Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

How to disable hive shell for all users (Hive CLI)

avatar
Master Guru

I have configured ranger authorization for hive and want to force all the users to use beeline and want to block access to hive shell to all the users.

I know one workaround - we can revoke execute access for below file on all hive-clients.

/usr/hdp/current/hive-client/bin/hive 

By doing this it could cause an issue to jobs scheduled via workflow engines like oozie or azkabaan etc.

Is there any other effective way to do this ?

1 ACCEPTED SOLUTION

avatar
Master Guru

Suggestion given by @Hajime

We can add below lines in hive-env template via ambari to disable hive-shell

if [ "$SERVICE" = "cli" ]; then
echo "Sorry! I have disabled hive-shell"
exit 1 
fi

After restarting hive services, when you try to run hive shell then you will get below output

[root@sandbox hive]# hive
Sorry! I have disabled hive-shell

View solution in original post

20 REPLIES 20

avatar
Master Guru

avatar
Master Mentor

avatar
Super Collaborator

@Kuldeep Kulkarni it is simple, we had the same problem and i simply edited hive.distro file

/usr/hdp/2.2.0.0-2041/hive/bin/hive.distro

go to this line and comment it and add below string --- if [ "$SERVICE" = "" ] ; then

if [ "$SERVICE" = "" ] && [ "$USER" = "xxxxxxxx" ] ; then if [ "$SERVICE" = "" ] ; then

xxxxxxx - you can use your shared id /service id

let me how did it go..

avatar
Master Guru

avatar
Master Guru

Suggestion given by @Hajime

We can add below lines in hive-env template via ambari to disable hive-shell

if [ "$SERVICE" = "cli" ]; then
echo "Sorry! I have disabled hive-shell"
exit 1 
fi

After restarting hive services, when you try to run hive shell then you will get below output

[root@sandbox hive]# hive
Sorry! I have disabled hive-shell

avatar

This might be sufficient to keep honest people honest. For a user that has write access on the filesystem, it's trivial to override hive-env.sh

avatar
Explorer

I've seen it recommended to change the first line to:

if [ "$SERVICE" = "cli" ] && [ "$USER" != "ambari-qa" ]; then 

Without this, Ambari won't be able to check Hive metastore state and will throw an alert (at least in HDP 2.4).

avatar
Expert Contributor

Hi @kuldeep Kulkarni

This might be silly answer, if i see there is less option as of now to block hive cli wrt specific user, either if there are lot more changes which needs to be made on hadoop configuration side to block hive cli, then i will like to suggest - why not to block hive command from Linux side. For example say sudoers can be one of the way to do this.

avatar
New Contributor

Not only do we restrict access to hive in our environment but we also make people use a command called 'hql' which is a wrapper around beeline. By default a user (on our kerberised cluster and therefore they have already done kinit) can just type 'hql' and be in the defaults or pass simple options to specify non-defaults

#!/bin/bash
# David M Walker, Data Management & Warehousing & Worldpay
# hql command line for use with a Kerborised cluster

DATABASE="DEFAULT"
QUERY_FILE=""
HOST="localhost"
PORT="10001"
QUEUE="DEFAULT"
REALM="_HOST@REALM"

while getopts :d:h:p:r:q:f: PARAM
do
   case "${PARAM}" in 
      d) DATABASE="${OPTARG}"
         ;; 
      f) QUERY_FILE="${OPTARG}"
         ;;
      h) HOST="${OPTARG}"
         ;;
      p) PORT="${OPTARG}"
         ;;
      q) QUEUE="${OPTARG}"
         ;;
      r) REALM="${OPTARG}"
         ;;
      ?) echo "Usage: hql [-d DATABASE] [-h HOST] [-p PORT] [-q QUEUE] [-r REALM] [-f QUERY_FILE]" 
         exit 1
         ;;
   esac
done
shift $(($OPTIND - 1))

if [ -z "${QUERY_FILE}" ]
then
   beeline -u "jdbc:hive2://${HOST}:${PORT}/${DATABASE};transportMode=http;httpPath=cliservice;principal=hive/${REALM}" --hiveconf tez.queue.name=${QUEUE}
   exit $?
else
   if [ -r "${QUERY_FILE}" ]
   then
      beeline -u "jdbc:hive2://${HOST}:${PORT}/${DATABASE};transportMode=http;httpPath=cliservice;principal=hive/${REALM}" --hiveconf tez.queue.name=${QUEUE} -f ${QUERY_FILE}
      exit $?
   else
      echo "File ${QUERY_FILE} is not readable"
      exit 1
   fi
fi

exit 0

avatar

@Kuldeep Kulkarni it seems that HIVE-10511 is the long-term plan for this, also see this link.