question Re: How to protect Storm nimbus without Kerberos in Archives of Support Questions (Read Only)

How to protect Storm nimbus without Kerberos

wbu — Tue, 18 Oct 2016 20:32:07 GMT

Hi,

What's the simplest solution to protect Storm Nimbus from random submit topologies?

I know kerberos can protect that, but my customer doesn't want to setup Kerberos and just want to protect Nimbus thrift port with either user/pass or ssl cert. I did think to use proxy, like Nginx. But there's no option in the storm cli to input user/pass. And can't find doc about Nimbus SSL.

Does anyone have this kind of experience?

Thanks in advance.

Wendell

Re: How to protect Storm nimbus without Kerberos

aervits — Wed, 19 Oct 2016 08:55:31 GMT

Apache Ranger can provide an authorization model for your Storm topologies, http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.4.3/bk_Security_Guide/content/storm_policy.html

And here https://cwiki.apache.org/confluence/display/RANGER/Apache+Ranger+0.5+-+User+Guide#ApacheRanger0.5-UserGuide-AddingSTORMPolicies

Re: How to protect Storm nimbus without Kerberos

aervits — Wed, 26 Oct 2016 15:01:05 GMT

@wbu securing access to the Nimbus UI is only with Kerberos and SPNEGO AUTH https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.4.3/bk_secure-storm-ambari/content/ch_secure-storm-ui.html so unless you just want to protect from submitting topologies with Apache Ranger, you have to enable Kerberos

Re: How to protect Storm nimbus without Kerberos

wbu — Wed, 26 Oct 2016 21:47:34 GMT

Hi Artern,

Thanks for the confirm.

My current problem is the customer doesn't want to setup Kerberos, and it's a single tenant cluster. Our solution is to use SASL/DIGEST with Nimbus thrift server. Both server and client JAAS configure a admin user/pass. If they match, then allow the connection.

But need to fix a bug in Storm DigestSaslTransportPlugin.java

So very simple.

Regards,

Wendell

Re: How to protect Storm nimbus without Kerberos

wbu — Sat, 29 Oct 2016 22:08:36 GMT

DigestSaslTransportPlugin.java has another bug. Have to use PlainSaslTransportPlugin.java