Disable Cloudera Management Debug WebUIs (Host Monitor, Service Monitor, Activity Monitor)

benhadoop — Thu, 15 Aug 2019 19:48:10 GMT

Hi community,

looking at security, I am in process of disabling any interfaces without proper authentication / authorization (or even encryption). I came across the debug web UIs of Cloudera Management services.

According to https://www.cloudera.com/documentation/enterprise/latest/topics/cm_ig_ports_cm.html, the debug WebUIs can be disabled by setting the port property to -1. This works for Reports Manager (8083), Event Server (8084), Navigator Audit Server (8089), Telemetry Publisher (10111).

This does not work, however, for Service Monitor (8086 / 9086 TLS), Activity Monitor (8087 / 9087 TLS), Host Monitor (8091 / 9091 TLS). Setting port to -1 leads to non-starting services without a proper ERROR in the log file.

Cloudera Manager agent even tries to check, if the server successfully bound to port -1 and runs into errors:

[15/Aug/2019 12:06:03 +0000] 65646 Thread-14 process ERROR [918-cloudera-mgmt-HOSTMONITOR] Failed port check: Command '['ss', '-np', 'state', 'listening', '(', 'sport', '=', '-1', 'or', 'sport', '=', '9995', 'or', 'sport', '=', '9994', ')']' returned non-zero exit status 255

How do you disable the debug web UIs for those management services. Or is there a way to properly secure them by authentication and authorization?

Thanks and best regards

Benjamin

Re: Disable Cloudera Management Debug WebUIs (Host Monitor, Service Monitor, Activity Monitor)

araujo — Thu, 15 Aug 2019 16:22:04 GMT

It works for me on a CM 6.3.

Which version are you using?

Re: Disable Cloudera Management Debug WebUIs (Host Monitor, Service Monitor, Activity Monitor)

benhadoop — Fri, 16 Aug 2019 05:01:41 GMT

I am using CDH/CM 6.2. Will update the cluster and test again. However, according to the docs, it should already work since 5.14.

Re: Disable Cloudera Management Debug WebUIs (Host Monitor, Service Monitor, Activity Monitor)

michalis — Sat, 17 Aug 2019 23:05:03 GMT

This was reported as a bug, and has already been fixed in CM 6.3.0, 6.2.1 as part of OPSAPS-49111

question Re: Disable Cloudera Management Debug WebUIs (Host Monitor, Service Monitor, Activity Monitor) in Support Questions

Disable Cloudera Management Debug WebUIs (Host Monitor, Service Monitor, Activity Monitor)

Re: Disable Cloudera Management Debug WebUIs (Host Monitor, Service Monitor, Activity Monitor)

Re: Disable Cloudera Management Debug WebUIs (Host Monitor, Service Monitor, Activity Monitor)

Re: Disable Cloudera Management Debug WebUIs (Host Monitor, Service Monitor, Activity Monitor)