Cp-docker-images: How to whitelist 4 letter word command in zookeeper ?

[ethicalmohit]

I am trying to whitelist 4 letter commands for the zookeeper container but I am not able to do it. As of now, only "srvr" is working.

Error:

echo mntr | nc localhost 2181
mntr is not executed because it is not in the whitelist.

I have tried to pass it up with the environmental variable but it's not picking up. I don't there is a configuration to set this variable.

ZOOKEEPER_4LW_COMMANDS_WHITELIST=*

[OneCricketeer]

Refer https://github.com/confluentinc/cp-docker-images/blob/5.3.1-post/debian/zookeeper/include/etc/confluent/docker/zookeeper.properties.template#L7-L30

The alternative, use KAFKA_OPTS to pass Java properties via -Dzookeeper.4lw.commands.whitelist

[ethicalmohit]

Refer https://github.com/confluentinc/cp-docker-images/blob/5.3.1-post/debian/zookeeper/include/etc/confluent/docker/zookeeper.properties.template#L7-L30

The alternative, use KAFKA_OPTS to pass Java properties via -Dzookeeper.4lw.commands.whitelist

I tried giving KAFKA_OPTS with -Dzookeeper.4lw.commands.whitelist as a value but it is still not working. Do I need to pass some other variables also?

[OneCricketeer]

Please show your full command.

You can exec into the container and look at the running process

[ksandrmatveyev]

from logs:

===> ENV Variables ...
KAFKA_OPTS=-D4lw.commands.whitelist=ruok -Dzookeeper.snapshot.trust.empty=true
[2020-02-06 08:57:17,642] WARN o.e.j.s.ServletContextHandler@33f88ab{/,null,UNAVAILABLE} contextPath ends with /* (org.eclipse.jetty.server.handler.ContextHandler)
[2020-02-06 08:57:17,643] WARN Empty contextPath (org.eclipse.jetty.server.handler.ContextHandler)
[2020-02-06 08:57:17,841] WARN configuration znode missing (should only happen during upgrade), creating the node (org.apache.zookeeper.server.ZKDatabase)
# echo ruok | nc localhost 2181
ruok is not executed because it is not in the whitelist.

[zhenik]

Maybe typo, I used confluentinc distribution,

-D4lw.commands.whitelist=ruok

to

-Dzookeeper.4lw.commands.whitelist=ruok

I tried with docker and *, works fine.

version: '3'
services:
  zookeeper:
    image: confluentinc/cp-zookeeper:5.3.1
    environment:
      ZOOKEEPER_SERVER_ID: 1
      ZOOKEEPER_CLIENT_PORT: "2181"
      ZOOKEEPER_TICK_TIME: "2000"
      ZOOKEEPER_SERVERS: "zookeeper:22888:23888"
      KAFKA_OPTS: "-Dzookeeper.4lw.commands.whitelist=*"
    ports:
      - "2181:2181"

Than,
docker-compose exec zookeeper echo ruok | nc localhost 2181

return
imok

[ksandrmatveyev]

-Dzookeeper.4lw.commands.whitelist=ruok works. tnx a lot!

[tzwsoho]

zookeeper version 3.6.1
ZOO_4LW_COMMANDS_WHITELIST: "*"

works

[shubhamdixit863]

If you are using kafka ,go to kafka/config ,then open zookeeper.properties in editor and add 4lw.commands.whitelist=* this line at the end .Reference -http://www.mtitek.com/tutorials/zookeeper/validate-running-zk.php

[nrvmodi]

Thanks. I am using confluent kafka. -Dzookeeper.4lw.commands.whitelist=ruok save my day.