Member since
04-09-2019
254
Posts
140
Kudos Received
34
Solutions
My Accepted Solutions
Title | Views | Posted |
---|---|---|
2096 | 05-22-2018 08:32 PM | |
14299 | 03-15-2018 02:28 AM | |
3809 | 08-07-2017 07:23 PM | |
4602 | 07-27-2017 05:22 PM | |
2603 | 07-27-2017 05:16 PM |
01-20-2017
03:54 PM
1 Kudo
Hello @Niranjan Rao, For any Kerberos ticket, the 'ticket_lifetime' (usually 1 day) is the time for which that particular ticket is valid. Once the ticket gets invalid, there is an option (kinit -R) to renew it. User can keep renewing her ticket this way till 'renew_lifetime' time (usually 7 days). The 'renew_lifetime' is calculated from the time the ticket was first acquired. After 'renew_lifetime' is over, a ticket can not be used anymore and a fresh ticket is required to be taken. For example, if you acquire a ticket on 1st Jan 00:00:00, it will expire on 1st Jan 23:59:59. You can keep renewing this ticket till 7th Jan 23:59:59. After that, you'll have no choice but to get a new ticket. Hope this helps !
... View more
01-18-2017
10:59 AM
Hello @Saikiran Parepally, To add to @Kuldeep Kulkarni's answer, you can find the instruction to create AD user and keytab, here : https://community.hortonworks.com/content/supportkb/48973/how-to-setup-kerberos-keytab-for-hadoop-services-o.html Once you have generated keytabs for all the required principals, you can copy them to Ranger Admin node(s) and use "ktutil" command from Kerberos package to merge all keytabs into one. Like this: # ktutil
ktutil: rkt /tmp/service1.keytab
ktutil: rkt /tmp/service2.keytab
ktutil: rkt /tmp/service3.keytab
ktutil: wkt /tmp/combined.keytab
ktutil: exit Hope this helps !
... View more
01-09-2017
11:54 AM
2 Kudos
Hello @Ramya Grandhi, The latest HDP 2.5 sandbox image is based on docker. Though it says 8GB RAM recommended but it should work. Be warned that you might experience sluggish, slow operation though. You might not be able to run too many services together. Just to draw parallel, I use HDP 2.5 virtualbox image on a macbook having 16GB RAM and sometime I see 6-8GB of memory consumption by sandbox & occasionally a slight performance hit. Hope this helps.
... View more
01-05-2017
03:19 PM
1 Kudo
Hello @Qi Wang, 1. You have not shown what error you are getting in beeline. Please paste that error.
2.
The error in Knox log is due to the fact that Ranger audit is not able
to access "kerberized" HDFS service. This is mostly an audit error and
should not block beeline access. 3. IMO, the actual error (if any)
would be in HiveServer2 log (/var/log/hive/hiveserver2.log) file.
Please check that for any clues. To fix the Ranger audit error,
either you can check the ranger-knox-audit configuration / enable DEBUG
logging for Knox OR you can turn off 'Ranger audit to HDFS'. Hope this helps.
... View more
12-30-2016
10:13 AM
A2A @Ayub Khan !
... View more
12-28-2016
01:08 PM
Nicely written and very helpful. Thanks @Ayub Khan for writing this !
... View more
12-17-2016
03:43 PM
8 Kudos
Hello @Sami Ahmad, Keeping the jargon aside -
Ranger is used for deciding who can access what resources on a Hadoop cluster with the help of policies (there is more to this but this is in the most basic terms). Knox can be imagined as the gatekeeper which decides whether to allow user access to Hadoop cluster or not. More complete definitions:
Ranger is an authorization system which allows / denies access to Hadoop cluster resources (HDFS files, Hive tables etc.) based on pre-defined Ranger policies. When user request comes to Ranger, it is assumed to be authenticated already. Knox is a REST API based perimeter security gateway system which 'authenticates' user credentials (mostly against AD/LDAP). Only the successfully authenticated user are allowed access to Hadoop cluster. Knox also provides a layer of abstraction to the underneath Hadoop services i.e. all endpoints are accessed via Knox gateway URL. Follow Apache Ranger project and Apache Knox project for more comprehensive description and full set of feature list. Hope this helps !
... View more
12-14-2016
11:19 AM
1 Kudo
Hello @Mohammed Seeni Short answer: Use this curl command to submit an Oozie job via curl curl -i -k -u guest:guest-password -H Content-Type:application/xml -T workflow-configuration.xml -X POST 'https://localhost:8443/gateway/sandbox/oozie/v1/jobs?action=start' For the complete Oozie commands via Curl, please follow the Knox guide here. Hope this helps !
... View more
12-10-2016
07:21 PM
2 Kudos
Hello @ddharam, This
error can have many reasons but a common one is that the password to
open SSL keystore is incorrect. Can you please show us the SSL
configuration part in Zeppelin? Also please share the keytool command
used to list the keystore. Don't forget to hide the vital parts from the
output ! Another option is to run Zeppelin in SSL debug mode to get more descriptive log. You can add "-Djavax.net.debug=ssl" in the Zeppelin command line & restart Zeppelin service. Please share the debug log here. Thanks.
... View more
12-09-2016
07:22 AM
Thanks @azeltov. I did check that one before writing this. Wanted to address the pain points and common issues that our users are facing around this. Cheers !
... View more