Quickly secure the access to the cluster via http

[#1]

Stack : Installed HDP-2.3.2.0-2950 using Ambari 2.1

The cluster is having 1NN + 8 DN = 9 nodes.

Some business sensitive data has been loaded onto HDFS via Sqoop.

While access to the Ambari URL at http://NN:8080 is acceptable, the access to the http://NN:50070/ and further utilities like 'Browsing the file system' should be restricted to only 2-3 selected users. Right now, anyone can browse the hdfs contents via the browser.

How to do it, preferably via Ambari ?

Note : The access to different components(Hive, HDFS) etc. role wise is a later part, right now, just hiding the data is the concern

[#2 · Accepted solution]

Hi @Kaliyug Antagonist.

I would suggest implementing Knox, with a restricted set of users allowing access to only the set of services you want to expose to those users.

Both http://hortonworks.com/apache/knox-gateway/ and

http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.4.2/bk_Security_Guide/content/perimeter_security...

... should get you started.

Hope that helps.

[#3]

Alternatively use kerberos and kerberize the HDFS UI. In this case only SPNEGO enabled browsers will be able to access the ui and you will have the same filesystem access restrictions as users have when directly accessing hdfs.