Return-Path: <hdfs-issues-return-163386-archive-asf-public=cust-asf.ponee.io@hadoop.apache.org>
X-Original-To: archive-asf-public-internal@cust-asf2.ponee.io
Delivered-To: archive-asf-public-internal@cust-asf2.ponee.io
Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183])
	by cust-asf2.ponee.io (Postfix) with ESMTP id 36F05200B4A
	for <archive-asf-public-internal@cust-asf2.ponee.io>; Tue,  5 Jul 2016 23:14:13 +0200 (CEST)
Received: by cust-asf.ponee.io (Postfix)
	id 35898160A2C; Tue,  5 Jul 2016 21:14:13 +0000 (UTC)
Delivered-To: archive-asf-public@cust-asf.ponee.io
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by cust-asf.ponee.io (Postfix) with SMTP id 82F04160A70
	for <archive-asf-public@cust-asf.ponee.io>; Tue,  5 Jul 2016 23:14:12 +0200 (CEST)
Received: (qmail 69582 invoked by uid 500); 5 Jul 2016 21:14:11 -0000
Mailing-List: contact hdfs-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:hdfs-issues-help@hadoop.apache.org>
List-Unsubscribe: <mailto:hdfs-issues-unsubscribe@hadoop.apache.org>
List-Post: <mailto:hdfs-issues@hadoop.apache.org>
List-Id: <hdfs-issues.hadoop.apache.org>
Delivered-To: mailing list hdfs-issues@hadoop.apache.org
Received: (qmail 69535 invoked by uid 99); 5 Jul 2016 21:14:11 -0000
Received: from arcas.apache.org (HELO arcas) (140.211.11.28)
    by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 05 Jul 2016 21:14:11 +0000
Received: from arcas.apache.org (localhost [127.0.0.1])
	by arcas (Postfix) with ESMTP id 204F42C02AA
	for <hdfs-issues@hadoop.apache.org>; Tue,  5 Jul 2016 21:14:11 +0000 (UTC)
Date: Tue, 5 Jul 2016 21:14:11 +0000 (UTC)
From: "Anatoli Shein (JIRA)" <jira@apache.org>
To: hdfs-issues@hadoop.apache.org
Message-ID: <JIRA.12986935.1467749831000.30281.1467753251129@Atlassian.JIRA>
In-Reply-To: <JIRA.12986935.1467749831000@Atlassian.JIRA>
References: <JIRA.12986935.1467749831000@Atlassian.JIRA> <JIRA.12986935.1467749831224@arcas>
Subject: [jira] [Commented] (HDFS-10596) libhdfs++: Implement
 hdfsFileIsEncrypted
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394
archived-at: Tue, 05 Jul 2016 21:14:13 -0000


    [ https://issues.apache.org/jira/browse/HDFS-10596?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15363263#comment-15363263 ] 

Anatoli Shein commented on HDFS-10596:
--------------------------------------

In order to test this function we need an encryption zone in HDFS, and to set it up we need a key provider service running (kms).

To get kms server to run I did the following modifications to the config files:

/etc/hadoop/kms-site.xml:
<property>
    <name>hadoop.kms.key.provider.uri</name>
    <value>jceks://file@/${user.home}/kms.keystore</value>
    <description>
      URI of the backing KeyProvider for the KMS.
    </description>
  </property>

  <property>
    <name>hadoop.security.keystore.java-keystore-provider.password-file</name>
    <value>kms.keystore.password</value>
    <description>
      If using the JavaKeyStoreProvider, the password for the keystore file.
    </description>
  </property>

/etc/hadoop/core-site.xml
<property>
    <name>hadoop.security.key.provider.path</name>
    <value>kms://http@localhost:16000/kms</value>
    <description>
        Path to KeyProvider for the KMS.
    </description>
</property>

Then I needed to create a password file like this:
touch .../hadoop-2.6.0/share/hadoop/kms/tomcat/webapps/kms/WEB-INF/classes/kms.keystore.password

After that I was able to start/stop KMS service from .../hadoop-2.6.0/sbin  directory like this:
./kms.sh start
./kms.sh stop

Then I created a new encryption key:
hadoop key create myKey

And was able to list it:
hadoop key list -provider jceks://file@/home/anatoli/kms.keystore -metadata

Created a new directory:
hadoop fs -mkdir hdfs://localhost.localdomain:9433/zone

However I cannot create zone. This is the command I am trying:
hdfs crypto -createZone -keyName myKey -path hdfs://localhost.localdomain:9433/zone

And I get this error:
16/07/05 17:12:27 WARN util.NativeCodeLoader: Unable to load native-hadoop library for your platform... using builtin-java classes where applicable
RemoteException: Can't create an encryption zone for /zone since no key provider is available.

Not sure how to go around this. Does anyone have any ideas?

> libhdfs++: Implement hdfsFileIsEncrypted
> ----------------------------------------
>
>                 Key: HDFS-10596
>                 URL: https://issues.apache.org/jira/browse/HDFS-10596
>             Project: Hadoop HDFS
>          Issue Type: Sub-task
>          Components: hdfs-client
>            Reporter: Anatoli Shein
>         Attachments: HDFS-10596.HDFS-8707.000.patch
>
>




--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

---------------------------------------------------------------------
To unsubscribe, e-mail: hdfs-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: hdfs-issues-help@hadoop.apache.org