Is there a reference document for ambari.properties

[#1]

Hello Everyone,

Is there a reference document for exhaustive list of properties that can be set within ambari.properties?

I would like to check whether Ambari has an option for disabling HTTP OPTIONS method.

Thanks,

Megh

[#2]

Hello Megh,

Yes, You can surely do it using the command  #ambari-server setup-security. This will make changes in the ambari.properties

You can refer to the below doc for complete steps by steps setup to disable HTTP and enable HTTPS.

https://docs.cloudera.com/HDPDocuments/Ambari-2.2.0.0/bk_Ambari_Security_Guide/content/_optional_set...

[#3]

Hi @Atahar ,

Thanks for your reply. I'm actually looking for a property to disable HTTP options method as this is being flagged as a vulnerability by my internal Security team.

Thanks,

Megh

[#4]

Hello @vidanimegh  , 

Do you have any CVE number for the vulnerability you are facing by the internal team?

Do you want to disable HTTP? That logically means you want to enable HTTPS.

Correct me if my understanding is wrong.

[#5]

Hello @Atahar ,

The Vulnerability ID is "http-options-method-enabled".

I Don't want to disable HTTP and enable HTTPS, I want to disable "HTTP Options Method".

Thanks,

Megh

[#6]

@vidanimegh I have done some research and there does not appear to be a way to disable the HTTP Options method from the Ambari Web UI. An RMP has been raised for this feature (RMP-10941) but it is not currently available. In terms of security, these options are made available because Ambari can be administered via curl API calls but each call is authenticated.

In terms of other ways to secure the WebUI, SSL can be enabled to ensure any response is encoded and Kerberos can be enabled to further secure the cluster.