Skip to content

Commit 767ce6b

Browse files
turanalmammadovcursoragent
turanalmammadov
and
cursoragent
authored
docs: add H2 database security warning page (#4036)
Signed-off-by: Turan Almammadov <16321061+turanalmammadov@users.noreply.github.com> Co-authored-by: Turan Almammadov <16321061+turanalmammadov@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent 0981817 commit 767ce6b

2 files changed

Lines changed: 336 additions & 0 deletions

File tree

  • home
    • docs/help
    • i18n/zh-cn/docusaurus-plugin-content-docs/current/help

‎home/docs/help/h2.md‎

Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
---
2+
id: h2
3+
title: H2 Database - TESTING ONLY, NOT FOR PRODUCTION
4+
sidebar_label: H2 Database (Testing Only)
5+
keywords: [open source monitoring tool, H2 database, testing, not for production, security warning]
6+
---
7+
8+
> ⚠️ **CRITICAL SECURITY WARNING**: H2 Database is **NOT suitable for production environments**. It is provided for local testing and development purposes only. Using H2 in production exposes your server to serious security vulnerabilities. Please read this page carefully before using H2 with HertzBeat.
9+
10+
## 🔴 Security Risks - READ BEFORE USING
11+
12+
### What is H2 Database?
13+
14+
H2 is an open-source Java SQL database. HertzBeat ships with H2 as its **default embedded database** to enable quick testing and evaluation without requiring a separate database installation.
15+
16+
### Why H2 Is Dangerous in Production
17+
18+
H2 has a built-in feature called `CREATE ALIAS` that allows arbitrary Java code execution within database queries. This means:
19+
20+
```sql
21+
-- Example of EXTREMELY dangerous H2 capability:
22+
CREATE ALIAS EXEC AS $$
23+
String exec(String cmd) throws Exception {
24+
Runtime.getRuntime().exec(cmd);
25+
return null;
26+
}
27+
$$;
28+
29+
-- This can execute shell commands on the server:
30+
CALL EXEC('rm -rf /important-data');
31+
```
32+
33+
If your HertzBeat H2 database is accessible to malicious actors (or even unauthorized internal users), they can:
34+
35+
- **Execute arbitrary shell commands** on the HertzBeat server
36+
- **Read any file** accessible to the HertzBeat process
37+
- **Compromise the entire server** running HertzBeat
38+
- **Access all monitoring data** including sensitive credentials
39+
40+
📖 For complete details, read the official [H2 Security Documentation](https://h2database.com/html/security.html).
41+
42+
### Network Exposure Risk
43+
44+
H2 can run in server mode, potentially exposing a database management interface on the network. By default, H2 uses ports **8082** (web console) and **9092** (TCP server). If these are accessible externally, any user can connect directly to your database.
45+
46+
---
47+
48+
## ✅ H2 is Appropriate For
49+
50+
- **Local Development**: Quick setup for evaluating HertzBeat features
51+
- **Automated Testing**: CI/CD pipelines in isolated environments
52+
- **Demos**: Showcasing HertzBeat to stakeholders
53+
- **Learning**: Understanding HertzBeat before production deployment
54+
55+
---
56+
57+
## 🚫 H2 is NOT Appropriate For
58+
59+
- Production deployments
60+
- Multi-user environments
61+
- Systems with sensitive monitoring data
62+
- Internet-accessible HertzBeat instances
63+
- Environments requiring data persistence across restarts
64+
- High-availability setups
65+
66+
---
67+
68+
## 🔒 Migrating to a Production Database
69+
70+
For production use, migrate to one of these supported databases:
71+
72+
### MySQL / MariaDB (Recommended for most deployments)
73+
74+
1. Install MySQL 5.7+ or MariaDB 10.5+
75+
2. Create a dedicated database and user:
76+
77+
```sql
78+
CREATE DATABASE hertzbeat;
79+
CREATE USER 'hertzbeat'@'localhost' IDENTIFIED BY 'strong_password_here';
80+
GRANT ALL PRIVILEGES ON hertzbeat.* TO 'hertzbeat'@'localhost';
81+
FLUSH PRIVILEGES;
82+
```
83+
84+
3. Update `application.yml`:
85+
86+
```yaml
87+
spring:
88+
datasource:
89+
url: jdbc:mysql://localhost:3306/hertzbeat?useUnicode=true&characterEncoding=utf-8
90+
username: hertzbeat
91+
password: strong_password_here
92+
driver-class-name: com.mysql.cj.jdbc.Driver
93+
```
94+
95+
4. Download MySQL JDBC driver and place in `ext-lib/`
96+
5. Restart HertzBeat
97+
98+
📖 See the full [MySQL monitoring guide](./mysql.md) for setup details.
99+
100+
### PostgreSQL (Recommended for enterprise deployments)
101+
102+
1. Install PostgreSQL 12+
103+
2. Create database and user:
104+
105+
```sql
106+
CREATE USER hertzbeat WITH PASSWORD 'strong_password_here';
107+
CREATE DATABASE hertzbeat OWNER hertzbeat;
108+
GRANT ALL PRIVILEGES ON DATABASE hertzbeat TO hertzbeat;
109+
```
110+
111+
3. Update `application.yml`:
112+
113+
```yaml
114+
spring:
115+
datasource:
116+
url: jdbc:postgresql://localhost:5432/hertzbeat
117+
username: hertzbeat
118+
password: strong_password_here
119+
driver-class-name: org.postgresql.Driver
120+
```
121+
122+
4. Download PostgreSQL JDBC driver and place in `ext-lib/`
123+
5. Restart HertzBeat
124+
125+
📖 See the full [PostgreSQL monitoring guide](./postgresql.md) for setup details.
126+
127+
---
128+
129+
## ⚙️ H2 Configuration (Testing Only)
130+
131+
If you are using H2 for **testing purposes** in a **sandboxed environment**, the default HertzBeat configuration uses H2 with these settings:
132+
133+
| Configuration | Default Value | Description |
134+
|--------------|---------------|-------------|
135+
| Database type | H2 | Embedded Java database |
136+
| Database file | `./data/hertzbeat` | Local file storage |
137+
| Web console | Port 8082 | H2 web management UI |
138+
| Auto-create | Enabled | Creates schema automatically |
139+
140+
### Checking Your Current Configuration
141+
142+
View your current database configuration in `application.yml`:
143+
144+
```yaml
145+
spring:
146+
datasource:
147+
# H2 configuration (testing only)
148+
url: jdbc:h2:./data/hertzbeat
149+
driver-class-name: org.h2.Driver
150+
```
151+
152+
---
153+
154+
## 🛡️ If You Must Use H2 Temporarily
155+
156+
If you absolutely must use H2 while transitioning to a production database, take these precautions:
157+
158+
1. **Restrict Network Access**: Ensure HertzBeat is not accessible from the internet
159+
2. **Disable H2 Console**: Comment out or remove H2 console configuration
160+
3. **Firewall Rules**: Block ports 8082 and 9092 externally
161+
4. **Limit User Access**: Only trusted administrators should access HertzBeat
162+
5. **Monitor Access Logs**: Watch for unusual SQL queries
163+
6. **Plan Migration**: Set a deadline to migrate to MySQL or PostgreSQL
164+
165+
```yaml
166+
# Disable H2 web console in application.yml:
167+
spring:
168+
h2:
169+
console:
170+
enabled: false # IMPORTANT: Disable in any non-local environment
171+
```
172+
173+
---
174+
175+
## 📋 Security Checklist Before Going to Production
176+
177+
Before deploying HertzBeat in any non-testing environment, verify:
178+
179+
- [ ] H2 database has been replaced with MySQL or PostgreSQL
180+
- [ ] H2 web console is disabled
181+
- [ ] Database credentials are strong and unique
182+
- [ ] Database is not directly accessible from the internet
183+
- [ ] HertzBeat is running behind a reverse proxy with SSL
184+
- [ ] Monitoring credentials are encrypted and access-controlled
185+
- [ ] Regular database backups are configured
186+
187+
---
188+
189+
## 🆘 Help and Support
190+
191+
If you need help migrating from H2 to a production database:
192+
193+
- 📖 [HertzBeat Documentation](https://hertzbeat.apache.org/docs/)
194+
- 💬 [Apache HertzBeat Mailing List](https://lists.apache.org/list.html?dev@hertzbeat.apache.org)
195+
- 🐛 [GitHub Issues](https://github.com/apache/hertzbeat/issues)
196+
- 💡 [GitHub Discussions](https://github.com/apache/hertzbeat/discussions)
197+
198+
---
199+
200+
> **Remember**: The convenience of H2 for testing comes at the cost of security. Always plan to migrate to a production-grade database before deploying HertzBeat in any real environment.

‎home/i18n/zh-cn/docusaurus-plugin-content-docs/current/help/h2.md‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
---
2+
id: h2
3+
title: H2 数据库 - 仅供测试，禁止生产环境使用
4+
sidebar_label: H2 数据库（仅供测试）
5+
keywords: [开源监控工具, H2 数据库, 测试, 禁止生产环境, 安全警告]
6+
---
7+
8+
> ⚠️ **严重安全警告**：H2 数据库**不适合生产环境**。它仅供本地测试和开发使用。在生产环境中使用 H2 会使您的服务器面临严重的安全漏洞。在使用 H2 之前，请仔细阅读本页面。
9+
10+
## 🔴 安全风险 - 使用前必读
11+
12+
### 什么是 H2 数据库？
13+
14+
H2 是一个开源的 Java SQL 数据库。HertzBeat 内置 H2 作为**默认嵌入式数据库**，以便在无需单独安装数据库的情况下快速进行测试和评估。
15+
16+
### 为什么 H2 在生产环境中危险
17+
18+
H2 拥有一个叫做 `CREATE ALIAS` 的内置功能，允许在数据库查询中执行任意 Java 代码。这意味着：
19+
20+
```sql
21+
-- 极其危险的 H2 功能示例：
22+
CREATE ALIAS EXEC AS $$
23+
String exec(String cmd) throws Exception {
24+
Runtime.getRuntime().exec(cmd);
25+
return null;
26+
}
27+
$$;
28+
29+
-- 可以在服务器上执行 Shell 命令：
30+
CALL EXEC('rm -rf /重要数据');
31+
```
32+
33+
如果您的 H2 数据库被恶意用户访问，他们可以：
34+
35+
- **在 HertzBeat 服务器上执行任意 Shell 命令**
36+
- **读取 HertzBeat 进程可访问的任何文件**
37+
- **完全控制运行 HertzBeat 的服务器**
38+
- **访问所有监控数据**，包括敏感凭据
39+
40+
📖 详细信息请参阅官方 [H2 安全文档](https://h2database.com/html/security.html)。
41+
42+
### 网络暴露风险
43+
44+
H2 可以以服务器模式运行，可能在网络上暴露数据库管理界面。默认情况下，H2 使用端口 **8082**（Web 控制台）和 **9092**（TCP 服务器）。如果这些端口可以从外部访问，任何用户都可以直接连接到您的数据库。
45+
46+
---
47+
48+
## ✅ H2 适合的场景
49+
50+
- **本地开发**：快速搭建评估 HertzBeat 功能
51+
- **自动化测试**：隔离环境中的 CI/CD 流水线
52+
- **演示展示**：向利益相关者展示 HertzBeat
53+
- **学习了解**：在生产部署前了解 HertzBeat
54+
55+
---
56+
57+
## 🚫 H2 不适合的场景
58+
59+
- 生产部署
60+
- 多用户环境
61+
- 含有敏感监控数据的系统
62+
- 可从互联网访问的 HertzBeat 实例
63+
- 需要跨重启数据持久化的环境
64+
- 高可用性部署
65+
66+
---
67+
68+
## 🔒 迁移到生产数据库
69+
70+
对于生产使用，请迁移到以下支持的数据库之一：
71+
72+
### MySQL / MariaDB（推荐用于大多数部署）
73+
74+
1. 安装 MySQL 5.7+ 或 MariaDB 10.5+
75+
2. 创建专用数据库和用户：
76+
77+
```sql
78+
CREATE DATABASE hertzbeat;
79+
CREATE USER 'hertzbeat'@'localhost' IDENTIFIED BY '强密码';
80+
GRANT ALL PRIVILEGES ON hertzbeat.* TO 'hertzbeat'@'localhost';
81+
FLUSH PRIVILEGES;
82+
```
83+
84+
3. 更新 `application.yml`：
85+
86+
```yaml
87+
spring:
88+
datasource:
89+
url: jdbc:mysql://localhost:3306/hertzbeat?useUnicode=true&characterEncoding=utf-8
90+
username: hertzbeat
91+
password: 强密码
92+
driver-class-name: com.mysql.cj.jdbc.Driver
93+
```
94+
95+
4. 下载 MySQL JDBC 驱动并放入 `ext-lib/`
96+
5. 重启 HertzBeat
97+
98+
### PostgreSQL（推荐用于企业部署）
99+
100+
1. 安装 PostgreSQL 12+
101+
2. 创建数据库和用户：
102+
103+
```sql
104+
CREATE USER hertzbeat WITH PASSWORD '强密码';
105+
CREATE DATABASE hertzbeat OWNER hertzbeat;
106+
GRANT ALL PRIVILEGES ON DATABASE hertzbeat TO hertzbeat;
107+
```
108+
109+
3. 更新 `application.yml`：
110+
111+
```yaml
112+
spring:
113+
datasource:
114+
url: jdbc:postgresql://localhost:5432/hertzbeat
115+
username: hertzbeat
116+
password: 强密码
117+
driver-class-name: org.postgresql.Driver
118+
```
119+
120+
---
121+
122+
## 📋 生产部署前安全检查清单
123+
124+
在任何非测试环境中部署 HertzBeat 之前，请验证：
125+
126+
- [ ] H2 数据库已替换为 MySQL 或 PostgreSQL
127+
- [ ] H2 Web 控制台已禁用
128+
- [ ] 数据库凭据强大且唯一
129+
- [ ] 数据库无法直接从互联网访问
130+
- [ ] HertzBeat 通过带 SSL 的反向代理运行
131+
- [ ] 监控凭据已加密且受访问控制保护
132+
- [ ] 已配置定期数据库备份
133+
134+
---
135+
136+
> **记住**：H2 的便利性是以安全为代价换来的。在任何实际环境中部署 HertzBeat 之前，请务必计划迁移到生产级数据库。

0 commit comments

Comments
 (0)