Page History

...

1. Checking HTTP Principle

1. kadmin.local

2. list_principals

3. exit

2. search for spnego.service.keytab

   1. locate spengo keytab

   2. kadmin.local

   3. list_principals

   4. exit

   • The list shown should contain HTTP/<internal host name>@Realm

3. Try to kinit using “HTTPusing  “HTTP/<internal host name>@Realm” with “spnego.service.keytab”

1. 1. 1. locate spengo keytab
      2. kinit -k -t  <path>/spengo.service.keytab/<intername host name>@EXAMPLE.COM
      3. klist
      4. kdestroy

• Create a principle to use with Ranger Repo for logging in KMS
• Create principal

kadmin.local
addprinc <principal name>
Enter the password
exit

• Check the principal by doing kinit

kinit <principal name>
Enter password
klist
kdestroy

• Edit “hdfs­-site.xml”

Replace localhost with <internal host name>
Go to path cd/usr/hdp/<version>/hadoop/conf/
vim hdfs-site.xml
For property “dfs.encryption.key.provider.uri” ,enter the value “kms://http@<internal host name>:9292/kms”
save and quite

• Edit “core-­site.xml”

Replace	localhost with <internal host name>
Go to path cd/usr/hdp/<version>/hadoop/conf/
vim core-site.xml

• Restart Namenode

su ­-l hdfs -­c "/usr/hdp/<version>/hadoop/sbin/hadoop­-daemon.sh stop namenode"
su ­-l hdfs -­c "/usr/hdp/<version>/hadoop/sbin/hadoop­-daemon.sh start namenode"

• Restart krb5kdc

service krb5kdc restart

• We’ll extract our build of ranger KMS at the appropriate place (/usr/local).

cd/usr/local
sudo tar -zxvf ~/dev/incubator-ranger/target/ranger-0.5.0-kms.tar.gz
sudo ln -s ranger-0.5.0-kms ranger-kms
cd ranger-kms

• Setting required for secure instance

1. 1. Edit following properties under ews/webapp/WEB­INF/classes/conf.dist/kms-­site.xml:

<property>
  	<name>hadoop.kms.authentication.type</name>
  	<value>kerberos</value>
</property>

<property>
	<name>hadoop.kms.authentication.kerberos.keytab</name>
	<value>/etc/security/keytabs/spnego.service.keytab</value>
</property>

<property>
	<name>hadoop.kms.authentication.kerberos.principal</name>
	<value>*</value>
/property>

•   Add following property in ews/webapp/WEB­INF/classes/conf.dist/kms-­site.xml : (Replace “testkms1” with appropriate user who will be used for credential authentication):

<property>
	<name>hadoop.kms.proxyuser.testkms1.groups</name>
	<value>*</value>
</property>

<property>
	<name>hadoop.kms.proxyuser.testkms1.hosts</name>
	<value>*</value>
</property>

<property>
	<name>hadoop.kms.proxyuser.testkms1.users</name>
	<value>*</value>
</property>

• Create link to /etc/hadoop/conf/core-site.xml under /etc/ranger/kms/conf

  1. (ln -s /etc/hadoop/conf/core-site.xml /etc/ranger/kms/conf/core-site.xml)

• Install Ranger-kms with appropriate property values

1. 1. Go to ranger-kms folder and edit install.properties (Enter appropriat  values for the below given properties)
      1. db_root user=
      2. db_root password
      3. db_host
      4. db_name
      5. db_user
      6. db_password
      7. KMS_MASTER_KEYPASSWD
      8. POLICY_MGR_URL
      9. REPOSITORY_NAME
      10. XAAUDIT.DB.IS_ENABLED
      11. XAAUDIT.DB.FLAVOUR
      12. XAAUDIT.DB.HOSTNAME
      13. XAAUDIT.DB.DATABASE_NAME
      14. XAAUDIT.DB.USER_NAME
      15. XAAUDIT.DB.PASSWORD

• Run setup

./setup.sh

• start the KMS server

rangee-kms start

Ranger UI setup

• Create KMS service

1. 1. REPOSITORY_NAME: name specified in installed.properties (e.g kmsdev)

   2. KMS URL: kms://http@<internal host name>:9292/kms
   3. Username:Principle that will be used for kms (e.g.testkms1@EXAMPLE.COM)
   4. Password:Password for principle(e.g.testkms1 password)