chore: import upstream snapshot with attribution
This commit is contained in:
wehub-resource-sync
@@ -0,0 +1,200 @@
|
||||
---
|
||||
id: h2
|
||||
title: H2 Database - TESTING ONLY, NOT FOR PRODUCTION
|
||||
sidebar_label: H2 Database (Testing Only)
|
||||
keywords: [open source monitoring tool, H2 database, testing, not for production, security warning]
|
||||
---
|
||||
|
||||
> ⚠️ **CRITICAL SECURITY WARNING**: H2 Database is **NOT suitable for production environments**. It is provided for local testing and development purposes only. Using H2 in production exposes your server to serious security vulnerabilities. Please read this page carefully before using H2 with HertzBeat.
|
||||
|
||||
## 🔴 Security Risks - READ BEFORE USING
|
||||
|
||||
### What is H2 Database?
|
||||
|
||||
H2 is an open-source Java SQL database. HertzBeat ships with H2 as its **default embedded database** to enable quick testing and evaluation without requiring a separate database installation.
|
||||
|
||||
### Why H2 Is Dangerous in Production
|
||||
|
||||
H2 has a built-in feature called `CREATE ALIAS` that allows arbitrary Java code execution within database queries. This means:
|
||||
|
||||
```sql
|
||||
-- Example of EXTREMELY dangerous H2 capability:
|
||||
CREATE ALIAS EXEC AS $$
|
||||
String exec(String cmd) throws Exception {
|
||||
Runtime.getRuntime().exec(cmd);
|
||||
return null;
|
||||
}
|
||||
$$;
|
||||
|
||||
-- This can execute shell commands on the server:
|
||||
CALL EXEC('rm -rf /important-data');
|
||||
```
|
||||
|
||||
If your HertzBeat H2 database is accessible to malicious actors (or even unauthorized internal users), they can:
|
||||
|
||||
- **Execute arbitrary shell commands** on the HertzBeat server
|
||||
- **Read any file** accessible to the HertzBeat process
|
||||
- **Compromise the entire server** running HertzBeat
|
||||
- **Access all monitoring data** including sensitive credentials
|
||||
|
||||
📖 For complete details, read the official [H2 Security Documentation](https://h2database.com/html/security.html).
|
||||
|
||||
### Network Exposure Risk
|
||||
|
||||
H2 can run in server mode, potentially exposing a database management interface on the network. By default, H2 uses ports **8082** (web console) and **9092** (TCP server). If these are accessible externally, any user can connect directly to your database.
|
||||
|
||||
---
|
||||
|
||||
## ✅ H2 is Appropriate For
|
||||
|
||||
- **Local Development**: Quick setup for evaluating HertzBeat features
|
||||
- **Automated Testing**: CI/CD pipelines in isolated environments
|
||||
- **Demos**: Showcasing HertzBeat to stakeholders
|
||||
- **Learning**: Understanding HertzBeat before production deployment
|
||||
|
||||
---
|
||||
|
||||
## 🚫 H2 is NOT Appropriate For
|
||||
|
||||
- Production deployments
|
||||
- Multi-user environments
|
||||
- Systems with sensitive monitoring data
|
||||
- Internet-accessible HertzBeat instances
|
||||
- Environments requiring data persistence across restarts
|
||||
- High-availability setups
|
||||
|
||||
---
|
||||
|
||||
## 🔒 Migrating to a Production Database
|
||||
|
||||
For production use, migrate to one of these supported databases:
|
||||
|
||||
### MySQL / MariaDB (Recommended for most deployments)
|
||||
|
||||
1. Install MySQL 5.7+ or MariaDB 10.5+
|
||||
2. Create a dedicated database and user:
|
||||
|
||||
```sql
|
||||
CREATE DATABASE hertzbeat;
|
||||
CREATE USER 'hertzbeat'@'localhost' IDENTIFIED BY 'strong_password_here';
|
||||
GRANT ALL PRIVILEGES ON hertzbeat.* TO 'hertzbeat'@'localhost';
|
||||
FLUSH PRIVILEGES;
|
||||
```
|
||||
|
||||
3. Update `application.yml`:
|
||||
|
||||
```yaml
|
||||
spring:
|
||||
datasource:
|
||||
url: jdbc:mysql://localhost:3306/hertzbeat?useUnicode=true&characterEncoding=utf-8
|
||||
username: hertzbeat
|
||||
password: strong_password_here
|
||||
driver-class-name: com.mysql.cj.jdbc.Driver
|
||||
```
|
||||
|
||||
4. Download MySQL JDBC driver and place in `ext-lib/`
|
||||
5. Restart HertzBeat
|
||||
|
||||
📖 See the full [MySQL monitoring guide](./mysql.md) for setup details.
|
||||
|
||||
### PostgreSQL (Recommended for enterprise deployments)
|
||||
|
||||
1. Install PostgreSQL 12+
|
||||
2. Create database and user:
|
||||
|
||||
```sql
|
||||
CREATE USER hertzbeat WITH PASSWORD 'strong_password_here';
|
||||
CREATE DATABASE hertzbeat OWNER hertzbeat;
|
||||
GRANT ALL PRIVILEGES ON DATABASE hertzbeat TO hertzbeat;
|
||||
```
|
||||
|
||||
3. Update `application.yml`:
|
||||
|
||||
```yaml
|
||||
spring:
|
||||
datasource:
|
||||
url: jdbc:postgresql://localhost:5432/hertzbeat
|
||||
username: hertzbeat
|
||||
password: strong_password_here
|
||||
driver-class-name: org.postgresql.Driver
|
||||
```
|
||||
|
||||
4. Download PostgreSQL JDBC driver and place in `ext-lib/`
|
||||
5. Restart HertzBeat
|
||||
|
||||
📖 See the full [PostgreSQL monitoring guide](./postgresql.md) for setup details.
|
||||
|
||||
---
|
||||
|
||||
## ⚙️ H2 Configuration (Testing Only)
|
||||
|
||||
If you are using H2 for **testing purposes** in a **sandboxed environment**, the default HertzBeat configuration uses H2 with these settings:
|
||||
|
||||
| Configuration | Default Value | Description |
|
||||
|--------------|---------------|-------------|
|
||||
| Database type | H2 | Embedded Java database |
|
||||
| Database file | `./data/hertzbeat` | Local file storage |
|
||||
| Web console | Port 8082 | H2 web management UI |
|
||||
| Auto-create | Enabled | Creates schema automatically |
|
||||
|
||||
### Checking Your Current Configuration
|
||||
|
||||
View your current database configuration in `application.yml`:
|
||||
|
||||
```yaml
|
||||
spring:
|
||||
datasource:
|
||||
# H2 configuration (testing only)
|
||||
url: jdbc:h2:./data/hertzbeat
|
||||
driver-class-name: org.h2.Driver
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🛡️ If You Must Use H2 Temporarily
|
||||
|
||||
If you absolutely must use H2 while transitioning to a production database, take these precautions:
|
||||
|
||||
1. **Restrict Network Access**: Ensure HertzBeat is not accessible from the internet
|
||||
2. **Disable H2 Console**: Comment out or remove H2 console configuration
|
||||
3. **Firewall Rules**: Block ports 8082 and 9092 externally
|
||||
4. **Limit User Access**: Only trusted administrators should access HertzBeat
|
||||
5. **Monitor Access Logs**: Watch for unusual SQL queries
|
||||
6. **Plan Migration**: Set a deadline to migrate to MySQL or PostgreSQL
|
||||
|
||||
```yaml
|
||||
# Disable H2 web console in application.yml:
|
||||
spring:
|
||||
h2:
|
||||
console:
|
||||
enabled: false # IMPORTANT: Disable in any non-local environment
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 📋 Security Checklist Before Going to Production
|
||||
|
||||
Before deploying HertzBeat in any non-testing environment, verify:
|
||||
|
||||
- [ ] H2 database has been replaced with MySQL or PostgreSQL
|
||||
- [ ] H2 web console is disabled
|
||||
- [ ] Database credentials are strong and unique
|
||||
- [ ] Database is not directly accessible from the internet
|
||||
- [ ] HertzBeat is running behind a reverse proxy with SSL
|
||||
- [ ] Monitoring credentials are encrypted and access-controlled
|
||||
- [ ] Regular database backups are configured
|
||||
|
||||
---
|
||||
|
||||
## 🆘 Help and Support
|
||||
|
||||
If you need help migrating from H2 to a production database:
|
||||
|
||||
- 📖 [HertzBeat Documentation](https://hertzbeat.apache.org/docs/)
|
||||
- 💬 [Apache HertzBeat Mailing List](https://lists.apache.org/list.html?dev@hertzbeat.apache.org)
|
||||
- 🐛 [GitHub Issues](https://github.com/apache/hertzbeat/issues)
|
||||
- 💡 [GitHub Discussions](https://github.com/apache/hertzbeat/discussions)
|
||||
|
||||
---
|
||||
|
||||
> **Remember**: The convenience of H2 for testing comes at the cost of security. Always plan to migrate to a production-grade database before deploying HertzBeat in any real environment.
|
||||
Reference in New Issue
Block a user