【RabbitMQ】禁用AMQP配置中的明文身份验证机制
【RabbitMQ】禁用AMQP配置中的明文身份验证机制
参考博文
https://blog.csdn.net/u013551615/article/details/126314195
1、生成rabbitmq证书
#克隆生成证书的仓库到/ycx目录
git clone --depth 1 https://github.com/Berico-Technologies/CMF-AMQP-Configuration.git
cd /ycx/CMF-AMQP-Configuration/ssl#修改生成证书10年有效期
sed -i "s/valid=365/valid=3650/g" create_client_cert.sh
sed -i "s/valid=365/valid=3650/g" make_server_cert.sh
sed -i "s/valid=365/valid=3650/g" setup_ca.sh
sed -i "s/default_days = 365/default_days = 3650/g" openssl.cnf#生成ca证书，“ycxRabbitMQCA”为自定义名称，名称任意。在当前目录下生成ca目录
sh setup_ca.sh ycxRabbitMQCA#生成服务端证书，第一个参数是服务端证书前缀，第二个参数是密码。密码任意，在当前目录下生成server目录
sh make_server_cert.sh rabbitmq-server Mq123456#生成客户端证书，第一个参数是客户端证书前缀（同时也是rabbitmq用户名），第二个参数是密码。密码任意，在当前目录下生成client目录
sh create_client_cert.sh rabbitmq-client Mq123456在 /ycx/CMF-AMQP-Configuration/ssl 目录下会生成三个文件夹ca、server、client
2、生成代码JKS证书
使用 RabbitMQ 服务端公钥证书生成 JKS 证书
# -alias后为别称，-file后是服务端公钥位置，-keystore后是输出JSK证书位置，此处相对路径
cd /ycx/CMF-AMQP-Configuration/ssl
keytool -import -alias rabbitmq-server -file server/rabbitmq-server.cert.pem -keystore rabbitmqKeyStore.jks -storepass Mq123456结果在/ycx/CMF-AMQP-Configuration/ssl目录生成 rabbitmqKeyStore.jks
3、配置rabbitmq
默认 RabbitMQ 配置目录在 /etc/rabbitmq
mkdir -p /ycx/data/rabbitmq/ssl
cd /ycx/CMF-AMQP-Configuration/ssl
cp ca/cacert.pem /ycx/data/rabbitmq/ssl
cp server/rabbitmq-server.key.pem /ycx/data/rabbitmq/ssl
cp server/rabbitmq-server.cert.pem /ycx/data/rabbitmq/ssl新建配置文件/ycx/data/rabbitmq/rabbitmq.config，配置内容如下：一和二使用一种能用的格式
格式一
listeners.tcp.default = 5672
listeners.tcp = none
listeners.ssl.default=5671
ssl_options.cacertfile=/etc/rabbitmq/ssl/cacert.pem
ssl_options.certfile=/etc/rabbitmq/ssl/rabbitmq-server.cert.pem
ssl_options.keyfile=/etc/rabbitmq/ssl/rabbitmq-server.key.pem
ssl_options.verify=verify_peer
ssl_options.fail_if_no_peer_cert=true
ssl_options.versions.1=tlsv1.2
ssl_options.versions.2=tlsv1.1
ssl_options.ciphers.1 = ECDHE-ECDSA-AES256-GCM-SHA384
ssl_options.ciphers.2 = ECDHE-RSA-AES256-GCM-SHA384
ssl_options.ciphers.3 = ECDHE-ECDSA-AES256-SHA384
ssl_options.ciphers.4 = ECDHE-RSA-AES256-SHA384
ssl_options.ciphers.5 = ECDHE-ECDSA-DES-CBC3-SHA
ssl_options.ciphers.6 = ECDH-ECDSA-AES256-GCM-SHA384
ssl_options.ciphers.7 = ECDH-RSA-AES256-GCM-SHA384
ssl_options.ciphers.8 = ECDH-ECDSA-AES256-SHA384
ssl_options.ciphers.9 = ECDH-RSA-AES256-SHA384
ssl_options.ciphers.10 = DHE-DSS-AES256-GCM-SHA384
ssl_options.ciphers.11= DHE-DSS-AES256-SHA256
ssl_options.ciphers.12 = AES256-GCM-SHA384
ssl_options.ciphers.13 = AES256-SHA256
ssl_options.ciphers.14 = ECDHE-ECDSA-AES128-GCM-SHA256
ssl_options.ciphers.15 = ECDHE-RSA-AES128-GCM-SHA256
ssl_options.ciphers.16 = ECDHE-ECDSA-AES128-SHA256
ssl_options.ciphers.17 = ECDHE-RSA-AES128-SHA256
ssl_options.ciphers.18 = ECDH-ECDSA-AES128-GCM-SHA256
ssl_options.ciphers.19= ECDH-RSA-AES128-GCM-SHA256
ssl_options.ciphers.20 = ECDH-ECDSA-AES128-SHA256
ssl_options.ciphers.21 = ECDH-RSA-AES128-SHA256
ssl_options.ciphers.22 = DHE-DSS-AES128-GCM-SHA256
ssl_options.ciphers.23 = DHE-DSS-AES128-SHA256
ssl_options.ciphers.24 = AES128-GCM-SHA256
ssl_options.ciphers.25 = AES128-SHA256
ssl_options.ciphers.26 = ECDHE-ECDSA-AES256-SHA
ssl_options.ciphers.27 = ECDHE-RSA-AES256-SHA
ssl_options.ciphers.28 = DHE-DSS-AES256-SHA
ssl_options.ciphers.29 = ECDH-ECDSA-AES256-SHA
ssl_options.ciphers.30 = ECDH-RSA-AES256-SHA
ssl_options.ciphers.31= AES256-SHA
ssl_options.ciphers.32 = ECDHE-ECDSA-AES128-SHA
ssl_options.ciphers.33 = ECDHE-RSA-AES128-SHA
ssl_options.ciphers.34 = DHE-DSS-AES128-SHA
ssl_options.ciphers.35 = DHE-DSS-AES128-SHA256
ssl_options.ciphers.36 = ECDH-ECDSA-AES128-SHA
ssl_options.ciphers.37 = ECDH-RSA-AES128-SHA
ssl_options.ciphers.38 = AES128-SHA
auth_mechanisms.1 = EXTERNAL
management.tcp.port = 15672
ssl_cert_login_from = common_name
loopback_users.guest = false格式二
[{rabbit, [
{ssl_listeners, [5671]},
{ssl_options, [
{cacertfile, "/etc/rabbitmq/ssl/cacert.pem"},
{certfile, "/etc/rabbitmq/ssl/rabbitmq-server.cert.pem"},
{keyfile, "/etc/rabbitmq/ssl/rabbitmq-server.key.pem"},
{verify, verify_peer},
{fail_if_no_peer_cert, true},
{ciphers, [
"ECDHE-ECDSA-AES256-GCM-SHA384","ECDHE-RSA-AES256-GCM-SHA384",
"ECDHE-ECDSA-AES256-SHA384","ECDHE-RSA-AES256-SHA384",
"ECDHE-ECDSA-DES-CBC3-SHA","ECDH-ECDSA-AES256-GCM-SHA384",
"ECDH-RSA-AES256-GCM-SHA384","ECDH-ECDSA-AES256-SHA384",
"ECDH-RSA-AES256-SHA384","DHE-DSS-AES256-GCM-SHA384",
"DHE-DSS-AES256-SHA256","AES256-GCM-SHA384",
"AES256-SHA256","ECDHE-ECDSA-AES128-GCM-SHA256",
"ECDHE-RSA-AES128-GCM-SHA256","ECDHE-ECDSA-AES128-SHA256",
"ECDHE-RSA-AES128-SHA256","ECDH-ECDSA-AES128-GCM-SHA256",
"ECDH-RSA-AES128-GCM-SHA256","ECDH-ECDSA-AES128-SHA256",
"ECDH-RSA-AES128-SHA256","DHE-DSS-AES128-GCM-SHA256",
"DHE-DSS-AES128-SHA256","AES128-GCM-SHA256",
"AES128-SHA256","ECDHE-ECDSA-AES256-SHA",
"ECDHE-RSA-AES256-SHA","DHE-DSS-AES256-SHA",
"ECDH-ECDSA-AES256-SHA","ECDH-RSA-AES256-SHA",
"AES256-SHA","ECDHE-ECDSA-AES128-SHA",
"ECDHE-RSA-AES128-SHA","DHE-DSS-AES128-SHA",
"ECDH-ECDSA-AES128-SHA","ECDH-RSA-AES128-SHA","AES128-SHA"
]}
]},
{auth_mechanisms,['EXTERNAL']},
{ssl_cert_login_from,common_name}
]}].
4、启用rabbitmq ssl
docker pull rabbitmq:3.8.16-management
docker run -d --restart=always -m=2g --name rabbitmqssl -p 5672:5672 -p 5671:5671 -p 15672:15672 --privileged=true -v /ycx/data/rabbitmq/rabbitmq.config:/etc/rabbitmq/rabbitmq.config -v /ycx/data/rabbitmq/ssl:/etc/rabbitmq/ssl -v /ycx/data/rabbitmq/data:/var/lib/rabbitmq -v /ycx/logs/rabbitmq:/var/log/rabbitmq docker.io/rabbitmq:3.8.16-management启用插件
docker exec -it rabbitmqssl bash#启用rabbitmq_auth_mechanism_ssl作为EXTERNAL认证机制的实现
rabbitmq-plugins enable rabbitmq_auth_mechanism_ssl#查看启动结果
rabbitmq-plugins list 包含如下内容怎启用成功
[E*] rabbitmq_auth_mechanism_ssl 3.8.16
添加证书登录用户（用户名要与客户端证书名称前缀一致），密码任意
rabbitmqctl add_user 'rabbitmq-client' '88352636'# 给 rabbitmq-client 用户虚拟主机/的所有权限，如需其他虚拟主机替换/
rabbitmqctl set_permissions -p "/" "rabbitmq-client" ".*" ".*" ".*"
rabbitmqctl set_user_tags rabbitmq-client administratorcd /ycx/CMF-AMQP-Configuration/ssl
# 使用客户端证书+CA证书连接RabbitMQ验证
openssl s_client -connect localhost:5671 -cert client/rabbitmq-client.cert.pem -key client/rabbitmq-client.key.pem -CAfile ca/cacert.pem
5、代码修改
在resources目录新建ssl
复制下面两个文件到ssl目录
/ycx/CMF-AMQP-Configuration/ssl/client/rabbitmq-client.keycert.p12
/ycx/CMF-AMQP-Configuration/ssl/rabbitmqKeyStore.jks
增加工厂方法
@Autowired
RabbitProperties rabbitProperties;
@Autowired
CachingConnectionFactory cachingConnectionFactory;
@PostConstruct
public void rabbitmqSslExternalPostConstruct() {
boolean rabbitSslEnabled = BooleanUtils.toBoolean(rabbitProperties.getSsl().getEnabled());
boolean rabbitSslKeyStoreExists = rabbitProperties.getSsl().getKeyStore() != null;
if (rabbitSslEnabled && rabbitSslKeyStoreExists) {
cachingConnectionFactory.getRabbitConnectionFactory().setSaslConfig(DefaultSaslConfig.EXTERNAL);
}
}POM文件增加排除后缀
<nonFilteredFileExtensions>
<nonFilteredFileExtension>p12</nonFilteredFileExtension>
<nonFilteredFileExtension>jks</nonFilteredFileExtension>
</nonFilteredFileExtensions>配置
spring:
rabbitmq:
host: 127.0.0.1
port: 5671
ssl:
# 客户端PKCS12证书及密码
key-store: classpath:ssl/rabbitmq-client.keycert.p12
key-store-password: Mq123456
# 公钥证书及类型
trust-store: classpath:ssl/rabbitmqKeyStore.jks
trust-store-type: JKS
# 不校验主机名，默认开启会导致连接失败
verify-hostname: false
