Mailing-List: contact user-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@hadoop.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
MIME-Version: 1.0
In-Reply-To: 
 <CALB5Fy9cw38Rx9ZtO+z+UZo671AgW0obS=3Ki4kvsCUUgFF8UQ@mail.gmail.com>
References: 
 <CALB5Fy8L0HhLJKCNTb4mhLFnzUqV3Qc0A7ZXibg9hJcmoKzmaQ@mail.gmail.com>
 <C7128CA403432849A4483B030F4489543574BDF2@turn-mail02.turn.corp>
 <CALB5Fy-MRwbL2BQ4g5crxehhrRPL3H-Bp6tfw9NDZahjBWzr+g@mail.gmail.com>
 <CAPQV63VQrrboMyq34jn6y8YX1HnDc9NRaAyzvDk65CwnXVw6+g@mail.gmail.com>
 <CALB5Fy9cw38Rx9ZtO+z+UZo671AgW0obS=3Ki4kvsCUUgFF8UQ@mail.gmail.com>
From: Jean-Marc Spaggiari <jean-marc@spaggiari.org>
Date: Tue, 26 Feb 2013 19:57:11 -0500
Message-ID: 
 <CAPQV63Um=0OsUxHcXyYfOYEEXwnnx=Vxx7zuOQ0DkrUh-wpTnQ@mail.gmail.com>
Subject: Re: JobTracker security
To: user@hadoop.apache.org
Content-Type: text/plain; charset=UTF-8

I mean the executable files. Or even the entire hadoop directory?
People might still be able to install a local copy of hadoop and
configure it to point to the same trackers, and then do the kill, but
at least that will complicate the things a bit?

If user1 and user2 are on different groups also, that might allow you
to block some user2 actions against user1 processes? Also, you should
take look to the "Security" chapter in "Hadoop: The Definitive Guide"
and to the hadoop-policy.xml file (I never looked at this file, so
maybe it's not at all related).

2013/2/26 Serge Blazhievsky <hadoop.ca@gmail.com>:
> hi Jean,
>
> Do you mean input files for hadoop ? or hadoop directory?
>
> Serge
>
>
> On Tue, Feb 26, 2013 at 4:38 PM, Jean-Marc Spaggiari
> <jean-marc@spaggiari.org> wrote:
>>
>> Maybe restrict access to the hadoop file(s) to the user1?
>>
>> 2013/2/26 Serge Blazhievsky <hadoop.ca@gmail.com>:
>> > I am trying to not to use kerberos...
>> >
>> > Is there other option?
>> >
>> > Thanks
>> > Serge
>> >
>> >
>> > On Tue, Feb 26, 2013 at 3:31 PM, Patai Sangbutsarakum
>> > <Patai.Sangbutsarakum@turn.com> wrote:
>> >>
>> >> Kerberos
>> >>
>> >> From: Serge Blazhievsky <hadoop.ca@gmail.com>
>> >> Reply-To: <user@hadoop.apache.org>
>> >> Date: Tue, 26 Feb 2013 15:29:08 -0800
>> >> To: <user@hadoop.apache.org>
>> >> Subject: JobTracker security
>> >>
>> >> Hi all,
>> >>
>> >> Is there a way to restrict job monitoring and management only to jobs
>> >> started by each individual user?
>> >>
>> >>
>> >> The basic scenario is:
>> >>
>> >> 1. Start a job under user1
>> >> 2. Login as user2
>> >> 3. hadoop job -list to retrieve job id
>> >> 4. hadoop job -kill job_id
>> >> 5. Job gets terminated....
>> >>
>> >> Is there something that needs to be enabled to prevent that from
>> >> happening?
>> >>
>> >> Thanks
>> >> Serge
>> >
>> >
>
>