question Re: What are the best practises for Unix user mapping ? in Archives of Support Questions (Read Only)

What are the best practises for Unix user mapping ?

tristan1 — Tue, 20 Sep 2016 13:58:41 GMT

Hello,

We have a working HDP 2.4 Kerberos enabled working, with Hue and from command line too.

Following to the documentation, we have created Unix user mappings between the nodes and Active Directory. Users can login to a utility machine and kinit to login.

https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.4.2/bk_Security_Guide/content/create_mappings_betw_principals_and_unix_usernames.html

It's working just fine.

My question is about the management of those users: everytime we want to grand access to a new user, we need to go ahead and create those users on all nodes, which is not very practical.

What are the best practises for that?

script user accounts creation?
Enrol all node machines as domain machines so that AD users can login?
Configure the unix machine to accept login using LDAP against AD?
Others?

Thanks a lot in advance for ideals and experiences.

Tristan

Re: What are the best practises for Unix user mapping ?

hkropp — Tue, 20 Sep 2016 16:11:45 GMT

A list of recommended tools are:

SSSD https://fedorahosted.org/sssd/ / https://help.ubuntu.com/lts/serverguide/sssd-ad.html
FreeIPA (introduces additional AD and need to establish Trust between the two) https://www.freeipa.org/page/Main_Page
Winutils
Centrify (commercial) https://www.centrify.com/
VAS / Quest (commercial) https://software.dell.com/products/authentication-services/
....

Please check the material of this workshop for reference:

https://community.hortonworks.com/articles/1143/cheatsheet-on-configuring-authentication-authoriza.html https://community.hortonworks.com/repos/4465/workshops-on-how-to-setup-security-on-hadoop-using.html

Re: What are the best practises for Unix user mapping ?

tristan1 — Tue, 20 Sep 2016 16:47:08 GMT

Thanks @hkropp. I'm looking at the suggested options.

What about plain LDAP login configuration on the nodes, could it be a simple solution too?

Re: What are the best practises for Unix user mapping ?

hkropp — Tue, 20 Sep 2016 16:49:21 GMT

Yes with pam_ldap integration: http://www.tldp.org/HOWTO/archived/LDAP-Implementation-HOWTO/pamnss.html

Re: What are the best practises for Unix user mapping ?

hkropp — Tue, 20 Sep 2016 16:52:20 GMT

Well, you would have the login, but not the kerberos init. You would still have two realms with user credentials the KRB5 realm and the LDAP realm depending on your setup.

Actually the KRB5 realm can be included inside LDAP or put differently Kerberos can be configured to use LDAP as it's user DB, that would give you the possibility to combine both. This essential is what FreeIPA is.