Mailing-List: contact user-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@hadoop.apache.org
Received-SPF: pass (athena.apache.org: domain of vinodkv@hortonworks.com
 designates 209.85.160.54 as permitted sender)
From: Vinod Kumar Vavilapalli <vinodkv@hortonworks.com>
Message-Id: <2797631C-8377-43B5-9740-D387A6FA4407@hortonworks.com>
Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\))
Subject: Re: kerberos for outside threads
Date: Wed, 22 Jan 2014 10:21:31 -0800
References: 
 <CANx3uAg8bUpuQvbrpfNHH9TRKzhNAUz9Xai-UL4-NhyRu0ZLUQ@mail.gmail.com>
To: user@hadoop.apache.org
In-Reply-To: 
 <CANx3uAg8bUpuQvbrpfNHH9TRKzhNAUz9Xai-UL4-NhyRu0ZLUQ@mail.gmail.com>
Content-Type: multipart/alternative;
 boundary="Apple-Mail=_C6EAC0BD-0B6F-4B4C-852B-B942B0487096"

--Apple-Mail=_C6EAC0BD-0B6F-4B4C-852B-B942B0487096
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=ISO-8859-1


That is a very appropriate setup. As long as those assumptions remain valid=
, of course. This was the only way how early hadoop clusters were secured -=
 by restricting access to the cluster using firewall and gateways.

+Vinod

On Jan 21, 2014, at 4:45 PM, Koert Kuipers <koert@tresata.com> wrote:

> but for a hadoop cluster that sits "behind" a bunch of web servers to do =
say log analysis, and that already is protected by standard measures (no ro=
ute to cluster from outside, so a web server would have to get compromised =
to gain access), is there any value in securing it with kerberos? does anyo=
ne do that?


--=20
CONFIDENTIALITY NOTICE
NOTICE: This message is intended for the use of the individual or entity to=
=20
which it is addressed and may contain information that is confidential,=20
privileged and exempt from disclosure under applicable law. If the reader=
=20
of this message is not the intended recipient, you are hereby notified that=
=20
any printing, copying, dissemination, distribution, disclosure or=20
forwarding of this communication is strictly prohibited. If you have=20
received this communication in error, please contact the sender immediately=
=20
and delete it from your system. Thank You.

--Apple-Mail=_C6EAC0BD-0B6F-4B4C-852B-B942B0487096
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset=ISO-8859-1

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html charset=
=3Diso-8859-1"></head><body style=3D"word-wrap: break-word; -webkit-nbsp-mo=
de: space; -webkit-line-break: after-white-space;"><div><br></div><div>That=
 is a very appropriate setup. As long as those assumptions remain valid, of=
 course. This was the only way how early hadoop clusters were secured - by =
restricting access to the cluster using firewall and gateways.</div><div><b=
r></div><div>+Vinod</div><br><div><div>On Jan 21, 2014, at 4:45 PM, Koert K=
uipers &lt;<a href=3D"mailto:koert@tresata.com">koert@tresata.com</a>&gt; w=
rote:</div><br class=3D"Apple-interchange-newline"><blockquote type=3D"cite=
"><div dir=3D"ltr"><div class=3D"gmail_default" style=3D"font-family:courie=
r new,monospace">but for a hadoop cluster that sits "behind" a bunch of web=
 servers to do say log analysis, and that already is protected by standard =
measures (no route to cluster from outside, so a web server would have to g=
et compromised to gain access), is there any value in securing it with kerb=
eros? does anyone do that?
</div></div>
</blockquote></div><br></body></html>
<br>
<span style=3D"color:rgb(128,128,128);font-family:Arial,sans-serif;font-siz=
e:10px">CONFIDENTIALITY NOTICE</span><br style=3D"color:rgb(128,128,128);fo=
nt-family:Arial,sans-serif;font-size:10px"><span style=3D"color:rgb(128,128=
,128);font-family:Arial,sans-serif;font-size:10px">NOTICE: This message is =
intended for the use of the individual or entity to which it is addressed a=
nd may contain information that is confidential, privileged and exempt from=
 disclosure under applicable law. If the reader of this message is not the =
intended recipient, you are hereby notified that any printing, copying, dis=
semination, distribution, disclosure or forwarding of this communication is=
 strictly prohibited. If you have received this communication in error, ple=
ase contact the sender immediately and delete it from your system. Thank Yo=
u.</span>
--Apple-Mail=_C6EAC0BD-0B6F-4B4C-852B-B942B0487096--