Step 7: Enable Hadoop Security

Minimum Required Role: Configurator (also provided by Cluster Administrator, Full Administrator)

To enable Hadoop security for the cluster, you enable it on an HDFS service. After you do so, the Cloudera Manager Server automatically enables Hadoop security on the MapReduce and YARN services associated with that HDFS service.

  1. Navigate to the HDFS Service > Configuration tab.
  2. In the Search field, type Hadoop Secure to show the Hadoop security properties (found under the Service-Wide > Security category).
  3. Click the value for the Hadoop Secure Authentication property and select the kerberos option to enable Hadoop security on the selected HDFS service.
  4. Click the value for the Hadoop Secure Authorization property and select the checkbox to enable service-level authorization on the selected HDFS service. You can specify comma-separated lists of users and groups authorized to use Hadoop services or perform admin operations using the following properties under the Service-Wide > Security section:
    • Authorized Users: Comma-separated list of users authorized to use Hadoop services.
    • Authorized Groups: Comma-separated list of groups authorized to use Hadoop services.
    • Authorized Admin Users: Comma-separated list of users authorized to perform admin operations on Hadoop.
    • Authorized Admin Groups: Comma-separated list of groups authorized to perform admin operations on Hadoop.
  5. In the Search field, type DataNode Transceiver to find the DataNode Transceiver Port property.
  6. Click the value for the DataNode Transceiver Port property and specify a privileged port number (below 1024). Cloudera recommends 1004.
  7. In the Search field, type DataNode HTTP to find the DataNode HTTP Web UI Port property and specify a privileged port number (below 1024). Cloudera recommends 1006.
  8. In the Search field type Data Directory Permissions to find the DataNode Data Directory Permissions property.
  9. Reset the value for the DataNode Data Directory Permissions property to the default value of 700 if not already set to that.
  10. Make sure you have changed the DataNode Transceiver Port, DataNode Data Directory Permissions and DataNode HTTP Web UI Port properties for every DataNode role group.
  11. Click Save Changes to save the configuration settings.

To enable ZooKeeper security:

  1. Navigate to the ZooKeeper Service > Configuration tab and click View and Edit.
  2. Click the value for Enable Kerberos Authentication property.
  3. Click Save Changes to save the configuration settings.

To enable HBase security:

  1. Navigate to the HBase Service > Configuration tab and click View and Edit.
  2. In the Search field, type HBase Secure to show the Hadoop security properties (found under the Service-Wide > Security category).
  3. Click the value for the HBase Secure Authorization property and select the checkbox to enable authorization on the selected HBase service.
  4. Click the value for the HBase Secure Authentication property and select kerberos to enable authorization on the selected HBase service.
  5. Click Save Changes to save the configuration settings.
(CDH 4.3 or later) To enable Solr security:
  1. Navigate to the Solr Service > Configuration tab and click View and Edit.
  2. In the Search field, type Solr Secure to show the Solr security properties (found under the Service-Wide > Security category).
  3. Click the value for the Solr Secure Authentication property and select kerberos to enable authorization on the selected Solr service.
  4. Click Save Changes to save the configuration settings.