wehub-resource-sync
201 lines
6.6 KiB
Markdown
201 lines
6.6 KiB
Markdown
---
|
|
id: h2
|
|
title: H2 Database - TESTING ONLY, NOT FOR PRODUCTION
|
|
sidebar_label: H2 Database (Testing Only)
|
|
keywords: [open source monitoring tool, H2 database, testing, not for production, security warning]
|
|
---
|
|
|
|
> ⚠️ **CRITICAL SECURITY WARNING**: H2 Database is **NOT suitable for production environments**. It is provided for local testing and development purposes only. Using H2 in production exposes your server to serious security vulnerabilities. Please read this page carefully before using H2 with HertzBeat.
|
|
|
|
## 🔴 Security Risks - READ BEFORE USING
|
|
|
|
### What is H2 Database?
|
|
|
|
H2 is an open-source Java SQL database. HertzBeat ships with H2 as its **default embedded database** to enable quick testing and evaluation without requiring a separate database installation.
|
|
|
|
### Why H2 Is Dangerous in Production
|
|
|
|
H2 has a built-in feature called `CREATE ALIAS` that allows arbitrary Java code execution within database queries. This means:
|
|
|
|
```sql
|
|
-- Example of EXTREMELY dangerous H2 capability:
|
|
CREATE ALIAS EXEC AS $$
|
|
String exec(String cmd) throws Exception {
|
|
Runtime.getRuntime().exec(cmd);
|
|
return null;
|
|
}
|
|
$$;
|
|
|
|
-- This can execute shell commands on the server:
|
|
CALL EXEC('rm -rf /important-data');
|
|
```
|
|
|
|
If your HertzBeat H2 database is accessible to malicious actors (or even unauthorized internal users), they can:
|
|
|
|
- **Execute arbitrary shell commands** on the HertzBeat server
|
|
- **Read any file** accessible to the HertzBeat process
|
|
- **Compromise the entire server** running HertzBeat
|
|
- **Access all monitoring data** including sensitive credentials
|
|
|
|
📖 For complete details, read the official [H2 Security Documentation](https://h2database.com/html/security.html).
|
|
|
|
### Network Exposure Risk
|
|
|
|
H2 can run in server mode, potentially exposing a database management interface on the network. By default, H2 uses ports **8082** (web console) and **9092** (TCP server). If these are accessible externally, any user can connect directly to your database.
|
|
|
|
---
|
|
|
|
## ✅ H2 is Appropriate For
|
|
|
|
- **Local Development**: Quick setup for evaluating HertzBeat features
|
|
- **Automated Testing**: CI/CD pipelines in isolated environments
|
|
- **Demos**: Showcasing HertzBeat to stakeholders
|
|
- **Learning**: Understanding HertzBeat before production deployment
|
|
|
|
---
|
|
|
|
## 🚫 H2 is NOT Appropriate For
|
|
|
|
- Production deployments
|
|
- Multi-user environments
|
|
- Systems with sensitive monitoring data
|
|
- Internet-accessible HertzBeat instances
|
|
- Environments requiring data persistence across restarts
|
|
- High-availability setups
|
|
|
|
---
|
|
|
|
## 🔒 Migrating to a Production Database
|
|
|
|
For production use, migrate to one of these supported databases:
|
|
|
|
### MySQL / MariaDB (Recommended for most deployments)
|
|
|
|
1. Install MySQL 5.7+ or MariaDB 10.5+
|
|
2. Create a dedicated database and user:
|
|
|
|
```sql
|
|
CREATE DATABASE hertzbeat;
|
|
CREATE USER 'hertzbeat'@'localhost' IDENTIFIED BY 'strong_password_here';
|
|
GRANT ALL PRIVILEGES ON hertzbeat.* TO 'hertzbeat'@'localhost';
|
|
FLUSH PRIVILEGES;
|
|
```
|
|
|
|
3. Update `application.yml`:
|
|
|
|
```yaml
|
|
spring:
|
|
datasource:
|
|
url: jdbc:mysql://localhost:3306/hertzbeat?useUnicode=true&characterEncoding=utf-8
|
|
username: hertzbeat
|
|
password: strong_password_here
|
|
driver-class-name: com.mysql.cj.jdbc.Driver
|
|
```
|
|
|
|
4. Download MySQL JDBC driver and place in `ext-lib/`
|
|
5. Restart HertzBeat
|
|
|
|
📖 See the full [MySQL monitoring guide](./mysql.md) for setup details.
|
|
|
|
### PostgreSQL (Recommended for enterprise deployments)
|
|
|
|
1. Install PostgreSQL 12+
|
|
2. Create database and user:
|
|
|
|
```sql
|
|
CREATE USER hertzbeat WITH PASSWORD 'strong_password_here';
|
|
CREATE DATABASE hertzbeat OWNER hertzbeat;
|
|
GRANT ALL PRIVILEGES ON DATABASE hertzbeat TO hertzbeat;
|
|
```
|
|
|
|
3. Update `application.yml`:
|
|
|
|
```yaml
|
|
spring:
|
|
datasource:
|
|
url: jdbc:postgresql://localhost:5432/hertzbeat
|
|
username: hertzbeat
|
|
password: strong_password_here
|
|
driver-class-name: org.postgresql.Driver
|
|
```
|
|
|
|
4. Download PostgreSQL JDBC driver and place in `ext-lib/`
|
|
5. Restart HertzBeat
|
|
|
|
📖 See the full [PostgreSQL monitoring guide](./postgresql.md) for setup details.
|
|
|
|
---
|
|
|
|
## ⚙️ H2 Configuration (Testing Only)
|
|
|
|
If you are using H2 for **testing purposes** in a **sandboxed environment**, the default HertzBeat configuration uses H2 with these settings:
|
|
|
|
| Configuration | Default Value | Description |
|
|
|--------------|---------------|-------------|
|
|
| Database type | H2 | Embedded Java database |
|
|
| Database file | `./data/hertzbeat` | Local file storage |
|
|
| Web console | Port 8082 | H2 web management UI |
|
|
| Auto-create | Enabled | Creates schema automatically |
|
|
|
|
### Checking Your Current Configuration
|
|
|
|
View your current database configuration in `application.yml`:
|
|
|
|
```yaml
|
|
spring:
|
|
datasource:
|
|
# H2 configuration (testing only)
|
|
url: jdbc:h2:./data/hertzbeat
|
|
driver-class-name: org.h2.Driver
|
|
```
|
|
|
|
---
|
|
|
|
## 🛡️ If You Must Use H2 Temporarily
|
|
|
|
If you absolutely must use H2 while transitioning to a production database, take these precautions:
|
|
|
|
1. **Restrict Network Access**: Ensure HertzBeat is not accessible from the internet
|
|
2. **Disable H2 Console**: Comment out or remove H2 console configuration
|
|
3. **Firewall Rules**: Block ports 8082 and 9092 externally
|
|
4. **Limit User Access**: Only trusted administrators should access HertzBeat
|
|
5. **Monitor Access Logs**: Watch for unusual SQL queries
|
|
6. **Plan Migration**: Set a deadline to migrate to MySQL or PostgreSQL
|
|
|
|
```yaml
|
|
# Disable H2 web console in application.yml:
|
|
spring:
|
|
h2:
|
|
console:
|
|
enabled: false # IMPORTANT: Disable in any non-local environment
|
|
```
|
|
|
|
---
|
|
|
|
## 📋 Security Checklist Before Going to Production
|
|
|
|
Before deploying HertzBeat in any non-testing environment, verify:
|
|
|
|
- [ ] H2 database has been replaced with MySQL or PostgreSQL
|
|
- [ ] H2 web console is disabled
|
|
- [ ] Database credentials are strong and unique
|
|
- [ ] Database is not directly accessible from the internet
|
|
- [ ] HertzBeat is running behind a reverse proxy with SSL
|
|
- [ ] Monitoring credentials are encrypted and access-controlled
|
|
- [ ] Regular database backups are configured
|
|
|
|
---
|
|
|
|
## 🆘 Help and Support
|
|
|
|
If you need help migrating from H2 to a production database:
|
|
|
|
- 📖 [HertzBeat Documentation](https://hertzbeat.apache.org/docs/)
|
|
- 💬 [Apache HertzBeat Mailing List](https://lists.apache.org/list.html?dev@hertzbeat.apache.org)
|
|
- 🐛 [GitHub Issues](https://github.com/apache/hertzbeat/issues)
|
|
- 💡 [GitHub Discussions](https://github.com/apache/hertzbeat/discussions)
|
|
|
|
---
|
|
|
|
> **Remember**: The convenience of H2 for testing comes at the cost of security. Always plan to migrate to a production-grade database before deploying HertzBeat in any real environment.
|