Member since
07-10-2018
21
Posts
2
Kudos Received
0
Solutions
10-03-2018
06:44 AM
@Robert Levas Thanks for your support
... View more
09-28-2018
05:31 AM
@Robert Levas Could this be a problem related to principal mismatch in client and spengo configuration ?
When I checked `klist` I could see principal name has HTTP/$loadBalancer@EXAMPLE.COM. Where I actually configured HTTP/_HOST@EXAMPLE.COM in ui.filter.params. Is the browser override the principal name as the host ? Can we bypass that ?
My Spnego configuration object - {'type': 'kerberos', 'kerberos.principal': 'HTTP/_HOST@EXAMPLE.COM', 'kerberos.keytab':'/etc/security/keytabs/spnego.service.keytab' , 'kerberos.name.rules': 'DEFAULT'} klist output - klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: HTTP/sdssystemmaster2.example.com@EXAMPLE.COM Valid starting Expires Service principal
2018-09-28T10:12:09 2018-09-29T10:12:09 krbtgt/example.com@EXAMPLE.COM
2018-09-28T10:22:44 2018-09-29T10:12:09 HTTP/elb.amazonaws.com@ 2018-09-28T10:22:44 2018-09-29T10:12:09 HTTP/elb.amazonaws.com@EXAMPLE.COM
... View more
09-26-2018
07:22 AM
@Robert Levas List of SPNEGO principals HTTP/sdssystemedge.example.com@EXAMPLE.COM
HTTP/sdssystemhdf1.example.com@EXAMPLE.COM
HTTP/sdssystemhdf2.example.com@EXAMPLE.COM
HTTP/sdssystemhdf3.example.com@EXAMPLE.COM
HTTP/sdssystemmaster1.example.com@EXAMPLE.COM
HTTP/sdssystemmaster2.example.com@EXAMPLE.COM
HTTP/sdssystemworker1.example.com@EXAMPLE.COM
HTTP/sdssystemworker2.example.com@EXAMPLE.COM
HTTP/sdssystemworker3.example.com@EXAMPLE.COM
HTTP/sdssystemworker4.example.com@EXAMPLE.COM
Turned off Reverse-DNS by setting rdns=false in krb5.conf file. But still getting same error HTTP ERROR: 403 Problem accessing /. Reason:
org.apache.hadoop.security.authentication.client.AuthenticationException Powered by Jetty://
... View more
09-25-2018
12:02 PM
@Sandeep Nemuri Thanks
... View more
09-19-2018
05:43 AM
Kerberized HCP Cluster managed by Ambari
... View more
Labels:
- Labels:
-
Apache Storm
09-18-2018
06:39 AM
@Robert Levas That principal name is masked. Actually it is in FQDN format (HTTP/sdssystemmaster2.example.com@EXAMPLE.COM)
... View more
09-17-2018
03:56 PM
Thanks Unsupported key type issue is solved. Now getting another error in /var/log/krb5kdc.log while accessing storm web ui. Sep1708:37:50 ip-10-0-2-8.ec2.internal krb5kdc[1536](info): TGS_REQ (6 etypes {181716232526})127.0.0.1: LOOKING_UP_SERVER: authtime 0, HTTP/sdssystemmaster2@EXAMPLE.COM for HTTP/ec2-18-114-9-244.compute-1.amazonaws.com@EXAMPLE.COM,Servernot found inKerberos database Sep1708:37:50 ip-10-0-2-8.ec2.internal krb5kdc[1536](info): closing down fd 13 Sep1708:37:50 ip-10-0-2-8.ec2.internal krb5kdc[1536](info): TGS_REQ (6 etypes {181716232526})127.0.0.1: UNKNOWN_SERVER: authtime 0, HTTP/sdssystemmaster2@EXAMPLE.COM for krbtgt/COMPUTE-1.AMAZONAWS.COM@EXAMPLE.COM,Servernot found inKerberos database Sep1708:37:50 ip-10-0-2-8.ec2.internal krb5kdc[1536](info): closing down fd 13
... View more
09-17-2018
03:28 PM
@ASIF Khan Remove users.xml and authorizations.xml files from Nifi installation directory. Then restart Nifi , the authorization will rebuild new versions of these files based on the current configuration in your authorizers.xml file.
... View more
09-14-2018
01:02 AM
We have a kerberised hdp cluster ( 2.6.5 ) deployed in AWS. AWS network architecture is in such a way that all the hdp component nodes are under private subnet and the access to them is only via ssh from bastion node which is in public subnet. We have enabled all the web components ( Storm UI, Metron UI, Metron Management UI etc ) available outside via AWS ELB load balancer to the outside world.
Our kerberos server and kdc admin is available outside via ssh tunneling via bastion node, This is for the external accessing client to authenticate eg : Spengo. When we access our storm UI via browser with proper step taken for to pass spengo authentication, We are getting 403 error even with proper keytab and principal. Error getting in /var/log/storm/ui.out in storm UI hosted node Found KeyTab /etc/security/keytabs/spnego.service.keytab for HTTP/sdssystemmaster2@EXAMPLE.COM
Looking for keys for: HTTP/sdssystemmaster2@EXAMPLE.COM
Found unsupported keytype (3) for HTTP/sdssystemmaster2@EXAMPLE.COM
MemoryCache: add 1536315369/301662/8ABC886166F6808EA668D561462EDD37/metron@EXAMPLE.COM to metron@HOST. Steps followed :
1- Installed kerberos client 2- Copied krb5.conf file from kerberose node to local file krb5.ini and configured [libdefaults]
renew_lifetime = 7d
forwardable = true
default_realm = EXAMPLE.COM
ticket_lifetime = 24h
dns_lookup_realm = false
dns_lookup_kdc = false
default_ccache_name = /tmp/krb5cc_%{uid}
#default_tgs_enctypes = aes des3-cbc-sha1 rc4 des-cbc-md5
#default_tkt_enctypes = aes des3-cbc-sha1 rc4 des-cbc-md5
[logging]
default = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
kdc = FILE:/var/log/krb5kdc.log
[realms]
EXAMPLE.COM = {
admin_server = localhost
kdc = localhost
} 3- Copied keytab file of principal - HTTP/sdssystemmaster2@EXAMPLE.COM spnego.service.keytab 3- kinit executed () and ticket seems to be generated fine (screenshot added) 4- Configured firefox about:config network.negotiate-auth.trusted-uris : loadbalancer-url
network.negotiate-auth.delegation-uris : loadbalancer-url
network.negotiate-auth.gsslib : C:\Program Files\MIT\Kerberos\bin\gssapi64.dll
network.negotiate-auth.using-native-gsslib : false 5- Loaded the storm UI Storm UI spengo Kerberos configuration ui.filter : org.apache.hadoop.security.authentication.server.AuthenticationFilter
ui.filter.params : {'type': 'kerberos', 'kerberos.principal': '{{storm_ui_jaas_principal}}', 'kerberos.keytab':'{{storm_ui_keytab_path}}' , 'kerberos.name.rules': 'DEFAULT'}
storm_ui_keytab : /etc/security/keytabs/spnego.service.keytab
storm_ui_principal_name : HTTP/_HOST@EXAMPLE.COM
... View more
Labels:
- Labels:
-
Apache Storm
08-03-2018
07:09 AM
1 Kudo
You need to secure your YARN. Dr. Who is anonymous user. Require passwords, enable kerberos, add Knox, secure your serves. http://hadoop.apache.org/docs/r2.8.0/hadoop-project-dist/hadoop-common/SecureMode.html hadoop.htttp.staticuser.user = dr. who it's an internal joke for default user. you can change it. it means you have not secure your Hadoop, have an easy password like admin or have a malicious user. https://hadoop.apache.org/docs/r2.4.1/hadoop-project-dist/hadoop-common/core-default.xml https://www.bleepingcomputer.com/news/security/hadoop-servers-expose-over-5-petabytes-of-data/ Stop your cluster. Change your security then restart. You can then kill all those jobs and no new ones will start.
... View more