Cloudera Docs

Enabling the TLS feature flag for Navigator Encrypt

This document provides a step-by-step procedural guide for enabling advanced TLS 1.3 security changes in Cloudera Manager and configuring the Navigator Encrypt service to utilize the updated cipher suites.

It outlines the complete administrative workflow across both the cluster CLI and the Cloudera Manager UI, covering:
  • Enabling the feature flag: Adding CMF_FF_TLS_ADVANCED_CONTROL to the Cloudera Manager server defaults and configuring supported TLS versions.
  • Installing Navigator Encrypt: Setting up system kernel dependencies, managing parcel distribution, and deploying the Navigator Encrypt service.
  • Configuring advanced TLS ciphers: Setting up specific TLS 1.3 ciphers (such as AES-GCM and ChaCha20-Poly1305) within the Navigator Encrypt service configurations.
  • Service verification: Guidance on restarting Cloudera Manager services or the entire cluster to apply global security changes.
  1. On the cluster CLI, update the Cloudera Manager server default file.
    1. ssh to the cluster.
    2. Edit the Cloudera Manager server default file: 
      vi /etc/default/cloudera-scm-server
    3. Add the following line at the end of the file to enable the TLS 1.3 changes in Cloudera Manager: 
      export CMF_FF_TLS_ADVANCED_CONTROL=true
    4. Restart the Cloudera Manager server to apply the changes: 
      systemctl restart cloudera-scm-server
  2. In the Cloudera Manager UI, update the supported TLS version.
    1. Once the server is restarted, log in to the Cloudera Manager UI.
    2. Navigate to Administration > Settings.
    3. Search for the supported_tls_versions configuration.
    4. Change its value to TLSv1.3.
    5. Click Save Changes.
    6. Now, log in to the cluster CLI and run systemctl restart cloudera-scm-server again, as Cloudera Manager requires a restart after changing this property.
  3. Install the Navigator Encrypt service in Cloudera Manager.
    1. Collect the Parcel Repository URL for NavEncrypt from the RE-portal.
    2. In the Cloudera Manager UI, click Parcels > Parcel Repositories & Network Settings.
    3. In the Remote Parcel Repository URLs property, click Add Another and add the Parcel Repository URL for NavEncrypt.
    4. Click Save & Verify Configuration.
    5. Close the Parcel Repositories & Network Settings dialog.
      On the Cluster page, the NavEncrypt parcel appears.
    6. Click Download > Distribute > Activate > OK in order.
    7. In Cluster CLI, confirm the activation of the NavEncrypt parcel by using the following commands: 
      sudo yum install dkms

sudo yum install cryptsetup

sudo yum install kernel-devel-<version>
    8. Go to the Cloudera Manager UI, and click the three dots beside the cluster.
    9. Click Add Service, select NavEncrypt, and click Continue.
    10. Select the host where navencrypt is needed, click Close, and then click Continue.
    11. Enter the Master Password and Ranger KMS Host, and then click Continue.
      You can track the progress on the Command Details page.
    12. Continue the process and click Finish.
    13. Start the service by navigating to Cloudera Manager > NavEncrypt > Actions > Start.
  4. In the Cloudera Manager UI, update the cipher values.
    1. Once the server is restarted, log into the Cloudera Manager UI again.
    2. Navigate to NavEncrypt > Configuration.
    3. Search for the adv_tls_ciphers_list property.
      The default value will be {{COPY_FROM_GLOBAL}}, which takes the global cipher provided by Cloudera Manager.
    4. To add new ciphers for Navigator Encrypt:
      1. Click on the add (+) button next to the property.
      2. Keep in mind that only one cipher can be added in one box; use the add (+) button to add another.
      3. Do not remove the default value; only add new ciphers if needed.
        The following ciphers are needed for the Navigator Encrypt service; there is no need to add the ciphers below if they are already present in {{COPY_FROM_GLOBAL}} variable. The {{COPY_FROM_GLOBAL}} can be checked through Administration > Settings > tls_ciphers. The new ciphers are as follows:
        • TLS_AES_256_GCM_SHA384
        • TLS_CHACHA20_POLY1305_SHA256 (on CPUs without AES-NI)
        • TLS_AES_128_GCM_SHA256
  5. Restar the Navigator Encrypt service.
    • Restart the Navigator Encrypt service if you are only testing Navigator Encrypt.
    • If you want to test plugin communication, restart the entire cluster so other services can have the new changes as well.