@suresh krish Please find below reply inline - 1, What should be the permission for my data directory or file system eg, drwxrwx--- appwowner appgroup /data/ ---- is this the correct way.. or only appowner show have fulll permission and for others and group is restricted ? --> If you are planing to use Ranger to centralize governance for all access then you should set permission recursively to 700 from cli 2) What is the recommended file system that ranger should maintain and what is the recommended file system that ACL should maintain ? -> There is no recommendation given as such. But from my experience you should try to govern everything from single console. ie Ranger, else it will difficult for you to manage when your environment grows bigger n bigger. You do have an option to keep Application data[user app dir data, hive external tables,etc..] managed by Ranger and hadoop hdfs data[hive warehouse dir] by acls. 3) what if i have ACL restricted for a appowner and in ranger it is granted ? --> It a basic fundamentals of HDP that If you have Ranger setup in your environment, Ranger policies will take first precedence and then acl's. So for example - userA has a directory which has policy in ranger which mentions no write access on the dir , but from cli assume it has permission of 777 then, whenever the user tries to create a subdir inside the dir it will first check for ranger policy and if the ranger policy is not allowing then it will check for HDFS POXIS. Chk this link for more details - http://hortonworks.com/blog/best-practices-in-hdfs-authorization-with-apache-ranger/ 4) If i restrict a particular directory for a user. Will that user can access that directory through HIVE or HBASE ? --> Its all up to you how you manage the policy and from where [ie. Ranger / Acls] 5) what is the recommended permission that we need to set to handle by ranger --> Already replied in point 1.
... View more
