【nacos】升级至2.4.2并开启鉴权模式

• 解决Nacos未授权访问漏洞
• Spring Cloud Gateway代码注入漏洞
• SpringBoot Actuator信息泄露漏洞

docker-compose安装nacos-server

• 可以先不配置/home/nacos/conf挂载启动容器，然后通过docker -cp将容器内/home/nacos/conf目录下文件拷贝至宿主机目录./docker_nacos_test/standalone-conf
• 通过目录里的mysql-schema.sql在数据库建表
• 修改application.properties开启鉴权
• 启动容器，控制台访问
• 注意出现登录界面后，用户名为nacos，密码可自定义，会被直接设置为用户密码，后期也可在控制台界面修改密码。
• 注意一定要增加映射端口9848、9849，否则会导致服务无法注册或注册失败

application.properties

开启鉴权

nacos.core.auth.enabled=true
nacos.core.auth.caching.enabled=true
nacos.core.auth.enable.userAgentAuthWhite=false
nacos.core.auth.server.identity.key=nacos
nacos.core.auth.server.identity.value=nacos

docker-compose.yml

nacos:
    image: nacos/nacos-server:latest
    container_name: nacos
    restart: always
    environment:
      - MODE=standalone
      - PREFER_HOST_MODE=ip
      - SPRING_DATASOURCE_PLATFORM=mysql
      - MYSQL_SERVICE_HOST=127.0.0.1
      - MYSQL_SERVICE_PORT=3306
      - MYSQL_SERVICE_DB_NAME=nacos_config_test
      - MYSQL_SERVICE_USER=nacos
      - MYSQL_SERVICE_PASSWORD=XXX
      - MYSQL_SERVICE_DB_PARAM=characterEncoding=utf8&connectTimeout=1000&socketTimeout=3000&autoReconnect=true&allowPublicKeyRetrieval=true&serverTimezone=GMT%2B8
    volumes:
      - ./docker_nacos_test/standalone-logs/:/home/nacos/logs
      - ./docker_nacos_test/## 标题standalone-conf/:/home/nacos/conf
    ports:
      - "8848:8848"
      - "9848:9848"
      - "9849:9849"

微服务项目依赖版本升级

• nacos升级到到2.4.2后，之前1.X版本的spring-cloud-starter-alibaba-nacos-discovery注册组件无法连接到新版nacos，经测试2.2.9.RELEASE确定可以。
• Spring Cloud Alibaba 版本及其自身所适配的各组件对应版本说明

		<dependency>
            <groupId>com.alibaba.cloud</groupId>
            <artifactId>spring-cloud-starter-alibaba-nacos-discovery</artifactId>
            <version>2.2.9.RELEASE</version>
        </dependency>

spring:
  application:
    name: nacos-server-name
  cloud:
    nacos:
      discovery:
        server-addr: 127.0.0.1:8848
        username: nacos
        password: XXX
        namespace: public

gateway配置修改

pox.xml

	<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.3.12.RELEASE</version>
        <relativePath/>
    </parent>
    <groupId>com.example</groupId>
    <artifactId>gateway</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>gateway</name>
    <description>Demo project for Spring Boot</description>
    <properties>
        <java.version>1.8</java.version>
        <spring-cloud.version>Hoxton.SR12</spring-cloud.version>
        <spring-cloud-alibaba.version>2.2.9.RELEASE</spring-cloud-alibaba.version>
        <log4j2.version>2.16.0</log4j2.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-gateway</artifactId>
        </dependency>
        <dependency>
            <groupId>com.alibaba.cloud</groupId>
            <artifactId>spring-cloud-starter-alibaba-nacos-discovery</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.springframework.cloud</groupId>
                <artifactId>spring-cloud-dependencies</artifactId>
                <version>${spring-cloud.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>com.alibaba.cloud</groupId>
                <artifactId>spring-cloud-alibaba-dependencies</artifactId>
                <version>${spring-cloud-alibaba.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <version>2.3.12.RELEASE</version>
            </plugin>
        </plugins>
    </build>

</project>

application.yaml

server:
  port: 18890
spring:
  application:
    name: nacos-gateway
  cloud:
    nacos:
      discovery:
        server-addr: 127.0.0.1:8848
        username: nacos
        password: XXX
        namespace: public
    gateway:
      discovery:
        locator:
          enabled: true
management:
  # Actuator信息泄露漏洞
  endpoints:
    enabled-by-default: false
  # Gateway代码注入漏洞
  endpoint:
    gateway:
      enabled: false
logging:
  level:
    org.springframework.cloud.gateway: debug

OpenFeign远程调用修改

pom.xml 如上上述升级版本，此外还需新增loadbalancer依赖

		<dependency>
			<groupId>org.springframework.cloud</groupId>
			<artifactId>spring-cloud-starter-loadbalancer</artifactId>
		</dependency>