By default, what do Kafka broker network connections have?

By default, Apache Kafka is configured for a "trusted network" environment, prioritizing ease of use and initial setup over security. The default network listener uses the PLAINTEXT security protocol, which transmits data without any encryption. This default configuration does not implement any mechanism to verify the identity of clients connecting to the brokers, meaning there is no authentication. Consequently, as there is no authenticated principal (user), there is no basis for performing authorization checks against access control lists (ACLs). All security features—encryption (SSL/TLS), authentication (SASL or SSL), and authorization (ACLs)—must be explicitly configured by the administrator.

B: Encryption is not enabled by default. The default security protocol is PLAINTEXT, which sends data in the clear.

C: Authentication is not enabled by default. Clients can connect anonymously without providing credentials.

D: Both encryption and authentication are disabled by default and require explicit configuration to be enabled.

1. Confluent Documentation, "Encryption and Authentication using SSL for Apache Kafka®": In the "Prerequisites" section, it states, "By default, Kafka communication is unencrypted. To encrypt communication, you need to configure SSL for encryption on all the Confluent Platform components." This confirms encryption is off by default.

Source: Confluent Documentation, Confluent Platform v7.6, Security > On-Premises Deployments > Encryption and Authentication using SSL.

2. Apache Kafka Documentation, "3. Security": The security overview section introduces encryption, authentication, and authorization as features that need to be configured. For authorization, it specifies, "By default, when no authorizer.class.name is configured, Kafka authorizes all actions for all principals." This confirms authorization is effectively off by default.

Source: Apache Kafka 3.7 Documentation, Section 3.4, "Authorization and ACLs".

3. Confluent Documentation, "Authentication using SASL for Apache Kafka®": This guide details the steps required to enable authentication. The existence of a multi-step configuration process for enabling SASL confirms that it is not a default feature. The introduction states you must "configure Kafka brokers for SASL authentication."

Source: Confluent Documentation, Confluent Platform v7.6, Security > On-Premises Deployments > Authentication using SASL.