question Re: restrict WebHDFS to be reachable only from certain hosts in Archives of Support Questions (Read Only)

restrict WebHDFS to be reachable only from certain hosts

theyaa — Fri, 03 Nov 2017 23:55:02 GMT

Is there a way to limit access to WebHDFS to only users coming from certain hosts? Something similar to hadoop.proxyuser

Re: restrict WebHDFS to be reachable only from certain hosts

jsensharma — Sat, 04 Nov 2017 00:03:32 GMT

@Theyaa Matti

You can take a look at the HDFS proxyuser hosts setting as, means the user with name as <USERNAME> will be able to access the test1.example.com,test2.example.com,test3.example.com hosts only.

hadoop.proxyuser.<USERNAME>.hosts=test1.example.com,test2.example.com,test3.example.com

https://hadoop.apache.org/docs/r2.7.1/hadoop-project-dist/hadoop-common/Superusers.html

Re: restrict WebHDFS to be reachable only from certain hosts

jpetro416 — Sat, 04 Nov 2017 00:07:22 GMT

You achieve this by limiting access via firewall rules, other than that KNOX + Kerberos is the built in method.

Some resources:

Secure Authentication: The core Hadoop uses Kerberos and Hadoop delegation tokens for security. WebHDFS also uses Kerberos (SPNEGO) and Hadoop delegation tokens for authentication.

https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.6.2/bk_security/content/configure_webhdfs_for_knox.html

https://www.cloudera.com/documentation/enterprise/5-9-x/topics/cdh_sg_secure_webhdfs_config.html