I have to be missing something here.

It just hit me as added a new node to my cluster in order to prepare for the removal of a different node: "How does the cluster know that it is okay to send the new node a SST?"

I am pretty sure that the only information the new node has about the cluster is the gcomm:// address. Surely that isn't looked at as "secure" information that passes for authentication. To my knowledge, no shell account on the new node has the same password as on the existing cluster nodes.

So what would prevent anyone from spinning up a new node and pointing it's gcomm:// address at one or more of my nodes to just get an SST and be able to see all of my data?

Of course, certificates will be put in place. But I'm talking about a default setup and how things work "out of the box." I couldn't find much of anything that talked about this out there.

Am I going nuts?

  • 1
    Looking through /usr/bin/wsrep_sst_rsync, I see: rsync --owner --group --perms --links --specials --ignore-times --inplace --dirs --delete --quiet $WHOLE_FILE_OPT -f '+ /ib_logfile[0-9]*' -f '- **' "$WSREP_LOG_DIR/" rsync://$WSREP_SST_OPT_ADDR-log_dir Trying to manually run rsync on the command line in a similar fashion fails, but I may not be recreating the exact command line properly. Oct 7, 2015 at 17:17
  • Also - might this be better suited for serverfault? What do people think? Oct 7, 2015 at 17:20

2 Answers 2


The cluster simply doesn't know. It'll send a sst to every node which requests it.

  • 3
    Can you provide a reference/source to back this up? Oct 7, 2015 at 16:19
  • 1
    @ShaunMcPeck you observed this in your own experiment, no?
    – eckes
    Aug 14, 2019 at 7:09

This feature is available in the recent MariaDB version 10.10.1. See MDEV-27246 which is titled: "Implement a method to add IPs to allowlist for Galera Cluster node addresses that can make SST/IST requests".

The ticket description states:

Currently, as long as a node has access to Galera Cluster's TCP ports, it is allowed to make SST/IST requests. In general, no authentication is performed.

According to the ticket description and comments, there is now a new system variable wsrep_allowlist which can contain a comma-separated list of IPv4 and/or IPv6 addresses.

See also the Galera section in the release notes for 10.10.1.

The feature is also mentioned in MariaDB Corporation's blog article Announcing MariaDB Community Server 10.9 GA and 10.10 RC

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.