown(Node);
        _ -> true
    end.
...

可以知道如果Allowed空的話，代表不做任何限制，否則net_kernel:allow限制主動和被動連線的節點。

祝玩得開心！

Post Footer automatically generated by wp-posturl plugin for wordpress.