Hello
We have HDFS Encryption at rest enables in our Kerberized cluster.
I am able to create encryption zone, write data into it as admin (who created the key & zone). Other users (not in the same LDAP group as the above admin user) are not able to access it even with FACL's set to rwx - because they are not authorized for [DECRYPT_EEK].
Queries
1. When a user creates an encryption zone, by default, other users in same unix group gets access to [DECRYPT_EEK]. Is this true?
2. Usually an user is able to see the encrypted data (not the actual data) if he/she has read permissions to it. But, this is not the case with HDFS Rest encryption. Unless the user is able to decrypt the data, they are not allowed to read it. - correct?
3. Is there a way to show/display the encrypted data (without decrypting it)? If so, how?
4. What/where does GENERATE_EEK & GET_METADATA fit into this concept?
The whole concept of maintaining keys in KMS/KTS and encrypt the data based on that - seems to be more like a blocking the access to the data rather than the fact that the data is encrypted.
if someone can please provide some clarity, would be greatly beneficial. Thank you.
... View more
