Enable 2 way SSL between Ambari-Server and Ambari-agents in Ambari 2.5

[#1]

Configure SSL for Ambari Server

# On ambari-server host, take a back up of existing files

mkdir /root/ambari-ssl-backup; cp -r /var/lib/ambari-server/keys/* /root/ambari-ssl-backup/

# Navigate to the folder where all certificates are stored.

cd <dir>

# Extract certificates from p7b file

openssl pkcs7 –in ambari-server-host-cert.p7b –print_certs > ambari-server-host-name.crt

# Above .crt file contains full certificate chain, so separate server certificate from root chain.

Copy the intermediate/root chain to ca.crt and delete intermediate/root chain from ambari-server-host-name.crt

# Copy ca.crt, ambari-server-host-name.crt, ambari-server-host-privateKey.key files to /var/lib/ambari-server/keys/

cp ca.crt /var/lib/ambari-server/keys/

cp ambari-server-host-privateKey.key /var/lib/ambari-server/keys/

cp ambari-server-host-name.crt /var/lib/ambari-server/keys/

# Update password for the keystore in a file (Assuming it as ‘changeit’)

echo "changeit" > pass.txt

# Generate the keystore for ambari-server. Ambari uses pkcs12 keystore. Use the above password when prompted.

openssl pkcs12 –export –out keystore.p12 –inkey ambari-server-host-privateKey.key –in ambari-server-host-name.crt –certfile ca.crt

# verify the keystore

/usr/jdk64/jdk1.8.0_77/bin/keytool –list –v –keystore keystore.p12 –storetype pkcs12 –storepass changeit

# Create a truststore with Root/Intermediate/Ambari/and all agent certificates.

/usr/jdk64/jdk1.8.0_77/bin/keytool -import -file ca.crt -keystore truststore.jks -storepass changeit -alias rootCA

/usr/jdk64/jdk1.8.0_77/bin/keytool -import -file ambari-server-host-name.crt -keystore truststore.jks -storepass changeit -alias ambari-server

/usr/jdk64/jdk1.8.0_77/bin/keytool -import -file ambari-agent-host2.crt -keystore truststore.jks -storepass changeit -alias ambari-agent-host2

...

# Enable HTTPS for ambari-server

ambari-server setup-security

Using python /usr/bin/python

Security setup options...

===========================================================================

Choose one of the following options:

[1] Enable HTTPS for Ambari server.

[2] Encrypt passwords stored in ambari.properties file.

[3] Setup Ambari kerberos JAAS configuration.

[4] Setup truststore.

[5] Import certificate to truststore.

===========================================================================

Enter choice, (1-5): 1

Do you want to configure HTTPS [y/n] (y)? y

SSL port [8443] ? y

Enter path to Certificate: /var/lib/ambari-server/keys/hsynlhdps100.crt

Enter path to Private Key: /var/lib/ambari-server/keys/hsynlhdps100.key

Please enter password for Private Key: <hit enter if none>

Generating random password for HTTPS keystore...done.

Importing and saving Certificate...done.

Ambari server URL changed. To make use of the Tez View in Ambari please update the property tez.tez-ui.history-url.base in tez-site

# Configure truststore for ambari-server (This truststore would also contain certificates for AD server(s) in case of LDAPS between ambari-server and AD)

ambari-server setup-security

Using python /usr/bin/python

Security setup options...

===========================================================================

Choose one of the following options:

[1] Enable HTTPS for Ambari server.

[2] Encrypt passwords stored in ambari.properties file.

[3] Setup Ambari kerberos JAAS configuration.

[4] Setup truststore.

[5] Import certificate to truststore.

===========================================================================

Enter choice, (1-5): 4

Do you want to configure a truststore [y/n] (y)? y

TrustStore type [jks/jceks/pkcs12] (jks): jks

Path to TrustStore file :/var/lib/ambari-server/keys/truststore.jks

Password for TrustStore:

Re-enter password:

Ambari Server 'setup-security' completed successfully.

# Edit /etc/ambari-server/conf/ambari.properties, add below properties

security.server.two_way_ssl=true

security.server.cert_name=ambari-server-host-name.crt

security.server.key_name=ambari-server-host-privateKey.key

security.server.keystore_name=keystore.p12

security.server.keystore_type=PKCS12

security.server.truststore_name=truststore.jks

security.server.truststore_type=JKS

security.server.crt_pass_file=pass.txt

# Restart Ambari Server

ambari-server restart

# Since the certificates were already created, Ambari Server should not be creating any certificates

# Verify by inspecting logs in /var/log/ambari-server/ambari-server.log

xxxxxxxxxxxxxxxxxxx INFO [main] CertificateManager:68 - Initialization of root certificate

xxxxxxxxxxxxxxxxxxx INFO [main] CertificateManager:70 - Certificate exists:true

Configure SSL for Ambari Agent

### Repeat steps for every host in the cluster, including ambari-server host

# Extract Agent certificate from p7b file

openssl pkcs7 -in ambari-agent-cert.p7b –print_certs > `hostname –f`.crt

# Copy Agent certificate and key

cp `hostname –f`.crt /var/lib/ambari-agent/keys/

cp ambari-agent-privateKey.key /var/lib/ambari-agent/keys/`hostname –f`.key

# Copy CA certificate (Note: We need to copy this manually, otherwise the agent will copy over the server certificate instead of CA certificate)

cp ca.crt /var/lib/ambari-agent/keys/

# Restart Ambari Agent

ambari-agent restart

# Verify by inspecting logs in /var/log/ambari-agent/ambari-agent.log

INFO XXXXXXXXXXXXXXXXXXXXXXX security.py:49 - Server require two-way SSL authentication. Use it instead of one-way...

INFO XXXXXXXXXXXXXXXXXXXXXXX security.py:175 - Server certicate exists, ok

INFO XXXXXXXXXXXXXXXXXXXXXXX security.py:183 - Agent key exists, ok

INFO XXXXXXXXXXXXXXXXXXXXXXX security.py:191 - Agent certificate exists, ok

INFO XXXXXXXXXXXXXXXXXXXXXXX security.py:93 - SSL Connect being called.. connecting to the server

INFO XXXXXXXXXXXXXXXXXXXXXXX security.py:77 - SSL connection established. Two-way SSL authentication completed successfully.

INFO XXXXXXXXXXXXXXXXXXXXXXX Controller.py:149 - Registration Successful (response id = 0)

INFO XXXXXXXXXXXXXXXXXXXXXXX Controller.py:153 - Got status commands on registration.