question Re: Disabling Kerberos in Support Questions

Disabling Kerberos

Alessio — Fri, 16 Sep 2022 09:09:03 GMT

Hi all,

We have a Kerberized cluster,but at the moment we would disable it.

How is it possible ?

I performed the following steps:

Zookeeper -> enableSecurity (Enable Kerberos Authentication)-> false

HDFS -> hadoop.security.authentication -> Simple
HDFS -> hadoop.security.authorization -> false
HDFS -> dfs.datanode.address -> from 1004 (for Kerberos) to 50010 (default)
HDFS -> dfs.datanode.http.address -> from 1006 (for Kerberos) to 50075 (default)
HDFS -> Data Directory Permissions -> from 700 to 755

HBASE -> hbase.security.authentication -> Simple
HBASE -> hbase.security.authorization -> false

But when I start the cluster I have problems on Hue and Solr

Hue: It seems that Kerberos is still configured for Hue

-> The Kerberos Ticket Renewer is not running. How can i disable it?

-> Impala e Oozie don't run from Hue

Solr:

Caused by: java.io.IOException: Failed on local exception: java.io.IOException: Server asks us to fall back to SIMPLE auth, but this client is configured to only allow secure connections.;

I noticed that Hue and Solr run in secure mode. How can I disable them ?

Thanks

Alessio

Re: Disabling Kerberos

iamfromsky — Fri, 03 Oct 2014 20:32:42 GMT

Just like other services. Pls look carefully ,you will find the botton. I have done this many times.

Re: Disabling Kerberos

iamfromsky — Fri, 03 Oct 2014 20:33:36 GMT

Don't forget redeploy client. It's important

Re: Disabling Kerberos

Alessio — Thu, 09 Oct 2014 08:46:16 GMT

Hi,

I didn't find the button on CDH 5.1.2 but i removed the Kerberos Ticket Renewer and redeployed client.

I missed this for Solr

SOLR -> Solr Secure Authentication -> Simple

Thanks

Re: Disabling Kerberos

Grizzly — Thu, 09 Oct 2014 17:54:06 GMT

You would work your way back through the security guide discussion on enabling kerberos:

http://www.cloudera.com/content/cloudera/en/documentation/cloudera-manager/v5-latest/Configuring-Hadoop-Security-with-Cloudera-Manager/cm5chs_enable_security_s8.html

Note that if HBASE, or NN HA or JT HA was configured after enabling security, the cleanup can be difficult, the Znode paths within zookeeper might require manual removal of the ACL statements.

Todd

Re: Disabling Kerberos

Alessio — Fri, 10 Oct 2014 08:58:14 GMT

Thanks,

I followed the instructions in reverse order, present on the link.

When I disabled Kerberos, I had the two Namenodes (HA) both in stand-by state and I removed manually entries in Zookeeper.

Now it works!!!

Thanks

Alessio

Re: Disabling Kerberos

Alessio — Mon, 20 Oct 2014 09:23:47 GMT

Hi,

I have another question about this.

when you said :

Note that if HBASE, or NN HA or JT HA was configured after enabling security, the cleanup can be difficult, the Znode paths within zookeeper might require manual removal of the ACL statements.

The same problem can be present for Yarn (HA).

I tried to find the 'yarn.resourcemanager.zk-auth' in the yarn-site.xml (/var/run/cloudera-scm-agent/process) in order to auth with Zookeper and remove the ACL statement but is not present this parameter.

I searched it into all folders XXX-yarn-RESOURCEMANAGER (also in the most recent) but I cannot find it

How can i solve this? At the moment I have Yarn not in HA and when I try to enable the HA, both ResourceManagers stay in Stand-by

Thanks

Alessio

Re: Disabling Kerberos

Alessio — Mon, 23 Feb 2015 16:04:16 GMT

Solved !!!

Thanks

Alessio

Re: Disabling Kerberos

Bobby Perry — Wed, 18 Mar 2015 14:47:48 GMT

How so? i have the same problem! Both my Yarn HA services went into standby.

Re: Disabling Kerberos

Bobby Perry — Wed, 18 Mar 2015 15:48:32 GMT

Looking for how you removed it from zk..

Re: Disabling Kerberos

dmurthy — Wed, 15 Apr 2015 21:46:25 GMT

Hello Alessio,

I am facing the same problem could you please outline the steps you did for Yarn and Zookeeper.

Thanks

Deepak

Re: Disabling Kerberos

dna_29a — Wed, 16 Sep 2015 16:12:34 GMT

Have the same problem, but after clean and reinstall cluster (using parcels). Error appears when oozie java action wrties to HDFS (runs from HUE). Earlier on this cluster was Kerberos, and I cleand all (I hope) directories from previous installation.

Here is a detailed message:

Failing Oozie Launcher, Main class [org.apache.oozie.action.hadoop.JavaMain], main() threw exception, java.io.IOException:
Failed on local exception: java.io.IOException: Server asks us to fall back to SIMPLE auth, but this client is configured to only allow secure connections.; 
Host Details : local host is: "hadoop-05.xxx.xx/172.19.x.xxx"; destination host is: "hadoop-02.xxx.xx":8020; 
org.apache.oozie.action.hadoop.JavaMainException: java.io.IOException: Failed on local exception: java.io.IOException:
Server asks us to fall back to SIMPLE auth, but this client is configured to only allow secure connections.;
Host Details : local host is: "hadoop-05.xxx.xx/172.19.x.xxx"; destination host is: "hadoop-02.xxx.xx":8020;

Re: Disabling Kerberos

Tomas79 — Thu, 11 Feb 2016 21:55:01 GMT

I have a similar problem wanted to turn off Kerberos, so did everythin (turn auth to simple, data node ports etc etc).
Now the cluster does not use Kerberos, HDFS and Hive and Impala works fine, BUT THE OPTION FOR ENABLE KERBEROS IS STILL GREYED
Any thoughts?
T

Re: Disabling Kerberos

slmingol — Tue, 16 Feb 2016 22:41:52 GMT

The link provided is now broken. Is there an update to it?

Re: Disabling Kerberos

slmingol — Tue, 16 Feb 2016 22:45:05 GMT

Re: Disabling Kerberos

cjervis — Wed, 17 Feb 2016 12:18:44 GMT

Try this one:

http://www.cloudera.com/documentation/manager/5-1-x/Configuring-Hadoop-Security-with-Cloudera-Manager/cm5chs_enable_security_s8.html