ambari-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Hudson (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (AMBARI-13695) Minimize HDFS and other headless keytab distribution (security concerns)
Date Mon, 16 Nov 2015 22:10:11 GMT

    [ https://issues.apache.org/jira/browse/AMBARI-13695?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15007448#comment-15007448
] 

Hudson commented on AMBARI-13695:
---------------------------------

FAILURE: Integrated in Ambari-trunk-Commit #3844 (See [https://builds.apache.org/job/Ambari-trunk-Commit/3844/])
AMBARI-13695. Minimize HDFS and other headless keytab distribution (aonishuk: [http://git-wip-us.apache.org/repos/asf?p=ambari.git&a=commit&h=120021cdf6e3585101b23c9fa5019d1185b84749])
* ambari-server/src/main/resources/common-services/HDFS/2.1.0.2.0/kerberos.json
* ambari-server/src/main/resources/stacks/HDP/2.3.GlusterFS/services/ACCUMULO/kerberos.json
* ambari-server/src/main/resources/common-services/ACCUMULO/1.6.1.2.2.0/kerberos.json
* ambari-server/src/main/resources/stacks/HDP/2.3/services/ACCUMULO/kerberos.json
* ambari-server/src/main/resources/stacks/HDP/2.2/services/YARN/kerberos.json
* ambari-server/src/main/resources/common-services/HBASE/0.96.0.2.0/kerberos.json
* ambari-server/src/main/resources/common-services/SLIDER/0.60.0.2.2/kerberos.json
* ambari-server/src/main/resources/common-services/SPARK/1.4.1.2.3/kerberos.json
* ambari-server/src/main/resources/stacks/HDP/2.3/services/YARN/kerberos.json
* ambari-server/src/main/resources/common-services/MAHOUT/1.0.0.2.3/kerberos.json
* ambari-server/src/main/resources/common-services/HIVE/0.12.0.2.0/kerberos.json
* ambari-server/src/main/resources/common-services/SPARK/1.2.0.2.2/kerberos.json
* ambari-server/src/main/resources/common-services/YARN/2.1.0.2.0/kerberos.json
* ambari-server/src/main/resources/stacks/HDP/2.3/services/TEZ/kerberos.json
* ambari-server/src/main/resources/common-services/TEZ/0.4.0.2.1/kerberos.json
* ambari-server/src/main/resources/common-services/OOZIE/4.2.0.2.3/kerberos.json
* ambari-server/src/main/resources/common-services/FALCON/0.5.0.2.1/kerberos.json
* ambari-server/src/main/resources/common-services/OOZIE/4.0.0.2.0/kerberos.json
* ambari-server/src/main/resources/common-services/PIG/0.12.0.2.0/kerberos.json


> Minimize HDFS and other headless keytab distribution (security concerns)
> ------------------------------------------------------------------------
>
>                 Key: AMBARI-13695
>                 URL: https://issues.apache.org/jira/browse/AMBARI-13695
>             Project: Ambari
>          Issue Type: Bug
>          Components: ambari-server
>    Affects Versions: 2.0.0
>            Reporter: Robert Levas
>            Assignee: Robert Levas
>            Priority: Critical
>              Labels: hdfs, keytabs, security
>             Fix For: 2.1.3
>
>
> Currently, we distribute the *hdfs* headless principal to pretty much every single host
in the cluster.  
> Since *hdfs* is a super user in HDFS, if any one of the hdfs keytabs are compromised
on any host, the user can do anything on HDFS.
> We need to revisit and see if we can restrict the number of hosts to which we distribute
the hdfs headless keytab.
> For example, we can perform necessary HDFS operations on one of the master hosts available,
rather than picking an arbitrary client / slave hosts as we do today.
> Also, we should look into not only hdfs headless keytabs but all other headless ones
like hbase, storm, etc.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message