四字命令的安全风险

  conf  暴露:服务端配置(数据目录路径等)
         dataDir=<实验目录>
         dataDirSize=67109358
  envi  暴露:运行环境(Java 版本、用户名、工作目录、classpath)
         java.version=17.0.20.1
         os.name=Mac OS X
         user.name=w
  cons  暴露:所有客户端连接(来源地址、会话 id)
         /127.0.0.1:59141[1](queued=0,recved=5,sent=5,sid=0x1000c594b820000,lop=GETD,est=1790827418302,to=10000,lcxid=0
  dump  暴露:所有会话与它们持有的临时节点路径
         /svc/payments-prod
  wchp  暴露:被监听的路径与监听者
         /secret-config
  注意:四字命令读不到 znode 的数据内容(上面 /secret-config 的 password 没有出现),但路径名、会话、客户端地址、环境信息都能看到。

  srst(重置统计)前后 zk_packets_received:13 → 1(监控数据被清零)
  znode 数据没有被任何四字命令改变:/secret-config = b'db.password=hunter2'

  ruok  → imok
  srvr  → Zookeeper version: 3.9.6-${mvngit.commit.id}, built on 2026-09-14 21:34 UTC
  envi  → envi is not executed because it is not in the whitelist.
  cons  → cons is not executed because it is not in the whitelist.
  dump  → dump is not executed because it is not in the whitelist.
  conf  → conf is not executed because it is not in the whitelist.
  默认可用的命令(上面五个里): ['srvr']
  被禁止时的提示: envi is not executed because it is not in the whitelist.