Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

Should we disable HDFS default ACL to enable Ranger HDFS plugin?

Highlighted

Should we disable HDFS default ACL to enable Ranger HDFS plugin?

Contributor

In Sandbox HDP 2.3.2 / Ambar 2.1.2, Ranger is enabled in HDFS out of the box. When I tried to get ACL on CLI, I got the error as follows:

[hdfs@sandbox ~]$ hdfs dfs -getfacl /user/hdfs # file: /user/hdfs # owner: hdfs # group: hdfs getfacl: The ACL operation has been rejected. Support for ACLs has been disabled by setting dfs.namenode.acls.enabled to false.

Is it recommended to disable default ACL? If it is enabled, will we see ACL set command generating Ranger policies?

4 REPLIES 4
Highlighted

Re: Should we disable HDFS default ACL to enable Ranger HDFS plugin?

In a real cluster dfs.namenode.acls.enabled is set to true.

The sandbox is configured for a wide audience to run into the least amount of problems doing the tutorials.

And no, the acl command does not generate Ranger policies.

You set the policies in Ranger and it will manage the ACLs for HDFS as the

dfs.namenode.inode.attributes.provider.class is set to

org.apache.ranger.authorization.hadoop.RangerHdfsAuthorizer

See Slides 18 and 19 in

http://www.slideshare.net/Hadoop_Summit/securing-hadoop-with-apache-ranger

If there are no Ranger policies, it falls back to HDFS ACL

Re: Should we disable HDFS default ACL to enable Ranger HDFS plugin?

but if we set the dfs.namenode.acls.enabled = true and xasecure.add-hadoop-authorization" = true then only hadoop acl will take precedence and ranger policies will be over ridden. @ Ancil McBarnett

Highlighted

Re: Should we disable HDFS default ACL to enable Ranger HDFS plugin?

Expert Contributor

Also setting "xasecure.add-hadoop-authorization" = false in ranger-hdfs-security.xml in /etc/hadoop/conf will stop the fall back to HDFS ACL.

Highlighted

Re: Should we disable HDFS default ACL to enable Ranger HDFS plugin?

Contributor

I think there are some global policies created whenever we enable any Ranger plugin in Sandbox. This global policy by default blocks access to all. So for other policies to work or for it to fallback on the other authorization method, we need to disable this global policy.

Example : Like in this case, need to review if under HDFS Repo in Ranger, any global policy exists? If yes, need to disable it. In this case it will not fallback to HDFS ACLs if this global policy exists.

Don't have an account?
Coming from Hortonworks? Activate your account here