Configuring Ranger Admin HA With SSL
Set up a load-balancer with SSL and enable Ranger Admin HA on an Ambari-managed cluster.
- Edit the
httpd.conffile:vi /usr/local/apache2/conf/httpd.conf
Make the following updates:
-
If you are not running the load-balancer on the default port 80, change the default listening port in line
Listen 80to match the port setting. -
Un-comment the following module entries (remove the
#symbol at the beginning of each line):LoadModule proxy_module modules/mod_proxy.so LoadModule proxy_http_module modules/mod_proxy_http.so LoadModule proxy_ajp_module modules/mod_proxy_ajp.so LoadModule proxy_balancer_module modules/mod_proxy_balancer.so LoadModule slotmem_shm_module modules/mod_slotmem_shm.so LoadModule lbmethod_byrequests_module modules/mod_lbmethod_byrequests.so LoadModule lbmethod_bytraffic_module modules/mod_lbmethod_bytraffic.so LoadModule lbmethod_bybusyness_module modules/mod_lbmethod_bybusyness.so LoadModule ssl_module modules/mod_ssl.so
NoteIf
LoadModule ssl_module modules/mod_ssl.sois not available in thehttpd.conffile, check to make sure that you performed all of the previous installation steps. The load balancer will not work properly without the SSL module. -
Update the ServerAdmin email address, or comment out that line.
#ServerAdmin you@example.com
-
- Enable Ranger Admin HA using Ambari. On the Ambari dashboard of the
first Ranger host, select Services > Ranger, then
select Service Actions > Enable Ranger Admin HA to
launch the Enable Ranger Admin HA Wizard.
- On the Get Started page, enter the load-balancer URL and port number (in this
example, 172.22.71.37:88), then click Next.
- On the Select Hosts page, confirm the host assignments, then click Next.
- Check the settings on the Review page, then click Next.
- Click Complete on the Install, Start, and Test
page to complete the installation.
- When the installation is complete, the Ranger Admin instances are listed on the
Ranger Summary page. Select Actions > Restart All
Required to restart all services that require a restart.
NoteFor Oracle, clear the
Setup DB and DB usercheck box under "Advanced ranger-env" to avoid DB setup. - To test the load-balancer and Ranger HA configuration, select Ranger > Service Actions > Stop on one of the Ranger hosts.
- Use a browser to check the load-balancer host URL (with port). You should see the
Ranger Admin page.
- Create a custom
conffile for the load-balancer SSL configuration:vi /usr/local/apache2/conf/ranger-lb-ssl.conf
Make the following updates:
Add the following lines, then change the
<VirtualHost *:8443>port to match the default port you set previously in thehttpd.conffile.<VirtualHost *:8443> SSLEngine On SSLProxyEngine On SSLCertificateFile /usr/local/apache2/conf/server.crt SSLCertificateKeyFile /usr/local/apache2/conf/server.key #SSLCACertificateFile /usr/local/apache2/conf/ranger_lb_crt.pem #SSLProxyCACertificateFile /usr/local/apache2/conf/ranger_lb_crt.pem SSLVerifyClient optional SSLOptions +ExportCertData SSLProxyVerify none SSLProxyCheckPeerCN off SSLProxyCheckPeerName off SSLProxyCheckPeerExpire off ProxyRequests off ProxyPreserveHost off Header add Set-Cookie "ROUTEID=.%{BALANCER_WORKER_ROUTE}e; path=/" env=BALANCER_ROUTE_CHANGED <Proxy balancer://rangercluster> BalancerMember http://172.22.71.39:6080 loadfactor=1 route=1 BalancerMember http://172.22.71.38:6080 loadfactor=1 route=2 Order Deny,Allow Deny from none Allow from all ProxySet lbmethod=byrequests scolonpathdelim=On stickysession=ROUTEID maxattempts=1 failonstatus=500,501,502,503 nofailover=Off </Proxy> # balancer-manager # This tool is built into the mod_proxy_balancer # module and will allow you to do some simple # modifications to the balanced group via a gui # web interface. <Location /balancer-manager> SetHandler balancer-manager Order deny,allow Allow from all </Location> ProxyPass /balancer-manager ! ProxyPass / balancer://rangercluster/ ProxyPassReverse / balancer://rangercluster/ </VirtualHost>NoteThe URLs listed in the
BalancerMemberentries are the IP addresses of the Ranger Admin hosts. In this example, the Ranger Admin host adresses are:http://172.22.71.38:6080 http://172.22.71.39:6080
- Use SSH to connect to the KDC server host. Use the
kadmin.localcommand to access the Kerberos CLI, then check the list of principals for each domain where Ranger Admin and the load-balancer are installed.kadmin.local kadmin.local: list_principals
For example, if Ranger Admin is installed on <host1> and <host2>, and the load-balancer is installed on <host3>, the list returned should include the following entries:
HTTP/ <host3>@EXAMPLE.COM HTTP/ <host2>@EXAMPLE.COM HTTP/ <host1>@EXAMPLE.COM
If the HTTP principal for any of these hosts is not listed, use the following command to add the principal:
kadmin.local: addprinc -randkey HTTP/<host3>@EXAMPLE.COM
NoteThis step will need to be performed each time the Spnego keytab is regenerated.