如何禁止客户端连接Hazelcast集群？开源版认证方案咨询

针对你在Spring Boot中部署的双实例Hazelcast集群，开源版除修改集群名外，可通过以下几种方式实现安全防护，禁止外部非法连接：

1. 端口绑定+防火墙限制（最基础有效的物理隔离） #

将Hazelcast的集群通信端口绑定到内网IP（而非0.0.0.0），同时配合服务器防火墙规则，仅允许集群实例的IP访问相关端口，从网络层面阻断外部连接。

Spring Boot配置示例（application.yaml）： #

hazelcast:
  network:
    port:
      port: 5701
    join:
      multicast:
        enabled: false # 禁用多播，避免自动发现外部节点
      tcp-ip:
        enabled: true
        members: 192.168.1.100, 192.168.1.101 # 集群节点内网IP
    public-address: 192.168.1.100 # 当前节点绑定的内网IP

防火墙规则示例（以iptables为例）： #

仅允许集群节点IP访问5701端口：

iptables -A INPUT -p tcp --dport 5701 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 5701 -s 192.168.1.101 -j ACCEPT
iptables -A INPUT -p tcp --dport 5701 -j DROP

2. 自定义成员/客户端拦截器实现身份校验 #

Hazelcast开源版支持通过MembershipListener（节点加入拦截）和ClientInterceptor（客户端连接拦截）自定义校验逻辑，拒绝非法节点或客户端。

节点加入拦截器示例： #

import com.hazelcast.cluster.MembershipEvent;
import com.hazelcast.cluster.MembershipListener;
import com.hazelcast.core.HazelcastInstance;
import org.springframework.stereotype.Component;

@Component
public class NodeAuthListener implements MembershipListener {
    // 允许加入的节点IP白名单
    private static final String ALLOWED_NODE_IPS = "192.168.1.100,192.168.1.101";

    @Override
    public void memberAdded(MembershipEvent event) {
        String memberIp = event.getMember().getAddress().getHost();
        if (!ALLOWED_NODE_IPS.contains(memberIp)) {
            // 移除非法节点
            HazelcastInstance hazelcast = event.getHazelcastInstance();
            hazelcast.getCluster().removeMember(event.getMember());
        }
    }

    @Override
    public void memberRemoved(MembershipEvent event) {
        // 可选处理节点移除逻辑
    }
}

注册拦截器到Hazelcast配置： #

import com.hazelcast.config.Config;
import com.hazelcast.core.HazelcastInstance;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class HazelcastSecurityConfig {

    @Bean
    public HazelcastInstance hazelcastInstance(NodeAuthListener authListener) {
        Config config = new Config();
        // 启用TCP/IP集群模式
        config.getNetworkConfig().getJoin().getMulticastConfig().setEnabled(false);
        config.getNetworkConfig().getJoin().getTcpIpConfig().setEnabled(true)
                .addMember("192.168.1.100").addMember("192.168.1.101");
        // 注册节点认证监听器
        config.getClusterConfig().addMembershipListener(authListener);
        return com.hazelcast.core.Hazelcast.newHazelcastInstance(config);
    }
}

客户端连接拦截器示例： #

如果需要限制客户端连接，可实现ClientInterceptor：

import com.hazelcast.client.ClientInterceptor;
import com.hazelcast.client.impl.ClientRequest;
import com.hazelcast.client.impl.ClientResponse;

public class ClientAuthInterceptor implements ClientInterceptor {

    @Override
    public Object intercept(ClientRequest request) {
        String clientIp = request.getClientAddress().getHost();
        // 仅允许本地或指定IP的客户端连接
        if (!"127.0.0.1".equals(clientIp) && !clientIp.startsWith("192.168.1.")) {
            throw new SecurityException("Unauthorized client from IP: " + clientIp);
        }
        return null;
    }

    @Override
    public void afterResponse(ClientRequest request, ClientResponse response) {
        // 可选处理响应后逻辑
    }
}

配置客户端拦截器： #

hazelcast:
  network:
    client-interceptors:
      - class-name: com.yourpackage.ClientAuthInterceptor

3. 节点属性校验实现密钥认证 #

为每个集群实例设置唯一的认证密钥，通过实例属性传递，在节点加入时校验密钥一致性。

节点启动时设置密钥（JVM参数）： #

java -Dhazelcast.node.secret=your-secure-key -jar your-spring-boot-app.jar

配置实例属性并校验： #

import com.hazelcast.cluster.MembershipEvent;
import com.hazelcast.cluster.MembershipListener;
import com.hazelcast.core.HazelcastInstance;
import org.springframework.stereotype.Component;

@Component
public class SecretAuthListener implements MembershipListener {
    private static final String VALID_SECRET = System.getProperty("hazelcast.node.secret");

    @Override
    public void memberAdded(MembershipEvent event) {
        String memberSecret = event.getMember().getAttribute("node-secret");
        if (!VALID_SECRET.equals(memberSecret)) {
            event.getHazelcastInstance().getCluster().removeMember(event.getMember());
        }
    }

    @Override
    public void memberRemoved(MembershipEvent event) {
        // 可选处理逻辑
    }
}

在Hazelcast配置中设置实例属性： #

@Configuration
public class HazelcastConfig {

    @Bean
    public HazelcastInstance hazelcastInstance(SecretAuthListener authListener) {
        Config config = new Config();
        config.setInstanceAttribute("node-secret", System.getProperty("hazelcast.node.secret"));
        // 其他集群配置...
        config.getClusterConfig().addMembershipListener(authListener);
        return com.hazelcast.core.Hazelcast.newHazelcastInstance(config);
    }
}

内容的提问来源于stack exchange，提问作者spyder