Mailing-List: contact user-help@hbase.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@hbase.apache.org
Received-SPF: pass (nike.apache.org: domain of andrew.purtell@gmail.com
 designates 209.85.160.181 as permitted sender)
References: 
 <CAAMYKhoBtzvOgR0t5y=wVz=zdU2ZqEJ0ORXXb5zfJagagRhMeg@mail.gmail.com>
 <CA+RK=_Ao-giR-0LdUgZBTCMv_3umo_UTCWt6HFjH3xZ2iTVuGw@mail.gmail.com>
 <CAAMYKhqdXaLc4dY3fDXYqbAbNy7T+F4BJQox2oPm+qd4JCBy9w@mail.gmail.com>
In-Reply-To: 
 <CAAMYKhqdXaLc4dY3fDXYqbAbNy7T+F4BJQox2oPm+qd4JCBy9w@mail.gmail.com>
Mime-Version: 1.0 (1.0)
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii
Message-Id: <669C5054-0A6D-4C6A-B8F0-C4445D43F3FA@gmail.com>
Cc: "user@hbase.apache.org" <user@hbase.apache.org>
From: Andrew Purtell <andrew.purtell@gmail.com>
Subject: Re: HBase 0.94 security configurations
Date: Thu, 31 May 2012 20:56:34 +0200
To: "user@hbase.apache.org" <user@hbase.apache.org>

Security is optional.=20

If you don't set any SASL protected ACLs on znodes, then the client doesn't n=
eed to authenticate, you should not add any security options to the site fil=
e like you currently are, and the message on startup about the state of JAAS=
 configuration is informative only and is not relevant to you.=20

If you don't run with a server that supports security (like 3.3) then again t=
he message on startup is only informative.

    - Andy

On May 31, 2012, at 7:35 PM, Amit Sela <amits@infolinks.com> wrote:

> I still don't understand if it is optional to use the security or not ?
>=20
> if i'll set the following in hbase-site.xml:
>=20
> <property>
>        <name>hbase.zookeeper.property.requireClientAuthScheme</name>
>        <value></value>
>        <description>Property from ZooKeeper's config zoo.cfg.
>            Authentication scheme.
>        </description>
> </property>
>=20
> will it cancel the need of sasl-authentication ?
>=20
> If I go back to ZooKeeper 3.3.2 (which doesn't support security) - will
> HBase 0.94 and Hadoop 1.0.3 work or must they run with a ZooKeeper that
> supports security ?
>=20
>=20
> On Thu, May 31, 2012 at 7:01 PM, Andrew Purtell <apurtell@apache.org> wrot=
e:
>=20
>> See https://cwiki.apache.org/ZOOKEEPER/zookeeper-and-sasl.html
>>=20
>> For a fully baked (but simple) example configuration, have a look at
>> https://github.com/apurtell/tm-ec2-demo/ . Start with
>>=20
>> https://github.com/apurtell/tm-ec2-demo/blob/master/bin/image/tarball/set=
up-remote
>>=20
>> On Thu, May 31, 2012 at 8:55 AM, Amit Sela <amits@infolinks.com> wrote:
>>> Hi all,
>>>=20
>>> I'm upgrading our cluster with the following versions:
>>> HBase 0.90.2 to 0.94.0
>>> Hadoop 0.20.3 to 1.0.3
>>> zookeeper 3.3.2 to 3.4.3
>>>=20
>>> As a first step, I'm trying to run some tests on my PC and I get a
>>> SecurityException from zookeeper:
>>> SecurityException: java.lang.SecurityException: Unable to locate a login=

>>> configuration occurred when trying to find JAAS configuration.
>>>=20
>>> =46rom what I understand, this means that I have to create a JAAS
>>> configuration file and place it in the conf under HBASE_HOME.
>>>=20
>>> First of all, Is there a way to disable the use of the new security
>> feature
>>> - I'm working on a local test cluster for now and I don't really need
>> it...
>>>=20
>>> If I must use a JAAS conf - could anyone elaborate on how to setup
>>> everything: Kerberos KDC, JAAS Configuration file, where to put
>> everything
>>> and anything else I'm missing here.
>>>=20
>>> Thanks.
>>=20
>>=20
>>=20
>> --
>> Best regards,
>>=20
>>   - Andy
>>=20
>> Problems worthy of attack prove their worth by hitting back. - Piet
>> Hein (via Tom White)
>>=20