question Re: Dr.who virus in my YARN? how to resolve it using firewalld? in Support Questions

Dr.who virus in my YARN? how to resolve it using firewalld?

Mondi — Wed, 03 Jun 2020 10:02:23 GMT

Dr.who is running on my CDH 6.3, I've seen its crontab also using YARN user:

I've already remove the files of this and I want to implement some restrictions using firewalld,

how can I block this virus on running on my YARN 8088? do I need to block the 8088 port in all nodes? and what IP addresses do I need to insert for whitelisting? below is my current rules in firewalld:

public
target: default
icmp-block-inversion: no
interfaces:
sources:
services: dhcpv6-client ssh
ports: 8042/tcp 7191/tcp 2181/tcp 3181/tcp 4181/tcp 9010/tcp 8044/tcp 8041/tcp 8040/tcp 8091/tcp 9091/tcp 9995/tcp 9994/tcp 7184/tcp 7185/tcp 8084/tcp 8087/tcp 9087/tcp 9999/tcp 9998/tcp 9867/tcp 9866/tcp 9864/tcp 9865/tcp
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" source address="195.3.146.118" reject

Appreciate your help on this! thanks!

Re: Dr.who virus in my YARN? how to resolve it using firewalld?

paras — Wed, 03 Jun 2020 14:02:38 GMT

@Mondi

You should set yarn acls to restrict user access on YARN.

Please check if dr.who is part of yarn admin acl configurations in YARN. Remove the user in this case and set dedicated user and groups for yarn access

Refer https://docs.cloudera.com/documentation/enterprise/latest/topics/cm_mc_yarn_acl.html#concept_manage_yarn_ACLs

Also refer

https://community.cloudera.com/t5/Support-Questions/What-is-Dr-who-user-100s-of-yarn-jobs-are-getting-triggered/td-p/68026

Hope this helps,

Paras

Was your question answered? Make sure to mark the answer as the accepted solution.
If you find a reply useful, say thanks by clicking on the thumbs up button.

Re: Dr.who virus in my YARN? how to resolve it using firewalld?

Bender — Wed, 03 Jun 2020 14:32:03 GMT

Hello @Mondi ,

thank you for sharing with us your concerns. I believe you were referring to the thread under [1].

dr.who is a username used for all unauthenticated users who submit job to YARN. You can be subject to malware attacks when your cluster is not secured and connected to the Internet. Please see [2] on this topic and how to remedy.

Please always secure your cluster [3]. Make sure you enable authentication for web consoles [4] (securing your UIs). Once enabled, secured web UI will require SPNEGO to be configured on the browser you are accessing it e.g. the YARN Web UI.

Please let us know if you need more information on this topic.

Thank you:
Ferenc

[1] https://community.cloudera.com/t5/Support-Questions/HDP-2-6-1-Virus-CrytalMiner-dr-who/m-p/197497/highlight/true#M159548

[2] https://blog.cloudera.com/protecting-hadoop-clusters-from-malware-attacks/

[3] https://docs.cloudera.com/documentation/enterprise/6/6.3/topics/security.html

[4] https://docs.cloudera.com/documentation/enterprise/6/6.3/topics/cm_sg_web_auth.html

Re: Dr.who virus in my YARN? how to resolve it using firewalld?

Mondi — Thu, 04 Jun 2020 05:44:36 GMT

Hi @paras do you think this is now somehow sufficient? only the know users are indicated on the Admin ACL, can dr.who no longer ran a job in my yarn? :

Re: Dr.who virus in my YARN? how to resolve it using firewalld?

paras — Fri, 05 Jun 2020 13:58:53 GMT

@Mondi

You would still need to secure your cluster since any user can be impersonated in a non kerberised cluster.

Refer https://blog.cloudera.com/how-to-secure-internet-exposed-apache-hadoop/

for more details on securing your cluster.