Hadoop cluster security2: How to enable hadoop Service Level Authorization

Reference:

http://hadoop.apache.org/docs/current/hadoop-project-dist/hadoop-common/ServiceLevelAuth.html

Steps:

Add following in core-site.xml:

<!--For Service Level Authorization, together with hadoop-policy.xml-->

<property>

<name>hadoop.security.authorization</name>

<value>true</value>

</property>
hadoop-policy.xml: Besides clinets related properties, all other services are just permitted to hadoop admin user. Here is user hadoop, group hadoop. Bold ones are for clients access control.

<configuration>

<property>

<name>security.client.protocol.acl</name>

<value>chenfangfang,hadoop chenfangfang,hadoop</value>

<description>ACL for ClientProtocol, which is used by user code

via the DistributedFileSystem.

The ACL is a comma-separated list of user and group names. The user and

group list is separated by a blank. For e.g. "alice,bob users,wheel".

A special value of "*" means all users are allowed.</description>

</property>

<property>

<name>security.client.datanode.protocol.acl</name>

<value>chenfangfang,hadoop chenfangfang,hadoop</value>

<description>ACL for ClientDatanodeProtocol, the client-to-datanode protocol

for block recovery.

The ACL is a comma-separated list of user and group names. The user and

group list is separated by a blank. For e.g. "alice,bob users,wheel".

A special value of "*" means all users are allowed.</description>

</property>

<property>

<name>security.datanode.protocol.acl</name>

<value>hadoop hadoop</value>

<description>ACL for DatanodeProtocol, which is used by datanodes to

communicate with the namenode.

The ACL is a comma-separated list of user and group names. The user and

group list is separated by a blank. For e.g. "alice,bob users,wheel".

A special value of "*" means all users are allowed.</description>

</property>

<property>

<name>security.inter.datanode.protocol.acl</name>

<value>hadoop hadoop</value>

<description>ACL for InterDatanodeProtocol, the inter-datanode protocol

for updating generation timestamp.

The ACL is a comma-separated list of user and group names. The user and

group list is separated by a blank. For e.g. "alice,bob users,wheel".

A special value of "*" means all users are allowed.</description>

</property>

<property>

<name>security.namenode.protocol.acl</name>

<value>hadoop hadoop</value>

<description>ACL for NamenodeProtocol, the protocol used by the secondary

namenode to communicate with the namenode.

The ACL is a comma-separated list of user and group names. The user and

group list is separated by a blank. For e.g. "alice,bob users,wheel".

A special value of "*" means all users are allowed.</description>

</property>

<property>

<name>security.admin.operations.protocol.acl</name>

<value>hadoop hadoop</value>

<description>ACL for AdminOperationsProtocol. Used for admin commands.

The ACL is a comma-separated list of user and group names. The user and

group list is separated by a blank. For e.g. "alice,bob users,wheel".

A special value of "*" means all users are allowed.</description>

</property>

<property>

<name>security.refresh.user.mappings.protocol.acl</name>

<value>hadoop hadoop</value>

<description>ACL for RefreshUserMappingsProtocol. Used to refresh

users mappings. The ACL is a comma-separated list of user and

group names. The user and group list is separated by a blank. For

e.g. "alice,bob users,wheel". A special value of "*" means all

users are allowed.</description>

</property>

<property>

<name>security.refresh.policy.protocol.acl</name>

<value>hadoop hadoop</value>

<description>ACL for RefreshAuthorizationPolicyProtocol, used by the

dfsadmin and mradmin commands to refresh the security policy in-effect.

The ACL is a comma-separated list of user and group names. The user and

group list is separated by a blank. For e.g. "alice,bob users,wheel".

A special value of "*" means all users are allowed.</description>

</property>

<property>

<name>security.ha.service.protocol.acl</name>

<value>hadoop hadoop</value>

<description>ACL for HAService protocol used by HAAdmin to manage the

active and stand-by states of namenode.</description>

</property>

<property>

<name>security.zkfc.protocol.acl</name>

<value>hadoop hadoop</value>

<description>ACL for access to the ZK Failover Controller

</description>

</property>

<property>

<name>security.qjournal.service.protocol.acl</name>

<value>hadoop hadoop</value>

<description>ACL for QJournalProtocol, used by the NN to communicate with

JNs when using the QuorumJournalManager for edit logs.</description>

</property>

<property>

<name>security.mrhs.client.protocol.acl</name>

<value>chenfangfang,hadoop chenfangfang,hadoop</value>

<description>ACL for HSClientProtocol, used by job clients to

communciate with the MR History Server job status etc.

The ACL is a comma-separated list of user and group names. The user and

group list is separated by a blank. For e.g. "alice,bob users,wheel".

A special value of "*" means all users are allowed.</description>

</property>

<!-- YARN Protocols -->

<property>

<name>security.resourcetracker.protocol.acl</name>

<value>hadoop hadoop</value>

<description>ACL for ResourceTrackerProtocol, used by the

ResourceManager and NodeManager to communicate with each other.

The ACL is a comma-separated list of user and group names. The user and

group list is separated by a blank. For e.g. "alice,bob users,wheel".

A special value of "*" means all users are allowed.</description>

</property>

<property>

<name>security.resourcemanager-administration.protocol.acl</name>

<value>hadoop hadoop</value>

<description>ACL for ResourceManagerAdministrationProtocol, for admin commands.

The ACL is a comma-separated list of user and group names. The user and

group list is separated by a blank. For e.g. "alice,bob users,wheel".

A special value of "*" means all users are allowed.</description>

</property>

<property>

<name>security.applicationclient.protocol.acl</name>

<value>chenfangfang,hadoop chenfangfang,hadoop</value>

<description>ACL for ApplicationClientProtocol, used by the ResourceManager

and applications submission clients to communicate with each other.

The ACL is a comma-separated list of user and group names. The user and

group list is separated by a blank. For e.g. "alice,bob users,wheel".

A special value of "*" means all users are allowed.</description>

</property>

<property>

<name>security.applicationmaster.protocol.acl</name>

<value>hadoop hadoop</value>

<description>ACL for ApplicationMasterProtocol, used by the ResourceManager

and ApplicationMasters to communicate with each other.

The ACL is a comma-separated list of user and group names. The user and

group list is separated by a blank. For e.g. "alice,bob users,wheel".

A special value of "*" means all users are allowed.</description>

</property>

<property>

<name>security.containermanagement.protocol.acl</name>

<value>hadoop hadoop</value>

<description>ACL for ContainerManagementProtocol protocol, used by the NodeManager

and ApplicationMasters to communicate with each other.

The ACL is a comma-separated list of user and group names. The user and

group list is separated by a blank. For e.g. "alice,bob users,wheel".

A special value of "*" means all users are allowed.</description>

</property>

<property>

<name>security.resourcelocalizer.protocol.acl</name>

<value>hadoop hadoop</value>

<description>ACL for ResourceLocalizer protocol, used by the NodeManager

and ResourceLocalizer to communicate with each other.

The ACL is a comma-separated list of user and group names. The user and

group list is separated by a blank. For e.g. "alice,bob users,wheel".

A special value of "*" means all users are allowed.</description>

</property>

<property>

<name>security.job.task.protocol.acl</name>

<value>hadoop hadoop</value>

<description>ACL for TaskUmbilicalProtocol, used by the map and reduce

tasks to communicate with the parent tasktracker.

The ACL is a comma-separated list of user and group names. The user and

group list is separated by a blank. For e.g. "alice,bob users,wheel".

A special value of "*" means all users are allowed.</description>

</property>

<property>

<name>security.job.client.protocol.acl</name>

<value>chenfangfang,hadoop chenfangfang,hadoop</value>

<description>ACL for MRClientProtocol, used by job clients to

communciate with the MR ApplicationMaster to query job status etc.

The ACL is a comma-separated list of user and group names. The user and

group list is separated by a blank. For e.g. "alice,bob users,wheel".

A special value of "*" means all users are allowed.</description>

</property>

<property>

<name>security.applicationhistory.protocol.acl</name>

<value>chenfangfang,hadoop chenfangfang,hadoop</value>

<description>ACL for ApplicationHistoryProtocol, used by the timeline

server and the generic history service client to communicate with each other.

The ACL is a comma-separated list of user and group names. The user and

group list is separated by a blank. For e.g. "alice,bob users,wheel".

A special value of "*" means all users are allowed.</description>

</property>

</configuration>