Re: Knox authentication with PAM

Scharan · ‎06-04-2022

@learner94 You can make use of the capacity scheduler, Refer to the following docs for more info https://docs.cloudera.com/cdp-private-cloud-base/7.1.3/yarn-allocate-resources/topics/yarn-allocating-resources-with-the-capacity-scheduler.html

Scharan · ‎05-12-2022

Hi @gisbello Can you confirm is this issue started after the upgrade Can you share CDP/CDH and Cloudera manager version

Scharan · ‎04-04-2022

Hi @yagoaparecidoti If your looking for YARN Resource Managemen, Refer to the following document https://docs.cloudera.com/HDPDocuments/HDP2/HDP-2.6.4/bk_yarn-resource-management/content/setting_user_limits.html

Scharan · ‎03-24-2022

@Sayed016 Not only knox whatever the service may be the Pam authentication requires Read permission on /etc/shadow file Refer to the below doc for more info https://www.redhat.com/sysadmin/pluggable-authentication-modules-pam

Scharan · ‎03-24-2022

@Sayed016 Can you check the permission on /etc/shadow file, make sure it has 444 permission

Scharan · ‎03-08-2022

@HDP_Suja Can you check node mangar logs on the failed hosts, the error might be different

Scharan · ‎03-06-2022

@Chetankumar Can you please share complete stack trace of the error Also confirm cdh/ hdp version

Scharan · ‎01-25-2022

@HDP_Suja While accessing repo through the internet I can see 403 error, Make sure the paywall credentials are correct For the local repository, Check is the tarball that you downloaded contains all the required files, note that you need to pass the paywall credentials to download the tarball Refer the following link for more info https://www.cloudera.com/downloads/paywall-expansion.html

Scharan · ‎01-25-2022

@HDP_Suja Can you share the error / error code Make sure the below document is followed correctly https://docs.cloudera.com/HDPDocuments/Ambari-2.7.1.0/bk_ambari-installation/content/setting_up_a_local_repository_with_temporary_internet_access.html

Scharan · ‎01-21-2022

@Seaport For /api/interpreter/** = authc, roles[{{zeppelin_admin_group}}] you need to configure roles in shiro configuration, Refer to the following doc for more info https://zeppelin.apache.org/docs/0.8.0/setup/security/shiro_authentication.html#secure-your-zeppelin-information-optional https://community.cloudera.com/t5/Support-Questions/Zeppelin-user-role-mapping-using-Active-Directory/td-p/238681

Scharan · ‎01-20-2022

@Seaport To provide access to interpreter page, comment/delete below line[1] from shiro configuration url section or configure roles as mentioned in doc[2] [1]: /api/interpreter/** = authc, roles[admin] [2]: https://zeppelin.apache.org/docs/0.6.2/security/shiroauthentication.html#active-directory

Scharan · ‎01-19-2022

@Koffi Can you try restarting HBase service and they try restarting AMS

Scharan · ‎01-18-2022

Yes, change it to /ams-hbase-secure1 or any other name, New znode with the mentioned name will get created once you restart AMS service

Scharan · ‎01-18-2022

Can you try the below steps - Go to Ambari-->Ambari Metrics-->Configs-->Search for "hbase.tmp.dir" and check that value, it should be "/var/lib/ambari-metrics-collector/hbase-tmp". - Now login to the Collector node and do "cd /var/lib/ambari-metrics-collector" (cd to “hbase.tmp.dir”). Then take the backup of hbase-tmp directory by running "cp -pr hbase-tmp/ /tmp/hbase-tmp_bkp" Now run this command to delete this hbase tmp directory " rm -rf hbase-tmp " - Goto Ambari-->Ambari Metrics-->Configs and search for "zookeeper.znode.parent" it should be "/ams-hbase-unsecure". Now change this value to "/ams-hbase-unsecure1 " and save the configs. This will create a new znode.

Scharan · ‎01-18-2022

Hello @Koffi I can see AMS is running on Distributed mode, Can you check and confirm is Hbase service is up and running fine in your cluster

Scharan · ‎12-21-2021

Hi @jenne Can you share a complete stack trace of the error or ldap error code from the atlas application logs

Scharan · ‎12-18-2021

Hi @ebeb Activity Monitor is deprecated from 7.0.0 onwards , if there is no MapReduce V1 in use it can be safely removed from the cluster Refer to below document for more info https://docs.cloudera.com/documentation/enterprise/6/release-notes/topics/rg_deprecated_items.html#concept_h25_5b2_rbb

Scharan · ‎12-13-2021

@syedshakir I see "rcmprod" user doesn't have permission to access the interpreter page To provide access to interpreter page, comment/delete below line[1] from shiro configuration url section or configure roles as mentioned in doc[2] [1]: /api/interpreter/** = authc, roles[admin] [2]: https://zeppelin.apache.org/docs/0.6.2/security/shiroauthentication.html#active-directory

Scharan · ‎12-01-2021

@daba Can you try adding the below lines to the Knox topology files authentication.param.remove=main.pamRealm authentication.param.remove=main.pamRealm.service Refer to the following doc for more info on how to configure LDAP/AD in knox https://docs.cloudera.com/runtime/7.2.10/knox-authentication/topics/security-knox-authe-ldap.html

Scharan · ‎11-06-2021

@yacine_ Can you confirm the cdp version

Scharan · ‎10-25-2021

enable debug on atlas logs and see if their are any errors

Scharan · ‎10-24-2021

@yacine_ Is Atlas initialization is done, if not can you try Initiazing Atlas - Navigate to Atlas from the Cloudera Manager UI - Under actions , the Initialize Atlas option appears. Initiate it; it will create the required resources. - Once done, verify the Altas UI.

Scharan · ‎10-16-2021

@PrernaU To access interpreter page you need to have access in shiro cofiguration , Make sure your user id added to the below line in shiro configuration or delete/ comment the below line in shiro configuration /api/interpreter/** = authc, roles[admin_role, test, test2] Refer below doc for more info https://docs.cloudera.com/cdp-private-cloud-base/7.1.6/configuring-zeppelin/topics/enabling_access_control_for_interpreter__configuration__and_credential_settings.html

Scharan · ‎09-07-2021

@HeathG Can you confirm were there any changes made on the cluster If your cluster is kerberized can you try increasing kdc_timeout value in /etc/krb5.conf and they try restarting the zookeeper

Scharan · ‎08-31-2021

@wbivp You need to create /proxy policy for Nifi in ranger, Refer to below document for more info https://community.cloudera.com/t5/Community-Articles/NiFi-Ranger-based-policy-descriptions/ta-p/246586 https://docs.cloudera.com/HDPDocuments/HDP3/HDP-3.1.4/authorization-ranger/content/resource_policy_create_a_nifi_policy.html

Scharan · ‎08-31-2021

@KPG1 Ranger audits store in both HDFS and Solr. HDFS is used for long term , Solr will be used for short term storage. By using Solr you have data indexed and you can view it quickly from Ranger UI. Deleting older ranger audit from hdfs will not cause any issues to the service

Scharan · ‎08-22-2021

@ajck Can you share the stack trace of the error

Scharan · ‎08-13-2021

@Nil_kharat Ticket lifetime is set in kerberos configuration file krb5.conf in MIT kerberos, You can check the lifetime of the ticket using # klist command after doing kinit You can still specify the lifetime of the ticket using -l option as shown below # kinit -l 30m -kt <Keytab> <principal> Example: kinit -l 30m -kt sai.keytab sai@SUPPORTLAB.CLOUDERA.COM

Scharan · ‎08-13-2021

@Nil_kharat To renew the Kerberos ticket, run kinit and specify both the keytab file and the principal: # kinit -kt <keytab> <Principal> Example: # kinit -kt user1.keytab user1@EXAMPLE.COM

Scharan · ‎07-26-2021

@SSRIL Can you keep only one OS repository link and remove other OS properties from the Repository page Also can check the repo under /etc/yum.repos.d/

Online	Offline
Last Visited	‎06-23-2022 01:02 AM

Date Registered	‎07-09-2019 07:05 AM
Last Visited	‎06-23-2022 01:02 AM
Total Messages Posted	210
Total Kudos Received	65

Re: Knox authentication with PAM

Re: HDP-Yarn-NodeManager not getting started

Re: Zeppelin admin account does not have any permi...

Re: Start this Activity Monitor has failed. Activi...

Re: zeppline interpreter unable to change

Re: Resource level restriction in YARN queue while...

Re: Yarn Queue Manager Not starting

Re: create a dynamic resource pool for use in YARN...

Re: Knox authentication with PAM

Re: Knox authentication with PAM

Re: HDP-Yarn-NodeManager not getting started

Re: Error starting NodeManager

Re: HDP using Ambari Installation

Re: HDP using Ambari Installation

Re: Zeppelin admin account does not have any permi...

Re: Zeppelin admin account does not have any permi...

Re: Metric collectors not starting

Re: Metric collectors not starting

Re: Metric collectors not starting

Re: Metric collectors not starting

Re: Error while AD authentication (AtlasAuthentica...

Re: Start this Activity Monitor has failed. Activi...

Re: zeppline interpreter unable to change

Re: Apache Knox LDAP configuration is not used

Re: CDP7 can't access Atlas Web UI

Re: CDP7 can't access Atlas Web UI

Re: CDP7 can't access Atlas Web UI

Re: Zeppelin interpreter -Not able to add new inte...

Re: Unable to start Zookeeper - LoginException: co...

Re: Nifi Failed authorization

Re: Ranger audit log to hdfs

Re: 502 proxy error calling Zeppelin paragraph (Im...

Re: Renew Kerberos ticket

Re: Renew Kerberos ticket

Re: Apache Ambari Server installation giving error...