Cloudera Docs

Configuring PAM authentication with Linux users

You can configure PAM authentication to allow built-in Linux users to log in to Cloudera Manager.

  1. Configure the Cloudera Manager Server host:
    1. The Linux user who is running Cloudera Manager (for example, cloudera-scm) must have read access to the system shadow file. Run the following command on the Cloudera Manager Server host to check the shadow file group permission::
      ls -l /etc/shadow
----r-----+ 1 root root 1738 Jul 16 17:09 /etc/shadow

      The above example shows that the root group of the shadow file is the owner group and not the shadow group. The '-r' indicates that the user in the root group can have read access to the shadow file.

      If you see something like ---------- 1 root root 1611 Jul 16 17:09 /etc/shadow, no group read permission is assigned. Add that permission to the file by running the following command:

      chmod g+r /etc/shadow
  2. Add the user to the owner group:
    usermod -a -G root cloudera-scm

    If the owner group is the shadow group:

    usermod -a -G shadow cloudera-scm
  3. In Cloudera Manager, click Administration > Settings > External Authentication.
  4. Verify that the Authentication Backend Order property is not set to "Database Only."
  5. Verify that the Authorization Backend Order property is not set to "Database Only." If set to Database Only, the external group mapping will not work.
  6. Select PAM as the external authentication type.
  7. If you have a specific PAM configuration you wish to use for Cloudera Manager, modify the PAM Service Name property with that configuration's name (it should correspond to a file residing in /etc/pam.d/). Otherwise, use the default value, login.
  8. Save the changes.
  9. When finished, restart the Cloudera Manager Server:
    sudo systemctl restart cloudera-scm-server
  10. To test the configuration, log into Cloudera Manager with a Linux user and run the following commands in the host server console to create a user and assign groups to the user:
    1. Create the user:
      useradd testUser
passwd testUser
    2. Assign groups to the user:
      groupadd testGroup
usermod -a -G testGroup testUser
  11. In Cloudera Manager, map roles to the groups that your user belongs to. Click Administration > Users & Roles > LDAP/PAM Groups, then Add LDAP/PAM Group Mapping.
You can now login to Cloudera Manager using the Linux user you just created.