Hortonworks Data Platform

Hadoop Security Guide

Except where otherwise noted, this document is licensed under Creative Commons Attribution ShareAlike 3.0 License

http://creativecommons.org/licenses/by-sa/3.0/legalcode

Hortonworks Data Platform (HDP) and any of its components are not anticipated to be combined with any hardware, software or data, except as expressly recommended in this documentation.

2015-12-21

Abstract

The Hortonworks Data Platform, powered by Apache Hadoop, is a massively scalable and 100% open source platform for storing, processing and analyzing large volumes of data. It is designed to deal with data from many sources and formats in a very quick, easy and cost-effective manner. The Hortonworks Data Platform consists of the essential set of Apache Hadoop projects including MapReduce, Hadoop Distributed File System (HDFS), HCatalog, Pig, Hive, HBase, Zookeeper and Ambari. Hortonworks is the major contributor of code and patches to many of these projects. These projects have been integrated and tested as part of the Hortonworks Data Platform release process and installation and configuration tools have also been included.

Unlike other providers of platforms built using Apache Hadoop, Hortonworks contributes 100% of our code back to the Apache Software Foundation. The Hortonworks Data Platform is Apache-licensed and completely open source. We sell only expert technical support, training and partner-enablement services. All of our technology is, and will remain free and open source.

Please visit the Hortonworks Data Platform page for more information on Hortonworks technology. For more information on Hortonworks services, please visit either the Support or Training page. Feel free to Contact Us directly to discuss your specific needs.

Contents

1. Hadoop Security Features

2. Setting Up Security for Manual Installs

1. Preparing Kerberos

1.1. Kerberos Overview
1.2. Installing and Configuring the KDC
1.3. Creating the Database and Setting Up the First Administrator
1.4. Creating Service Principals and Keytab Files for HDP

2. Configuring HDP for Kerberos

2.1. Creating Mappings Between Principals and UNIX Usernames
2.2. Examples
2.3. Adding Security Information to Configuration Files
2.4. Configuring Secure HBase and ZooKeeper
2.5. Configuring Hue

3. Setting up One-Way Trust with Active Directory

3.1. Configure Kerberos Hadoop Realm on the AD DC
3.2. Configure the AD Domain on the KDC and Hadoop Cluster Hosts

4. Configuring Proxy Users

3. Data Protection: Wire Encryption

1. Enabling RPC Encryption

2. Enabling Data Transfer Protocol

3. Enabling SSL: Understanding the Hadoop SSL Keystore Factory

4. Creating and Managing SSL Certificates

4.1. Obtain a Certificate from a Trusted Third-Party Certification Authority (CA)
4.2. Create and Set Up an Internal CA (OpenSSL)
4.3. Installing Certificates in the Hadoop SSL Keystore Factory (HDFS, MapReduce, and YARN)
4.4. Using a CA-Signed Certificate

5. Enabling SSL for HDP Components

5.1. Enable SSL for WebHDFS, MapReduce Shuffle, and YARN
5.2. Enable SSL on Oozie
5.3. Enable SSL on WebHBase and the HBase REST API
5.4. Enable SSL on HiveServer2
5.5. Enable SSL for Kafka Clients

6. Connecting to SSL-Enabled Components

6.1. Connect to SSL Enabled HiveServer2 using JDBC
6.2. Connect to SSL Enabled Oozie Server

List of Tables

2.1. Service Principals
2.2. Service Keytab File Names
2.3. General core-site.xml, Knox, and Hue
2.4. core-site.xml Master Node Settings -- Knox Gateway
2.5. core-site.xml Master Node Settings -- Hue
2.6. hdfs-site.xml File Property Settings
2.7. yarn-site.xml Property Settings
2.8. mapred-site.xml Property Settings
2.9. hbase-site.xml Property Settings -- HBase Server
2.10. hive-site.xml Property Settings
2.11. oozie-site.xml Property Settings
2.12. webhcat-site.xml Property Settings
3.1. Components that Support SSL
3.2. Configure SSL Data Protection for HDP Components
3.3. Configuration Properties in ssl-server.xml

Legal notices