question Re: Does Ranger authenticate HDFS users in Support Questions

Does Ranger authenticate HDFS users

arun9a — Tue, 05 Jan 2016 08:02:05 GMT

Ok. I am very confused with this Ranger product. There is no proper documentation on this aspect.

Dose Ranger authenticate a user before accessing HDFS content?

Is it just for authorization purpose only?

I got some consultant say, if you just use Ranger for Hdfs, you can fake as someone else and connect to the HDFS.

For example, you have a user called phil and john. They have /tenent/users/phil and /users/john respectively. Both directories has directory level permission to only that particular user and for group owner hdfs.

Is it possible for Phil to create a unix account as john on a linux box. Sudo as john on that machine and access hdfs as john. There by faking himself as john.

Appreciate any insights on this

Re: Does Ranger authenticate HDFS users

amcbarnett — Mon, 19 Aug 2019 12:20:52 GMT

Ranger is just for authorization.

For central authentication, you can authenticate against an LDAP or AD. For local authentication, you can authenticate as a local unix user.

For true secure authentication, you need Kerberos with either a MIT KDC or AD as your KDC.

Yes it is possible without Kerberos to spoof a user.

See also this HCC post Kerberos, AD, Ranger

Re: Does Ranger authenticate HDFS users

sneethiraj — Tue, 05 Jan 2016 08:07:04 GMT

Ranger provides authorization and audit functionalities. You should use KERBEROS authentication to secure the Hadoop clusters along with Ranger. If you use SIMPLE authentication, the users can impersonate as other users by setting appropriate ENV variable before invoking hdfs commands.