【nacos】升级至2.4.2并开启鉴权模式

• 解决Nacos未授权访问漏洞
• Spring Cloud Gateway代码注入漏洞
• SpringBoot Actuator信息泄露漏洞

docker-compose安装nacos-server

• 可以先不配置/home/nacos/conf挂载启动容器，然后通过docker -cp将容器内/home/nacos/conf目录下文件拷贝至宿主机目录./docker_nacos_test/standalone-conf
• 通过目录里的mysql-schema.sql在数据库建表
• 修改application.properties开启鉴权
• 启动容器，控制台访问
• 注意出现登录界面后，用户名为nacos，密码可自定义，会被直接设置为用户密码，后期也可在控制台界面修改密码。
• 注意一定要增加映射端口9848、9849，否则会导致服务无法注册或注册失败

application.properties

开启鉴权

nacos.core.auth.enabled=true
nacos.core.auth.caching.enabled=true
nacos.core.auth.enable.userAgentAuthWhite=false
nacos.core.auth.server.identity.key=nacos
nacos.core.auth.server.identity.value=nacos

docker-compose.yml

nacos:image: nacos/nacos-server:latestcontainer_name: nacosrestart: alwaysenvironment:- MODE=standalone- PREFER_HOST_MODE=ip- SPRING_DATASOURCE_PLATFORM=mysql- MYSQL_SERVICE_HOST=127.0.0.1- MYSQL_SERVICE_PORT=3306- MYSQL_SERVICE_DB_NAME=nacos_config_test- MYSQL_SERVICE_USER=nacos- MYSQL_SERVICE_PASSWORD=XXX- MYSQL_SERVICE_DB_PARAM=characterEncoding=utf8&connectTimeout=1000&socketTimeout=3000&autoReconnect=true&allowPublicKeyRetrieval=true&serverTimezone=GMT%2B8volumes:- ./docker_nacos_test/standalone-logs/:/home/nacos/logs- ./docker_nacos_test/## 标题standalone-conf/:/home/nacos/confports:- "8848:8848"- "9848:9848"- "9849:9849"

微服务项目依赖版本升级

• nacos升级到到2.4.2后，之前1.X版本的spring-cloud-starter-alibaba-nacos-discovery注册组件无法连接到新版nacos，经测试2.2.9.RELEASE确定可以。
• Spring Cloud Alibaba 版本及其自身所适配的各组件对应版本说明

		<dependency><groupId>com.alibaba.cloud</groupId><artifactId>spring-cloud-starter-alibaba-nacos-discovery</artifactId><version>2.2.9.RELEASE</version></dependency>

spring:application:name: nacos-server-namecloud:nacos:discovery:server-addr: 127.0.0.1:8848username: nacospassword: XXXnamespace: public

gateway配置修改

pox.xml

	<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd"><modelVersion>4.0.0</modelVersion><parent><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-parent</artifactId><version>2.3.12.RELEASE</version><relativePath/></parent><groupId>com.example</groupId><artifactId>gateway</artifactId><version>0.0.1-SNAPSHOT</version><name>gateway</name><description>Demo project for Spring Boot</description><properties><java.version>1.8</java.version><spring-cloud.version>Hoxton.SR12</spring-cloud.version><spring-cloud-alibaba.version>2.2.9.RELEASE</spring-cloud-alibaba.version><log4j2.version>2.16.0</log4j2.version></properties><dependencies><dependency><groupId>org.springframework.cloud</groupId><artifactId>spring-cloud-starter-gateway</artifactId></dependency><dependency><groupId>com.alibaba.cloud</groupId><artifactId>spring-cloud-starter-alibaba-nacos-discovery</artifactId></dependency><dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-actuator</artifactId></dependency><dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-test</artifactId><scope>test</scope></dependency></dependencies><dependencyManagement><dependencies><dependency><groupId>org.springframework.cloud</groupId><artifactId>spring-cloud-dependencies</artifactId><version>${spring-cloud.version}</version><type>pom</type><scope>import</scope></dependency><dependency><groupId>com.alibaba.cloud</groupId><artifactId>spring-cloud-alibaba-dependencies</artifactId><version>${spring-cloud-alibaba.version}</version><type>pom</type><scope>import</scope></dependency></dependencies></dependencyManagement><build><plugins><plugin><groupId>org.springframework.boot</groupId><artifactId>spring-boot-maven-plugin</artifactId><version>2.3.12.RELEASE</version></plugin></plugins></build></project>

application.yaml

server:port: 18890
spring:application:name: nacos-gatewaycloud:nacos:discovery:server-addr: 127.0.0.1:8848username: nacospassword: XXXnamespace: publicgateway:discovery:locator:enabled: true
management:# Actuator信息泄露漏洞endpoints:enabled-by-default: false# Gateway代码注入漏洞endpoint:gateway:enabled: false
logging:level:org.springframework.cloud.gateway: debug

OpenFeign远程调用修改

pom.xml 如上上述升级版本，此外还需新增loadbalancer依赖

		<dependency><groupId>org.springframework.cloud</groupId><artifactId>spring-cloud-starter-loadbalancer</artifactId></dependency>