howto encrypt erlang rpc calls (and Mnesia replication) and other traffic

Question

I believe that internode communication is taking place in the clear and that the cookie value is strictly used for authentication. (I do not have any proof as yet).

1. How do I encrypt internode comms?
2. How do I encrypt Mnesia replication messages?
3. How do I configure my firewall and packet filters to permit these messages to pass thru?
4. How do I prevent snooping of my erlang traffic?

Answer 1

Well, since it all runs over IP, one option would be to use IPSec between your nodes. Encrypted VPN connections could also do the trick. Neither of these require any changes on the Erlang side of things, nor will the Erlang programs or runtime be aware that the encryption is happening, except in the (hopefully) rare case of attacks that cause communication to fail, in which case it will look as if the other node is down.

Answer 2

There are basically two options:

1. Use SSL to connect the Erlang nodes as described on Trap Exit
2. Use underlaying IP mechanisms like VPN or IpSEC

Answer 3

You can use an SSH tunnel to pass all erlang communications through it, using the -rsh ssh parameter, you will want to set up certificate-based authentication for ssh (i.e. no passwords). Then you can simply use something along the lines of

erl -rsh ssh ....

For additional details, please see:

• Pooling and Automated Code Distribution with Erlang
• Starting a set of Erlang cluster nodes with SSH