Master node has been compromised, is there way to keep the data?

[#1]

Hello,

So, this morning my master node got compromised by alot of hackers. They continued the brute-force attack causing the main server to block the access. I have four node cdh cluster (freeware), the concern now here is that my network administrator wants to re-install the host. I dont see any way to keep the stored data in HDFS as its not paid subscription. Can anyone help how could i save my data?

Thanks

[#2]

We are sorry to hear your cluster was compromised. Please see this recent security blog by Cloudera on malware attacks on un-secure Hadoop clusters [1]. Regardless of if you have a paid subscription, a distcp job can still be performed to another Hadoop cluster [2]. Please keep in mind that if the malware that has compromised your cluster has not yet been eradicated, and your target cluster is not secured with kerberos security as the blog mentions, there is a possibility your compromised cluster could be a source of attack to your target distcp cluster. As a last resort, you could possibly use hdfs dfs -copyToLocal for data that could fit into a local disk, then copy critical data elsewhere, in batches, prior to the remediation of the master node.

[1] https://blog.cloudera.com/blog/2018/11/protecting-hadoop-clusters-from-malware-attacks/

[2] https://www.cloudera.com/documentation/enterprise/latest/topics/cdh_admin_distcp_data_cluster_migrat...

[3] https://archive.cloudera.com/cdh5/cdh/5/hadoop/hadoop-project-dist/hadoop-common/FileSystemShell.htm...