question Re: Running all services as same user in Archives of Support Questions (Read Only)

Running all services as same user

awatson — Mon, 09 Nov 2015 10:11:18 GMT

Hi,

Are there any concerns about running all services (hdfs, hive, ambari, etc) as the same user? In this case, 'root'?

Thanks,

Re: Running all services as same user

nsabharwal — Mon, 09 Nov 2015 10:21:31 GMT

@awatson@hortonworks.com Was cluster deployed using ambari?

Re: Running all services as same user

awatson — Mon, 09 Nov 2015 10:29:46 GMT

@Neeraj Yes it was

Re: Running all services as same user

smohanty — Mon, 09 Nov 2015 10:49:30 GMT

I am not aware of any known issues - although I have not seen any such deployment. On the other hand, I think, Windows deployment of hadoop uses the same user for all services..

Re: Running all services as same user

andrewg — Mon, 09 Nov 2015 20:59:19 GMT

I strongly advise against running everything as a single user. There are accounts for controlling the infrastructure and for data access. Mashing them together only exposes the attack vector and basically throws security out the window.

If the drive was ti 'simplify' deployment and side-stepping corporate policies (and process) of creating new accounts, please re-consider.

Re: Running all services as same user

nsabharwal — Mon, 09 Nov 2015 21:21:26 GMT

@awatson@hortonworks.com

From Security, Management & Troubleshooting prospecting , this is big No.

Re: Running all services as same user

nsabharwal — Mon, 09 Nov 2015 21:22:12 GMT

@awatson@hortonworks.com Interesting. In Ambari console, you changed all the users to root under misc?

Re: Running all services as same user

stevel — Tue, 10 Nov 2015 00:02:20 GMT

you shouldn't be running services as root, for obvious reasons.
If you are on an insecure cluster, then all YARN jobs submitted will run as the service wide user. If that is "root", then your entire cluster belongs to the first malicious person running a job.
If you are running on a kerberos cluster -as you should- you need separate accounts for every individual user of the cluster, so you aren't saving on any setup effort