@Mondi    It is highly recommended to install kerberos as a prerequisite before using sentry. HiveServer2 and the Hive Metastore (HMS) running with strong authentication. For HiveServer2, strong authentication is either Kerberos or LDAP. For the Hive Metastore, only Kerberos is considered strong authentication (to override, see Securing the Hive Metastore). Below document mentions the prerequisites in detail: https://docs.cloudera.com/documentation/enterprise/latest/topics/sg_sentry_before_you_install.html#prerequisites   Hope this helps, Paras Was your question answered? Make sure to mark the answer as the accepted solution. If you find a reply useful, say thanks by clicking on the thumbs up button. ... View more

@Mondi    The property setting the retainment period can be found at: Cloudera Manager -> Cloudera Management Service -> Configuration -> and in the search field please type: "Navigator Audit Server Data Expiration Period" After reducing this retention period and restarting the Nav Audit server role, the tables/data should be purged.  If you still see old audit data remaining you can proceed with manual purging: Connect to your database. > show databases; > use <nav_audit_database>; > show tables; > drop table <audit_event_table>; You can also set audit filters for difffernt services to have a control on audit collection. https://docs.cloudera.com/documentation/enterprise/6/6.3/topics/cn_admcfg_audit_filters.html   Hope this helps, Paras Was your question answered? Make sure to mark the answer as the accepted solution. If you find a reply useful, say thanks by clicking on the thumbs up button. ... View more

Hi @Mondi ,   No, Apache Sentry is not used for data as rest or in motion encryption. To address those requirements you need to follow this guidelines and steps:   Encryption in Transit: https://docs.cloudera.com/documentation/enterprise/6/6.3/topics/cm_sg_guide_ssl_certs.html   Encryption at Rest: https://docs.cloudera.com/documentation/enterprise/6/6.3/topics/encryption_planning.html   Regards, Steve ... View more

@Mondi  just update dfs.cluster.administrators with the admin username you want in hdfs config (and restart hdfs,yarn,MR2,... services) ex: dfs.cluster.administrators = hdfs,ops   you can also use a HDFS administrators group (only one administrator group) using dfs.permissions.superusergroup ex : dfs.permissions.superusergroup = operations   to verify config has been updated, once services restarted hdfs getconf -confKey dfs.cluster.administrators or hdfs getconf -confKey dfs.permissions.superusergroup   ... View more

Hi @Mondi ,   Thanks for reaching out to Cloudera community.   The "com.mysql.cj.exceptions.InvalidConnectionAttributeException" in the log suggests that MySql JDBC driver version 8.x is being used. However, as pointed out by below doc, we recommend using only version 5.1 of the JDBC driver.  https://docs.cloudera.com/documentation/enterprise/6/latest/topics/cm_ig_mysql.html#cmig_topic_5_5_3   Please download the one from https://dev.mysql.com/downloads/connector/j/5.1.html and then install it in /usr/share/java. After that, retry the command.   Thanks and hope this helps! Li ... View more

Hi @Mondi ,   There are maintenance releases planned for 6.3 i.e. CDH 6.3.x. That means it is planned to do a CDH 6.3.4.   Regards, Steve ... View more

Hi @Mondi ,   Cloudera's lifecycle support policies are documented here:   https://www.cloudera.com/legal/policies/support-lifecycle-policy.html   Cloudera 6.3 is supported until the end of March 2022.   Regards, Steve ... View more