question Re: Quickly secure the access to the cluster via http in Archives of Support Questions (Read Only)

Quickly secure the access to the cluster via http

kaliyugantagoni — Fri, 16 Sep 2022 10:21:30 GMT

Stack : Installed HDP-2.3.2.0-2950 using Ambari 2.1

The cluster is having 1NN + 8 DN = 9 nodes.

Some business sensitive data has been loaded onto HDFS via Sqoop.

While access to the Ambari URL at http://NN:8080 is acceptable, the access to the http://NN:50070/ and further utilities like 'Browsing the file system' should be restricted to only 2-3 selected users. Right now, anyone can browse the hdfs contents via the browser.

How to do it, preferably via Ambari ?

Note : The access to different components(Hive, HDFS) etc. role wise is a later part, right now, just hiding the data is the concern

Re: Quickly secure the access to the cluster via http

drussell — Tue, 24 May 2016 18:01:46 GMT

Hi @Kaliyug Antagonist.

I would suggest implementing Knox, with a restricted set of users allowing access to only the set of services you want to expose to those users.

Both http://hortonworks.com/apache/knox-gateway/ and

http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.4.2/bk_Security_Guide/content/perimeter_security_with_apache_knox.html

... should get you started.

Hope that helps.

Re: Quickly secure the access to the cluster via http

bleonhardi — Tue, 24 May 2016 19:48:06 GMT

Alternatively use kerberos and kerberize the HDFS UI. In this case only SPNEGO enabled browsers will be able to access the ui and you will have the same filesystem access restrictions as users have when directly accessing hdfs.