This is the documentation for CDH 5.1.x. Documentation for other versions is available at Cloudera Documentation.

Configuring Hadoop Security in CDH 5

  Important:

These instructions assume you know how to install and configure Kerberos, you already have a working Kerberos Key Distribution Center (KDC) and realm setup, and that you've installed the Kerberos user packages on all cluster machines and machines which will be used to access the cluster. Furthermore, Oozie and Hue require that the realm support renewable tickets. For more information about installing and configuring Kerberos, see:

Here are the general steps to configuring secure Hadoop, each of which is described in more detail in the following sections:

  1. Install CDH 5.
  2. Verify User Accounts and Groups in CDH 5 Due to Security.
  3. If you are Using AES-256 Encryption, install the JCE Policy File.
  4. Create and Deploy the Kerberos Principals and Keytab Files.
  5. Shut Down the Cluster.
  6. Enable Hadoop security.
  7. Configure secure HDFS.
  8. Optional: Configuring Security for HDFS High Availability.
  9. Optional: Configuring secure WebHDFS.
  10. Optional: Configuring secure NFS
  11. Set Variables for Secure DataNodes.
  12. Start up the NameNode.
  13. Start up a DataNode.
  14. Set the Sticky Bit on HDFS Directories.
  15. Start up the Secondary NameNode (if used).
  16. Configure Either MRv1 Security or YARN Security.
  Note:

Kerberos security in CDH 5 has been tested with the following version of MIT Kerberos 5:

  • krb5-1.6.1 on Red Hat Enterprise Linux 5 and CentOS 5

Kerberos security in CDH 5 is supported with the following versions of MIT Kerberos 5:

  • krb5-1.6.3 on SUSE Linux Enterprise Server (SLES) 11 Service Pack 1
  • krb5-1.8.1 on Ubuntu
  • krb5-1.8.2 on Red Hat Enterprise Linux 6 and CentOS 6
  • krb5-1.9 on Red Hat Enterprise Linux 6.1
  Note:

If you want to enable Kerberos SPNEGO-based authentication for the Hadoop web interfaces, see the Hadoop Auth, Java HTTP SPNEGO Documentation.

Page generated September 3, 2015.