About mjarnold

mjarnold · ‎01-23-2023

I am interested in this as well.

mjarnold · ‎12-06-2019

The following always worked for me: kinit -kt hdfs.keytab hdfs hadoop fs -mkdir /benchmarks hadoop fs -chmod 0777 /benchmarks You can always lock down the directory permissions to only allow a certain group to write to this directory.

mjarnold · ‎05-10-2019

That particular package only comes from the MySQL Community repository. Not from the OS repos or from the SCL repos.

mjarnold · ‎04-11-2019

Thanks, Li!

mjarnold · ‎04-08-2019

The Cloudera Enterprise 6.x Release Notes Database Requirements states that: Hue requires the default MySQL/MariaDB version (if used) of the operating system on which it is installed. For more information, see Hue Databases. On RHEL6, this means that Hue requires MySQL version 5.1. But the rest of C6 requires the use of MySQL version 5.7. Does this mean that for RHEL/CentOS 6, two different MySQL database installations will be required? One for Hue and another for CM/ReportsManager/NavAudit/NavMeta/Hive/Oozie?

mjarnold · ‎02-28-2019

For posterity, I will helpfully refer to the Cloudera documentation on the topic. (Good work docs folks. I love the evironment customization.)

mjarnold · ‎06-19-2018

Has this situation improved over the past year? Is there any public information on how to secure the back-end database connections?

mjarnold · ‎05-01-2018

So I have had the chance to work with Navigator Encrypt once again and I inevitably come to the part where I have to create encrypted filesystems (navencrypt-prepare) on a brand new host. This is simple enough - no issues there. What confuses me is the need for using navencrypt-move. I just don't get why I would need to run this command on a newly built host with no existing data. It seems redundant. Granted, I also don't tend to use the navencypt ACLs. That would be one reason why I could see to use navencrypt-move. Can anyone explain the purpose of navencrypt-move on a fresh machine?

mjarnold · ‎04-16-2018

Assuming that you are referencing Cloudera Navigator Encrypt, as part of the process of encrypting a disk, you can move existing data onto that newly encrypted disk. See the navencrypt-move command. If you are referring to HDFS Transparent Encryption, then you must create a new encryption zone in HDFS (effectively a new directory) and then copy your HDFS data into it. A lot of people ask "How can I encrypt an existing directory". You would have to perform two extra steps and have plenty of available disk space: 1. Rename the existing directory in HDFS: "hdfs dfs -mv /data /data.bak" 2. Set up the encryption zone for /data. "hadoop key create <keyname>; hdfs dfs -mkdir /data; hdfs crypto -createZone -keyName <keyname> -path /data" 3. Copy the data in /data.bak to /data. "hdfs dfs -cp /data.bak/\* /data/" 4. Remove /data.bak. "hdfs dfs -rm -R /data.bak"

mjarnold · ‎04-16-2018

In Hadoop and Kafka, one normally would not use RAID or LVM for data disks. Instead each disk has a partition that consumes the entire disk and a filesystem is written to that partition. In the case of NavEnc, after partitioning, each disk is first encrypted and then has the filesystem written on top of the encrypted volume. Tying together multiple disks into one large filesystem is the opposite of what Kafka or Hadoop expect you to do and you lose out on the advantages of parallelism.

mjarnold · ‎01-24-2018

And to fully answer myself, here are the links to vendor documentation: Red Hat/CentOS https://access.redhat.com/solutions/8709 https://wiki.centos.org/FAQ/CentOS7#head-8984faf811faccca74c7bcdd74de7467f2fcd8ee https://wiki.centos.org/FAQ/CentOS6#head-d47139912868bcb9d754441ecb6a8a10d41781df Debian/Ubuntu https://wiki.debian.org/DebianIPv6#How_to_turn_off_IPv6 https://wiki.ubuntu.com/IPv6#Disabling_IPv6 Suse https://www.suse.com/support/kb/doc.php?id=7015035 https://www.suse.com/support/kb/doc/?id=7012111

mjarnold · ‎01-23-2018

Thanks. It sounds like the following should suffice: sysctl -w net.ipv6.conf.all.disable_ipv6=1 sysctl -w net.ipv6.conf.default.disable_ipv6=1

mjarnold · ‎01-22-2018

@Alex, I am curious as to what the Proactive Support tests look for when testing whether IPv6 is enabled. Is it the existence of IPv6 addresses on interfaces or the presence of the IPv6 kernel module? Red Hat's solutions indicate that you can either disable the kernel module via kernel boot options (results in other things breaking) or disable IPv6 on network interfaces via sysctl. Debian appears to be similar.

mjarnold · ‎01-19-2018

Hey @bgooley, Is there any update on DOCS-1862?

mjarnold · ‎10-10-2017

@sridharm Hue is not written in Java, thus the Oracle connector jar will not work. You want the Oracle Instant Client for Hue Parcel.

mjarnold · ‎03-17-2017

@bgooley, So to clarify my assumptions and (mis)understandings: The allowed_hosts setting is not checking the HTTP client's DNS domain. It is the Hue webserver framework (ie Django) checking the HTTP Host: header that the client sends. In my case of AWS VPC with default public subnet configuration, my web browser thinks I am talking to ec2-54-50-32-4.compute-1.amazonaws.com and sends that as the Host: header. The Hue server sees that, expecting something more like ip-10-1-2-3.ec2.internal, and replies with the "Bad Request (400)" to the client.

mjarnold · ‎03-09-2017

I would like to understand what security risk this change addresses. From what I can tell, this will adversly impact any cloud deployment that is using default cloud-provided domain names (ie AWS with default VPC configuration) and it will not affect any environment (ie on-premesis) where the clients are in the same domain as Hue. The only situation that I have been able to imagine is one where Hue is sitting on the public Internet at hue.domain with a very loose firewall (if any) but we want only clients (laptop.domain) to be served. Can the Hue Team elaborate on how allowed_hosts=".domain" can possibly help my customers and why every AWS install I do with 5.10 will require me to revert to allowed_hosts="*"?

mjarnold · ‎03-06-2017

In a recent Predictive Cluster Validation Summary for one of my clusters, Cloudera Proactive Support states: "The following hosts have IPv6 enabled, which is against our best practices, because it can cause connectivity problems. This is discussed in the CDH documentation. (http://www.cloudera.com/content/cloudera/en/documentation/core/latest/topics/cdh_ig_req_supported_versions.html)" Yet that page simply says that " IPv6 is not supported and must be disabled." If this is a hard requirement, then why is there no documentation on *how* to disable IPv6 for the various supported OSs? I understand that Cloudera may not want to get into the OS configuration business, but at least pointers to vender documentation should be provided.

mjarnold · ‎09-02-2016

When will Director support this natively?

mjarnold · ‎02-29-2016

SpiveyBen, Is there some sort of roadmap/timeline for support of both LDAP and Kerberos for HS2 clients?

Online	Offline
Last Visited	‎02-22-2023 08:44 AM

Date Registered	‎10-27-2015 07:45 AM
Last Visited	‎02-22-2023 08:44 AM
Total Messages Posted	39
Total Kudos Received	15

Re: Setting up Cloudera Navigator Encrypt

Re: When is CDP going to support Rocky Linux?

Re: Changing the basedir of TestDFSIO

Re: C6, Hue, MySQL, and RHEL6

Re: C6, Hue, MySQL, and RHEL6

C6, Hue, MySQL, and RHEL6

Re: How to do an OS upgrade on cloudera cluster fr...

Re: Does CDH support backend database using SSL/TL...

navencrypt-move

Re: Navigator can not encrypt the old data, right?

Re: Setting up Cloudera Navigator Encrypt

Re: Disabling IPv6

Re: Disabling IPv6

Re: Disabling IPv6

Re: Disabling IPv6

Re: HUE external database

Re: New Cloudera installation: Hue - Bad Request (...

Re: New Cloudera installation: Hue - Bad Request (...

Disabling IPv6

Re: Java 8 on CDH cluster using Cloudera director ...

Re: sentry + ldap + hive confuse