About rmani

rmani · ‎11-09-2017

@Prashant Chaudhari you mentioned that ranger audits log to spool directory, do you mean that it just puts in local spool and not getting into HDFS? Do you see any exceptions in the NIFI log related to ranger audit please check.

rmani · ‎11-06-2017

@Jack Jackson I didnt have any issue building using the following, what error you get while building? mvn clean compile package assembly:assembly

rmani · ‎10-12-2017

If you want to to just use the a later version of ranger you can do it manually replace the jars with new jars after extracting or building the jars. Refer. https://cwiki.apache.org/confluence/display/RANGER/Apache+Ranger+0.5.0+Installation#ApacheRanger0.5.0Installation-Laydownthebuildintoappropriateplaces

rmani · ‎09-28-2017

Are you using the Ambari Infra Solr, if so there are a property "Ranger audit service users" in Ambari infra, add your user in there and check.

rmani · ‎09-28-2017

@Jacqualin jasmin Try changing it in Amabri respective Log4j configuration. I know in older versions it is not there. If it's there you can change it ( admin-log4j, usersync-log4j, tagsync-log4j section)

rmani · ‎09-28-2017

@Magesh Kumar Check in xa_portal.log what error you get when you configure db. Just FYI, DB is not supported anymore for Ranger audits and Solr is the option for you in later versions.

rmani · ‎05-23-2017

@li zhen Unit test are added in ranger 0.7. Please refer that and it should also work for you. https://github.com/apache/ranger/blob/ranger-0.7/hive-agent/src/test/java/org/apache/ranger/services/hive/HIVERangerAuthorizerTest.java

rmani · ‎05-23-2017

@Jan Lenhardt is this a HA cluster? If so could you please link core-site.xml and hdfs-site.xml to the the ranger/conf folder, restart ranger and try?

rmani · ‎02-22-2017

Ranger audits the hdfs files and folders for which there is policy to audit, other request falls back to HDFS acl. Audit folders in hdfs for ranger audits are owned by respective component's super user ( when enabling plugin it gets created accordingly) and it has necessary hdfs acl to create the audit logs. Hence there is no circular dependency on this to audit back all the audits written into HDFS. As far as I know you can also start Ranger after HFDS is available, only thing while starting HDFS via Ambari, start service does checks which might take sometime before it come up, there is no relation to HDFS being Ranger's audit sink.

rmani · ‎02-15-2017

There is solution put around for this please refer https://issues.apache.org/jira/browse/RANGER-1310

rmani · ‎02-07-2017

We shall update the doc. I see that show databases is not there

rmani · ‎02-07-2017

@khireswar Kalita what HDP version you are using? "Show Databases" when ranger is enabled will show only those databases which the user / group has access. Do you see the audits for your operation in ranger?

rmani · ‎02-01-2017

@Javier Teixeira Quevedo Also please check in ranger install folder /usr/hdp/2.XXXX/ranger-admin/ews/webapp/WEB-INF/classes/ranger-plugins , atlas/ranger-atlas-plugin.*.jar is present. This is same plugin jar which is part of atlas ranger plugin install. SOLUTION : cp /usr/hdp/2.5.0.0-1245/atlas/libext/ranger-atlas-plugin-impl/ranger-atlas-plugin-0.6.0.2.5.0.0-1245.jar /usr/hdp/2.5.0.0-1245/ranger-admin/ews/webapp/WEB-INF/classes/ranger-plugins/atlas folder and not to /usr/hdp/2.5.0.0-1245/ranger-admin/ews/lib folder

rmani · ‎01-30-2017

@Jacqualin jasmin check that in Ambari the quick link what is the hostname it is used. If the hostname is not in your dns lookup /etc/host config in OS you might need to configure it to get the hostname resolved to correct IP and viceversa

rmani · ‎01-23-2017

@sreehari takkelapati you can bump the audit data in hdfs into hive table and do a report as needed for you. Please check this out.https://community.hortonworks.com/articles/60802/ranger-audit-in-hive-table-a-sample-approach-1.html

rmani · ‎01-20-2017

Please check this out https://community.hortonworks.com/questions/77692/controlling-access-to-hdfs-data-through-zeppelin.html This give idea on controlling hdfs data access through Zeppelin. @vshukla Is there any specific on Hive access control via zeppelin?Will the Ranger Hive Plugin itself is sufficient for this?

rmani · ‎01-17-2017

@Raffi Abberbock Ranger throws this error which is shown by the Ambari hive view, if at all if you want to change the message it will be in Ranger. Could you please raise an Apache Ranger JIRA for your needs?

rmani · ‎01-12-2017

@Dinesh Das Ranger is not supported in HIVE CLI. What version of HDP are using? If Ranger Policy is not in effective may be the plugin is not enabled correctly or something wrong. Do you get any audit in Ranger admin? Also as @svenkat requested please provide your use case that will help us.

rmani · ‎01-11-2017

@Dinesh Das Row Filtering and Column masking are supported in Ranger. This may cater your use case of column value level restriction. Please check it out and let us know is this what you were looking for? https://cwiki.apache.org/confluence/display/RANGER/Row-level+filtering+and+column-masking+using+Apache+Ranger+policies+in+Apache+Hive

rmani · ‎01-05-2017

This should get all policies in 0.6.x and 0.7 curl -iv -u admin:admin -H "Accept: application/json" -H "Content-Type: application/json" -X GET "http://hostname:6080/service/public/v2/api/policy" There is no bulk update. Do you want something like mass upload of policies? There is one jira https://issues.apache.org/jira/browse/RANGER-1214 which in WIP

rmani · ‎01-04-2017

Please use the Ranger Rest APIs https://cwiki.apache.org/confluence/display/RANGER/Apache+Ranger+0.6+-+REST+APIs+for+Service+Definition%2C+Service+and+Policy+Management Also check this out for the best practices for Ranger http://hortonworks.com/blog/best-practices-in-hdfs-authorization-with-apache-ranger/

rmani · ‎12-28-2016

@Guido Schmutz In Ambari -> Ranger -> Advanced ranger-ugsync-site Check the following properties. This should have the necessary kerberos principal usually "rangerusersync/_HOST@<domain_name>.COM" and its keytab ranger.usersync.kerberos.keytab ranger.usersync.kerberos.principal ranger.usersync.policymgr.username

rmani · ‎12-22-2016

@chennuri gouri shankar looks like you have a space in front of your ranger admin url. check it out and remove it if its there . " http://dm1.example.com:6080/service/plugins/policies/download/datametica"

rmani · ‎12-21-2016

@Leslie Chang you need to check the service definition you created for your service Here is the sample one check for HIVE. check it out https://github.com/apache/incubator-ranger/blob/master/agents-common/src/test/resources/admin/service-defs/test-hive-servicedef.json

rmani · ‎12-19-2016

S3 is not supported in Ranger as of now

rmani · ‎12-16-2016

I am not sure if this is Ranger related. Could you please provide hiveserver2.log?

rmani · ‎12-14-2016

@Prashobh Balasundaram which version of Ranger / HDP you are using, it may be that in your version that API is not there and later release has it

rmani · ‎12-14-2016

@hitaay This is nothing to do with performance of the Authorization which is done by the policy engine which has various optimization params.

rmani · ‎12-07-2016

Make user "sami" belongs to hdfs group and then try hive command line.

rmani · ‎12-06-2016

Looking at the error Permission denied: user=hive, access=EXECUTE, inode="/apps/hive/warehouse":hdfs:hdfs:d--------- it is hdfs which is doing the Authorization check and not allowing. Do you have the policy for the use "hive" if not create one with read, write and execute permission as your hdfs level permission is 000

Online	Offline
Last Visited	‎08-23-2019 07:50 PM

Date Registered	‎09-25-2015 05:12 PM
Last Visited	‎08-23-2019 07:50 PM
Total Messages Posted	93
Total Kudos Received	64

Re: How to install newer service version than in ...

Re: Ranger HDFS Audit with Ranger HDFS Plugin

Re: Ranger 'test connection' for Atlas fails

Re: custom ranger reports

Re: kerberos ticket not working after I enabled SO...

Re: Nifi ranger plugin not writing logs to hdfs

Re: How to install newer service version than in ...

Re: How to install newer service version than in ...

Re: Error 403 Unauthorized request in Solr Admin U...

Re: how to modify Ranger log and PID Directories

Re: Ranger Audit not available in Ranger UI. Audit...

Re: how to run the unit test in the source code ab...

Re: Hbase and Ranger - Hbase Police test connectio...

Re: Ranger HDFS Audit with Ranger HDFS Plugin

Re: Ranger audit to HDFS creates corrupt JSON

Re: All hive databases are showing on show databas...

Re: All hive databases are showing on show databas...

Re: Ranger 'test connection' for Atlas fails

Re: Not able to access Ranger Admin UI

Re: custom ranger reports

Re: How to restrict the users access to a particul...

Re: Customize Hive View Error message

Re: Can we do column value level restriction in Ap...

Re: Can we do column value level restriction in Ap...

Re: Few questions about apache ranger 0.6

Re: Few questions about apache ranger 0.6

Re: Problem with Ranger UserSync from UNIX on kerb...

Re: HIVE policies not working

Re: Ranger policy creation failing

Re: Ranger and creating database pointing to S3 ...

Re: Ranger and creating database pointing to S3 ...

Re: Is there a way to bulk dump ranger policy usin...

Re: What is more preferable/best practice guidelin...

Re: please help understand Ranger security

Re: kerberos ticket not working after I enabled SO...