Running all services as same user

[#1]

Hi,

Are there any concerns about running all services (hdfs, hive, ambari, etc) as the same user? In this case, 'root'?

Thanks,

[#2]

@awatson@hortonworks.com Was cluster deployed using ambari?

[#3]

@Neeraj Yes it was

[#4]

@awatson@hortonworks.com Interesting. In Ambari console, you changed all the users to root under misc?

[#5]

I am not aware of any known issues - although I have not seen any such deployment. On the other hand, I think, Windows deployment of hadoop uses the same user for all services..

[#6]

I strongly advise against running everything as a single user. There are accounts for controlling the infrastructure and for data access. Mashing them together only exposes the attack vector and basically throws security out the window.

If the drive was ti 'simplify' deployment and side-stepping corporate policies (and process) of creating new accounts, please re-consider.

[#7]

@awatson@hortonworks.com

From Security, Management & Troubleshooting prospecting , this is big No.

[#8 · Accepted solution]

1. you shouldn't be running services as root, for obvious reasons.
2. If you are on an insecure cluster, then all YARN jobs submitted will run as the service wide user. If that is "root", then your entire cluster belongs to the first malicious person running a job.
3. If you are running on a kerberos cluster -as you should- you need separate accounts for every individual user of the cluster, so you aren't saving on any setup effort