question Re: Root user not showing up on Ranger in Support Questions

Root user not showing up on Ranger

marcusvmc — Tue, 08 Oct 2019 18:37:41 GMT

Why isn't the root user showing up on ranger?

I intend to give permission to the root user on Hbase but I'm getting the following error:

hbase(main):001:0> grant 'root','RWXCA' ERROR: org.apache.hadoop.hbase.coprocessor.CoprocessorException: HTTP 400 Error: root is Not Found at org.apache.ranger.authorization.hbase.RangerAuthorizationCoprocessor.grant(RangerAuthorizationCoprocessor.java:1261) at org.apache.ranger.authorization.hbase.RangerAuthorizationCoprocessor.grant(RangerAuthorizationCoprocessor.java:1072) at org.apache.hadoop.hbase.protobuf.generated.AccessControlProtos$AccessControlService$1.grant(AccessControlProtos.java:10023) at org.apache.hadoop.hbase.protobuf.generated.AccessControlProtos$AccessControlService.callMethod(AccessControlProtos.java:10187) at org.apache.hadoop.hbase.regionserver.HRegion.execService(HRegion.java:8065) at org.apache.hadoop.hbase.regionserver.RSRpcServices.execServiceOnRegion(RSRpcServices.java:2426) at org.apache.hadoop.hbase.regionserver.RSRpcServices.execService(RSRpcServices.java:2408) at org.apache.hadoop.hbase.shaded.protobuf.generated.ClientProtos$ClientService$2.callBlockingMethod(ClientProtos.java:42010) at org.apache.hadoop.hbase.ipc.RpcServer.call(RpcServer.java:413) at org.apache.hadoop.hbase.ipc.CallRunner.run(CallRunner.java:131) at org.apache.hadoop.hbase.ipc.RpcExecutor$Handler.run(RpcExecutor.java:324) at org.apache.hadoop.hbase.ipc.RpcExecutor$Handler.run(RpcExecutor.java:304)

I assume this is because ranger does not recognize the unix root user. But why? Is there a workaround?

Re: Root user not showing up on Ranger

Shelton — Tue, 08 Oct 2019 20:14:36 GMT

@marcusvmc
ROOT use is not a normal HDP user but an OS superuser used to escalate privileges to do some changes on the host level.

The hbase super user is hbase just like hdfs 🙂 Ranger reads the /etc/passwd and /etc/group and ONLY loads (syncs) users /groups whos id is > 500

If you want to trick Ranger to sync root who's id is root:x:0:0:root:/root:/bin/bash then you have to tweak the minimum user ID below

Procedure

Configure Ranger user sync for UNIX:

On the Ranger Customize Services page, select the Ranger User Info tab.
Click Yes under Enable User Sync.

Use the Sync Source drop-down to select UNIX, then set the following properties:

Table 1. UNIX user sync propertiesProperty Description Default value

Minimum user ID	Only sync users above this user ID.	500
Password file	The location of the password file on the Linux server.	/etc/passwd
Group file	The location of the groups file on the Linux server.	/etc/group

Question:

Why would you want root user rights managed by Ranger? Use sudo if you want to impersonate root

I hope that helps !!

Re: Root user not showing up on Ranger

marcusvmc — Wed, 09 Oct 2019 11:44:52 GMT

I'm in a test environment and it would really help if I'm already logged in as root to do everything I need, including accessing Hbase.

I performed the changes and everything works perfectly! Thanks!