actuator防止外部访问漏洞修复

解决办法适用于2.x springboot版本

注意：actuator默认是开启的，默认开启是有漏洞的。

法零：和网站设置不同端口，不映射到外面，并修改路径
法一：禁用所有http接口，将配置改成：management.endpoints.web.exposure.exclude=*
法二：引入spring-boot-starter-security依赖，增加安全认证
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
配置增加

# actuator是否需要安全保证配置
management:
security:
enabled: true
endpoints:
web:
exposure:
include: "*"
# actuator登录认证配置
spring:
security:
user:
name: admin${random.int}
password: ${random.value}
代码增加打印认证的用户和密码

@Component
public class MyApplicationRunner implements ApplicationRunner {

private static final Logger LOGGER = LoggerFactory.getLogger(MyApplicationRunner.class);

@Autowired
private SecurityProperties securityProperties;

@Override
public void run(ApplicationArguments args) throws Exception {
LOGGER.info("actuator user name:{}, password:{}", securityProperties.getUser().getName(), securityProperties.getUser().getPassword());
// todo 存到redis或者其他
}
}
ActuatorSecurity认证类

import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration
public class ActuatorSecurity extends WebSecurityConfigurerAdapter {

   @Override
   protected void configure(HttpSecurity http) throws Exception {
       http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests()
           .anyRequest().authenticated().and().httpBasic();
   }

}
启动&测试
http://localhost:8088/actuator/beans

actuator防止外部访问漏洞修复

猜你喜欢