Cloudera Docs

Securing the NFS Gateway

The HDFS NFS gateway uses the NFSv3 protocol, which lacks built-in cryptography. Additionally, Hadoop binds the NFS gateway server ports to a wildcard address (0.0.0.0), making it accessible to any host on any IP address. You must configure secure tunneling and restrict host access to encrypt the NFS communication.

Enabling the ENCRYPT_ALL_PORTS feature in Cloudera Manager displays a warning when an HDFS NFS Gateway is configured. This warning alerts you that the NFS Gateway provides unencrypted access to the HDFS cluster.

To encrypt NFS communication, configure secure tunneling directly on the gateway host outside Cloudera Manager. Because secure tunneling requires configuration on both the server and client sides, perform the following steps to secure the connection:

  1. Open your terminal.
  2. Add the following firewall rules to block direct access to the NFS Gateway default ports: 
    iptables -A INPUT -p tcp --dport 2049 -j DROP
iptables -A INPUT -p tcp --dport 4242 -j DROP
iptables -A INPUT -p tcp --dport 111  -j DROP
  3. Configure a secure tunnel on the server side using the following example stunnel configuration: 
    cert = /etc/stunnel/gateway.pem
key  = /etc/stunnel/gateway.key
CAfile = /etc/stunnel/ca.pem
verify = 2                 ; require + verify client cert — this is the access control
sslVersionMin = TLSv1.2

[nfsd]
accept  = 0.0.0.0:20490
connect = 127.0.0.1:2049

[mountd]
accept  = 0.0.0.0:20491
connect = 127.0.0.1:4242
  4. Configure a secure tunnel on the client side using the following example stunnel configuration: 
    client = yes
cert = /etc/stunnel/client.pem
key  = /etc/stunnel/client.key
CAfile = /etc/stunnel/ca.pem
verify = 2
checkHost = nfsgw.example.com
sslVersionMin = TLSv1.2

[nfsd]
accept  = 127.0.0.1:2049
connect = nfsgw.example.com:20490

[mountd]
accept  = 127.0.0.1:4242
connect = nfsgw.example.com:20491
  5. Mount the file system on the client host using the local ports of the client-side tunnel: 
    mount -t nfs -o vers=3,proto=tcp,port=2049,mountport=4242,mountproto=tcp,nolock,sync,rsize=1048576,wsize=1048576 127.0.0.1:/ /mnt/hdfs
  6. Set the Allowed Hosts and Privileges (nfs.exports.allowed.hosts) property in Cloudera Manager to 127.0.0.1 rw.