Mailing-List: contact mapreduce-user-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: mapreduce-user@hadoop.apache.org
Received-SPF: pass (nike.apache.org: domain of bigbibguy@gmail.com designates
 209.85.210.50 as permitted sender)
MIME-Version: 1.0
Date: Fri, 30 Sep 2011 19:19:46 -0700
Message-ID: 
 <CAM0suvXDCjsN=dyrTu4Z355gXDkYkogUbjHRYvckKeJ72kyPYA@mail.gmail.com>
Subject: Hadoop Security - TaskTracker and Active Directory
From: bigbibguy father <bigbibguy@gmail.com>
To: mapreduce-user@hadoop.apache.org
Content-Type: multipart/alternative; boundary=bcaec52163032be13c04ae336012

--bcaec52163032be13c04ae336012
Content-Type: text/plain; charset=ISO-8859-1

We are planning to enable secure Hadoop using Kerberos.

Our users reside in the active directory. We read that there are two options
 to use Kerberos for securing Hadoop.

1) You run Kerberos on machine local to the cluster and create service
principals here
2) Use Active Directory itself as the kerberos KDC and create service
principals also in Active Directory.

It seems cloudera and industry in general recommends option1 of running a
local KDC for authernticating service principals.
https://ccp.cloudera.com/display/CDHDOC/Integrating+Hadoop+Security+with+Active+Directory

 I read that the tasktrackers run tasks as the user who submitted the user.
In that case , doesn't the TaskTracker nodes need to talk to the Active
Directory to get the user details like gid etc ?

So does this mean that every node (tasktrackers, job tracker and namenode)
 will be interacting with the Active Directory anyway ?

If so, option 1 doesn't seem to be superior since each node has to talk to
two kdc's - local kerberos for authenticating service principals, Active
Directory to get the user details and group information .

Please correct me if I am wrong in my assumptions.

Thanks and Regards,

BBG

--bcaec52163032be13c04ae336012
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

We are planning to enable secure Hadoop using Kerberos.=A0<div><br></div><d=
iv>Our users reside in the active directory. We read that there are two opt=
ions =A0to use Kerberos for securing Hadoop.</div><div><br></div><div>1) Yo=
u run Kerberos on machine local to the cluster and create service principal=
s here</div>
<div>2) Use Active Directory itself as the kerberos KDC and create service =
principals also in Active Directory.</div><div><br></div><div>It seems clou=
dera and industry in general recommends option1 of running a local KDC for =
authernticating service principals.</div>
<div><a href=3D"https://ccp.cloudera.com/display/CDHDOC/Integrating+Hadoop+=
Security+with+Active+Directory">https://ccp.cloudera.com/display/CDHDOC/Int=
egrating+Hadoop+Security+with+Active+Directory</a></div><div><br></div><div=
>
=A0I read that the tasktrackers run tasks as the user who submitted the use=
r. In that case , doesn&#39;t the TaskTracker nodes need to talk to the Act=
ive Directory to get the user details like gid etc ?</div><div><br></div>
<div>So does this mean that every node (tasktrackers, job tracker and namen=
ode) =A0will be interacting with the Active Directory anyway ?</div><div><b=
r></div><div>If so, option 1 doesn&#39;t seem to be superior since each nod=
e has to talk to two kdc&#39;s - local kerberos for authenticating service =
principals, Active Directory to get the user details and group information =
.=A0</div>
<div><br></div><div>Please correct me if I am wrong in my assumptions.</div=
><div><br></div><div>Thanks and Regards,</div><div><br></div><div>BBG</div>

--bcaec52163032be13c04ae336012--