knox-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Larry McCay (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (KNOX-250) SSH Bastion Auditing Functionality
Date Wed, 12 Mar 2014 20:14:43 GMT

    [ https://issues.apache.org/jira/browse/KNOX-250?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13932290#comment-13932290
] 

Larry McCay commented on KNOX-250:
----------------------------------

Hi Ed - This is looking interesting! 
Do you have it working at all yet?

One thing that I can see after a quick review is that we will want to converge your auditing
with that provided by Knox itself.
See: gateway-util-common/src/main/java/org/apache/hadoop/gateway/audit/api/

You can see the tests for it in gateway-util-common/src/test/java/org/apache/hadoop/gateway/audit/AuditServiceTest.java.

We will need to determine exactly how to go about converging/consolidating them.

I will be looking closer at what you are doing for authentication when I have a few free cycles.

Thanks for the sneak peek!

> SSH Bastion Auditing Functionality
> ----------------------------------
>
>                 Key: KNOX-250
>                 URL: https://issues.apache.org/jira/browse/KNOX-250
>             Project: Apache Knox
>          Issue Type: New Feature
>            Reporter: Ed Kohlwey
>
> It would be nice for Knox to provide SSH tunneling and auditing functionality in addition
to the rest gateway services it provides. This would help Knox be a single-stop for cluster
audit logging requirements.
> Larry McCay provided the following design guidance via the mailing list related to an
implementation:
> * Apache Mina SSHD Knox Provider (providers are great for introducing
> configuration, filters, listeners, etc.)
> * Each topology (which represents a managed Hadoop cluster) may configure
> an optional sshd-provider
> * The sshd-provider would likely require a ShellFactory that sets up a
> tunneling client into the target cluster (perhaps with the sshd client
> component)
> * The sshd-provider ShellFactory would need to resolve the appropriate
> Hadoop client configuration for it's intended Hadoop cluster
> * The sshd-provider would expose a separate ssh port per cluster for users
> to connect to



--
This message was sent by Atlassian JIRA
(v6.2#6252)

Mime
View raw message