强化分布式 Cookie 与节点访问控制

Erlang nodes form a cluster by sharing a secret cookie. Any node that knows the cookie and can reach the port may connect — and once connected, can run arbitrary code. This makes the cookie a critical secret.

By default each node reads its cookie from ~/.erlang.cookie. If two nodes share it, they trust each other completely.

A weak or default cookie on a publicly reachable distribution port is a full remote-code-execution hole. Treat the cookie like a root password.

Set a long, random cookie explicitly at startup rather than relying on the file default.

The cookie file must be readable only by its owner. Erlang refuses to start if permissions are too open.

Use net_kernel options and firewall rules so only known hostnames can even attempt a connection. Distribution should never be exposed to the open internet.

Pin the distribution to specific ports and bind EPMD to a private interface so the cluster is unreachable from outside the trusted network.

nodes/0 lists currently connected nodes. Periodically auditing this list helps detect an unexpected peer.

Subscribe to node up/down events with net_kernel:monitor_nodes/1 to log or reject connections you did not expect.

Start tooling or monitoring nodes as hidden with -hidden so they connect without joining the full mesh, reducing the trust surface of your cluster.

Cookies alone are not enough. Combine them with TLS distribution, a private network (VPN/VLAN), firewalled EPMD, and least-privilege node placement.

You learned to harden node access:

• The shared cookie is the cluster password — keep it long, random, secret
• Protect ~/.erlang.cookie with 400 permissions
• Bind distribution and EPMD to private interfaces; firewall them
• Audit connected nodes with nodes/0 and monitor events
• Layer cookies with TLS and network isolation