Install and configure additional required components
Use the following steps to install additional required components for FIPS.
- Perform the Additional Steps for Apache Ranger.
Install and Configure TLS either automatically or manually.
If you are using Auto-TLS, see:If you are manually configuring TLS, see:
Generate certificates in BCFKS format
keytoolutility distributed with the JDK can generate BCFKS formatted keystores using the CCJ security provider. When the CCJ security provider is statically installed into the JDK as previously described, there is no need to pass the
-providerclass com.safelogic.cryptocomply.jcajce.provider.ProvBCFKSarguments. It is only necessary to pass
BCFKSas the storetype for the
keytooloperation being invoked.
keytool -importkeystorecan be used to import a PKCS12 keystore into a BCFKS keystore:
keytool \ -importkeystore -v \ -srckeystore <pkcs12_keystore_file> \ -srcstoretype PKCS12 \ -srcstorepass <pkcs12_pass> \ -destkeystore <bcfks_keystore_file> \ -deststoretype BCFKS \ -deststorepass <bcfks_keystore_pass> \ -destkeypass <bcfks_key_pass>
Systems administrators and other platform implementers should consult their organization’s information systems security managers for the correct procedures for generating keypairs and requesting signing of x509 certificates. The Cloudera Data Platform requires the private key and signed certificate in both PEM encoded and BCFKS keystore format. The steps to accomplish this task might look similar to the following:
- Have the CA sign the CSR.
Import the private key and signed certificate into a PKCS12
Import the PKCS12 keystore into a BCFKS keystore:
- Enable Kerberos authentication using the Cloudera Manager Kerberos wizard.
kdc_timeoutvalue in the
krb5.conffile to a high enough setting to avoid client timeout errors while running queries.
/etc/krb5.conffile with a text editor.
[libdefaults], set the
kdc_timeoutvalue to a minimum of 5000 (5 seconds).
- Open the
- Install Apache Knox. See Installing Apache Knox.
- Install Ranger KMS with Key Trustee Server. See Installing Ranger KMS backed with a Key Trustee Server and HA
- Configure HDFS Transparent Data Encryption with Ranger KMS with Key Trustee Server.