Security (October 30, 2017)
Total Page:16
File Type:pdf, Size:1020Kb
Hortonworks Data Platform Security (October 30, 2017) docs.cloudera.com Hortonworks Data Platform October 30, 2017 Hortonworks Data Platform: Security Copyright © 2012-2017 Hortonworks, Inc. Some rights reserved. The Hortonworks Data Platform, powered by Apache Hadoop, is a massively scalable and 100% open source platform for storing, processing and analyzing large volumes of data. It is designed to deal with data from many sources and formats in a very quick, easy and cost-effective manner. The Hortonworks Data Platform consists of the essential set of Apache Hadoop projects including MapReduce, Hadoop Distributed File System (HDFS), HCatalog, Pig, Hive, HBase, ZooKeeper and Ambari. Hortonworks is the major contributor of code and patches to many of these projects. These projects have been integrated and tested as part of the Hortonworks Data Platform release process and installation and configuration tools have also been included. Unlike other providers of platforms built using Apache Hadoop, Hortonworks contributes 100% of our code back to the Apache Software Foundation. The Hortonworks Data Platform is Apache-licensed and completely open source. We sell only expert technical support, training and partner-enablement services. All of our technology is, and will remain free and open source. Please visit the Hortonworks Data Platform page for more information on Hortonworks technology. For more information on Hortonworks services, please visit either the Support or Training page. Feel free to Contact Us directly to discuss your specific needs. Except where otherwise noted, this document is licensed under Creative Commons Attribution ShareAlike 4.0 License. http://creativecommons.org/licenses/by-sa/4.0/legalcode ii Hortonworks Data Platform October 30, 2017 Table of Contents 1. HDP Security Overview ................................................................................................ 1 1.1. What's New in This Release ............................................................................... 1 1.2. Understanding Data Lake Security .................................................................... 5 1.3. HDP Security Features ....................................................................................... 6 1.3.1. Administration ....................................................................................... 7 1.3.2. Authentication and Perimeter Security ................................................... 8 1.3.3. Authorization ......................................................................................... 9 1.3.4. Audit .................................................................................................... 11 1.3.5. Data Protection .................................................................................... 11 2. Authentication ........................................................................................................... 12 2.1. Enabling Kerberos Authentication Using Ambari ............................................. 12 2.1.1. Kerberos Overview ............................................................................... 12 2.1.2. Kerberos Principals ............................................................................... 13 2.1.3. Installing and Configuring the KDC ....................................................... 14 2.1.4. Enabling Kerberos Security ................................................................... 19 2.1.5. Kerberos Client Packages ...................................................................... 24 2.1.6. Disabling Kerberos Security .................................................................. 24 2.1.7. Customizing the Attribute Template ..................................................... 25 2.1.8. Managing Admin Credentials ............................................................... 25 2.2. Configuring HDP Components for Kerberos Using Ambari ............................... 26 2.2.1. Configuring Kafka for Kerberos Using Ambari ...................................... 26 2.2.2. Configuring Storm for Kerberos Using Ambari ...................................... 41 2.3. Configuring Ambari Authentication with LDAP or AD ...................................... 46 2.3.1. Configuring Ambari for LDAP or Active Directory Authentication .......... 46 2.3.2. Configuring Ranger Authentication with UNIX, LDAP, or AD ................. 52 2.3.3. Encrypting Database and LDAP Passwords in Ambari ............................ 60 2.4. Configuring LDAP Authentication in Hue ......................................................... 62 2.4.1. Enabling the LDAP Backend ................................................................. 62 2.4.2. Enabling User Authentication with Search Bind ..................................... 62 2.4.3. Setting the Search Base to Find Users and Groups ................................. 63 2.4.4. Specifying the URL of the LDAP Server ................................................. 64 2.4.5. Specifying LDAPS and StartTLS Support ................................................ 64 2.4.6. Specifying Bind Credentials for LDAP Searches ...................................... 64 2.4.7. Synchronizing Users and Groups ........................................................... 64 2.4.8. Setting Search Bind Authentication and Importing Users and Groups ........................................................................................................... 65 2.4.9. Setting LDAP Users' Filter ..................................................................... 65 2.4.10. Setting an LDAP Groups Filter ............................................................ 66 2.4.11. Setting Multiple LDAP Servers ............................................................. 66 2.5. Advanced Security Options for Ambari ............................................................ 67 2.5.1. Configuring Ambari for Non-Root ......................................................... 67 2.5.2. Optional: Ambari Web Inactivity Timeout ............................................. 71 2.5.3. Optional: Set Up Kerberos for Ambari Server ........................................ 72 2.5.4. Optional: Set Up Two-Way SSL Between Ambari Server and Ambari Agents ........................................................................................................... 73 2.5.5. Optional: Configure Ciphers and Protocols for Ambari Server ................ 73 2.5.6. Optional: HTTP Cookie Persistence ........................................................ 73 2.6. Enabling SPNEGO Authentication for Hadoop ................................................. 74 iii Hortonworks Data Platform October 30, 2017 2.6.1. Configure Ambari Server for Authenticated HTTP ................................. 74 2.6.2. Configuring HTTP Authentication for HDFS, YARN, MapReduce2, HBase, Oozie, Falcon and Storm .................................................................... 74 2.6.3. Enabling Browser Access to a SPNEGO-enabled Web UI ........................ 75 2.7. Setting Up Kerberos Authentication for Non-Ambari Clusters ........................... 76 2.7.1. Preparing Kerberos ............................................................................... 76 2.7.2. Configuring HDP for Kerberos .............................................................. 82 2.7.3. Setting up One-Way Trust with Active Directory .................................. 110 2.7.4. Configuring Proxy Users ...................................................................... 112 2.8. Perimeter Security with Apache Knox ............................................................ 112 2.8.1. Apache Knox Gateway Overview ........................................................ 112 2.8.2. Configuring the Knox Gateway ........................................................... 115 2.8.3. Defining Cluster Topologies ................................................................ 119 2.8.4. Configuring a Hadoop Server for Knox ............................................... 120 2.8.5. Mapping the Internal Nodes to External URLs ..................................... 126 2.8.6. Configuring Authentication ................................................................ 129 2.8.7. Configuring Identity Assertion ............................................................ 149 2.8.8. Configuring Service Level Authorization .............................................. 158 2.8.9. Audit Gateway Activity ....................................................................... 161 2.8.10. Gateway Security .............................................................................. 164 2.8.11. Setting Up Knox Services for HA ....................................................... 167 2.8.12. Knox CLI Testing Tools ...................................................................... 171 2.9. Knox SSO ...................................................................................................... 172 2.9.1. Identity Providers (IdP) ....................................................................... 172 2.9.2. Setting up Knox SSO for Ambari ......................................................... 177 2.9.3. Setting up Knox SSO for Ranger Web UI ............................................. 178 2.9.4. Setting up the Knox Token Service for Ranger APIs ............................. 179 2.9.5. Setting up Knox SSO for Apache Atlas ................................................ 181 3. Configuring Authorization in Hadoop .....................................................................