Secure Webhdfs in Hadoop Hortonworks Cluster

[#1]

Dear community

I have installed a hadoop cluster on 8 servers using Ambari Hortonworks.

I am able to access webhdfs using the ip address and the default port 50070 without authentication.

How can I secure Webhdfs?

P.S I did not enable using kerberos in Ambari > Enable kerberos , should I do it?

Any suggestion will be appreciated

Thanks

Asma

[#2]

1. Set the value of the dfs.webhdfs.enabled property in hdfs-site.xml to true.

   <property>
     <name>dfs.webhdfs.enabled</name>
     <value>true</value> 
   </property>

2. Create an HTTP service user principal.

   kadmin: addprinc -randkey HTTP/$<Fully_Qualified_Domain_Name>@$<Realm_Name>.COM

   where:

   • Fully_Qualified_Domain_Name: Host where the NameNode is deployed.
   • Realm_Name: Name of your Kerberos realm.
3. Create a keytab file for the HTTP principal.

   kadmin: xst -norandkey -k /etc/security/spnego.service.keytab HTTP/$<Fully_Qualified_Domain_Name>

4. Verify that the keytab file and the principal are associated with the correct service.

   klist –k -t /etc/security/spnego.service.keytab

5. Add the dfs.web.authentication.kerberos.principal and dfs.web.authentication.kerberos.keytab properties to hdfs-site.xml.

   <property>
     <name>dfs.web.authentication.kerberos.principal</name>
     <value>HTTP/$<Fully_Qualified_Domain_Name>@$<Realm_Name>.COM</value>
   </property>
   <property>
     <name>dfs.web.authentication.kerberos.keytab</name>
     <value>/etc/security/spnego.service.keytab</value>
   </property>

6. Restart the NameNode and the DataNodes.