Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

Superuser privilege for new HDFS Admin doesn't work

avatar
Expert Contributor

Followed instructions here http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.5.0/bk_security/content/hdfs-encr-appendix.html to create a new hdfs admin for the purpose of making TDE zones creation work.

[opt1@tsys1 ~]$ groups
domain_users operator[opt1@tsys1 ~]$ hdfs dfsadmin -reportat org.apache.hadoop.util.ToolRunner.run(ToolRunner.java:90)
at org.apache.hadoop.hdfs.tools.DFSAdmin.main(DFSAdmin.java:2107)
report: Access denied for user opt1. Superuser privilege is required

Property values in Ambari shown below:

dfs.permissions.superusergroup=hdfs,operator

dfs.cluster.administrators=hdfs,opt1

hadoop.kms.blacklist.DECRYPT_EEK=opt1

1 ACCEPTED SOLUTION

avatar

The change I am suggesting is dfs.permissions.superusergroup=operator

View solution in original post

5 REPLIES 5

avatar

I believe dfs.permissions.superusergroup can only contain a single value. If you change dfs.permissions.superusergroup to just 'operator' is the behavior as expected?

User hdfs will have still normal superuser access with this configuration change, since it starts the NameNode process.

avatar
Expert Contributor

tried removing hdfs and just left opt1 in the administrator property but still getting the same issue.

avatar

The change I am suggesting is dfs.permissions.superusergroup=operator

avatar
Expert Contributor

removed hdfs in the superusergroup as well and just left operator, and it worked.

avatar
Expert Contributor

This information (as many others) is wrong in the official HDP Security course from Hortonworks. In the HDFS Encryption presentations of the course it states that to create an HDFS admin user to manage EZ is enough with setting the following

(copy/paste here):

dfs.cluster.administrators=hdfs,encrypter
hadoop.kms.blacklist.DECRYPT_EEK=hdfs,encrypter