...

• You can edit service details, including the config properties from the edit icon next to each service name.

Delete Service

• You can delete a service by clicking on the delete button next to each service name listed on the Manage service page.  

Ranger Policies

HDFS

...

• Adding HDFS policies

You can add a new policy from the HDFS policy listing page for a particular service. On add , the policy should be listed in the table below. You can search a Policy by search filters provided.

...

Step 3 : Policy is created with unique id

 

Edit/Delete HDFS Policies

...

• You can edit/delete a policy from the HDFS Policy Listing page by clicking on the edit/delete button next to policy row.

 

HDFS Policy Examples

...

• Ranger allows (through configuration) to allow both Ranger policies and HDFS permissions to be checked for a user request. When a user request is received in namenode, Ranger plugin will check for policies set through Ranger admin. If there are no policies, Ranger plugin will check for permission set in HDFS.It is recommended to have restrictive permission at HDFS level and create permission in Ranger security admin.

Example 1: Policy in Ranger

Step 1 : In the below example we create a policy ‘HDFS_POLICY’ with Resource path /home with read ,write,execute,delegate admin rights and assign it to mark.

• Login as user and try to create a directory home.The user ‘mark’ will be allowed to create the directory since it has read ,write,execute,admin rights to the policy ‘HDFS_POLICY’ with Resource path /home

• Logs For the operations .Result will come as ‘allowed’ if permission is granted and ‘denied’ if permission is denied.

...

NEED DISCUSSION FOR GENERATION OF LOG UNDER AUDIT >>ADMIN TAB

HIVE

• Adding HIVE policies

You can add a new policy from the Hive Policy Listing Page. On add , the policy should be listed in the table below. You can search a Policy by ‘Database Name’ , ‘Table’ , ‘Column’ , ‘Groups name’,’policy name’,’status’,’user name’,’udf’

...

Syntax: grant <permissions> on table <table> to user <user or group>;    
 
i.e   : grant select on table default.newtable to user mark;

...

Edit/Delete HIVE policies

...

• You can edit/delete a policy from the HIVE Policy Listing page by clicking on the edit/delete button next to policy row.

 

Note
REVOKE: Hive REVOKE is a command used to revoke access or privileges on Hive database tables from the users.

Code Block
Syntax: revoke <permissions> on table <table> from user <user or group>;   i.e. : revoke select on table default.newtable from user mark;

Note
This will revoke select rights from user1.

• • Similarly we can write it for (Update,Create,Drop,Alter,Index,Lock,All,Admin)

 

HBASE

• •  Adding HBASE Policies

You can add a new policy from the HBASE Policy Listing Page. On add , the policy should be listed in the table below. You can search a Policy by ‘column’,’column family’,’Group name’,’Policy name’,’Status,Table,’’Username’.

Step 1 : Click on the Add New Policy button on listing page.

Image Modified

Step 2 : Add Hbase Policy

Image Modified

Syntax: grant '<user-or-group>','<permissions>','<table>'
 
i.e   : grant 'mark’' , 'RW' , 'testtable2'

Image Modified

Image Modified

 Edit / Delete HBASE Policies

• • You can edit/delete a policy from the HBASE Policy Listing page by clicking on the edit/delete button next to policy row.

Image Modified

Syntax: revoke ‘<user-or-group>','<table>'
 
i.e   : revoke 'mark','testtable2'

Image Modified

Image Modified

KNOX

• •  Adding KNOX Policies

You can add a new policy from the KNOX Policy Listing Page. On add , the policy should be listed in the table below. You can search a Policy by ‘Policy Name’,‘Topology Name’ , ‘Service Name’ and ‘Groups’.

Step 1 : Click on the Add New Policy button on listing page

Image Modified

Step 2 : Add knox policy

Image Modified

• • Topology name: A topology is a graph of computation. Each node in a topology contains processing logic, and links between nodes indicate how data should be passed around between nodes.

• • Service Name: Binds a Hadoop service with an internal URL that the gateway uses to proxy requests from external clients to the internal cluster services.

Edit/Delete Knox policies

• • You can edit/delete a policy from the KNOX Policy Listing page by clicking on the edit/delete button next to policy row.

Image Modified

STORM

Adding STORM Policies

You can add a new policy from the STORM Policy Listing Page. On add , the policy should be listed in the table below. You can search a Policy by ‘Policy Name’,‘Topology Name’ and ‘Groups’.

Step 1 : Click on the Add New Policy button on listing page

Image Modified

Step 2 : Add STORM Policy

Image Modified

Edit/Delete STORM POlicies

• • You can edit/delete a policy from the STORM Policy Listing page by clicking on the edit/delete button next to policy row.

Image Modified

YARN

• • Adding Yarn policies

You can add a new policy from the YARN Policy Listing Page. On add , the policy should be listed in the table below. You can search a Policy by ‘Group name’,’Policy name’,’queue’,’Status’,’username’.

 Step 1 : Click on the Add New Policy button on listing page

Image Modified

Step 2 : Add YARN Policy

Image Modified

• • You can edit/delete a policy from the YARN Policy Listing page by clicking on the edit/delete button next to policy row.

Image Modified

SOLR

• •  Adding SOLR Policies

You can add a new policy from the STORM Policy Listing Page. On add , the policy should be listed in the table below. You can search a Policy by Collection,Group name,Policy name,status,user name.

Step 1 : Click on the Add New Policy button on listing page

Image Modified

Step 2 : Add SOLR policy

Image Modified

• • You can edit/delete a policy from the SOLR Policy Listing page by clicking on the edit/delete button next to policy row.

Image Modified

KAFKA

• • Adding KAFKA Policies

  • You can add a new policy from the KAFKA Policy Listing Page. On add , the policy should be listed in the table below. You can search a Policy by ‘Group name’,’Policy name’,Status,topic,’username’.

Step 1 : Click on the Add New Policy button on listing page

Image Modified

Step 2 : Add KAFKA Policy

Image Modified

• • Policy permissions are assigned to users and groups.  

Users

• • These are users who can login into the Ranger portal and perform administrative and reporting tasks.Roles can be assigned while adding the users.Only admins are allowed to create users and create services. The role of the ‘admin’/’admin user’ dictates what roles can be assigned to the new users.

Internal Vs External Users

• • Internal users are those users which are created by ranger Admin i.e XA Policy Manager .External users are those users which are synced from other system like Active Directory(AD) ,LDAP or unix system.

Add Users

• • You can add a new group from the User Listing Page. On add , the user should be listed in the table below. The users that are created in the system are You can search a User by ‘Email Address’ ,‘Role’ ,‘User Name’,‘ User Source’,’user status’,’visibility’.

Step 1 : Click on the Add New User button on the user listing page

Image Modified

Step 2 : Enter the details and save.

Image Modified

Step 3 : Set visibility (i.e. Visible/Hidden)

• • After clicking on hidden button user get hide from policy listing page. For hiding functionality user must need to select check box located near User Name column.

Image Modified

Image Modified

Image Modified

Step 4 : Set visibility (Visible)

• • After clicking on Visible option selected user get visible in users listing page.

Image Modified

Step 5 : Set status of the user.

• • If the status of the user is enable then that user can login to the application.If user status is disable then that particular user is not able to login to the application.

Image Modified

Image Modified

Edit Users

• • We can edit only internal users.For the external users,only the role can be changed.

 Admin Login:     

• • You can edit a user from the users Listing page by clicking on the user name.

Image Modified

User Login:

• • You can edit a user from the users Listing page by clicking on profile.

Image Modified

Groups

• • Ranger allows assigning permissions at group level too.

Add Groups

• • You can add a new group from the group Listing Page. On add , the group should be listed in the table below. You can search a group by ‘Group Name’ and ‘ Group Source’,visibility

Step 1: Click on the Add New Group button on the group listing page.

Image Modified

Step 2 : Enter the details and save.

Image Modified

4.2.2 Edit Groups

• • You can edit a group from the groups Listing page by clicking on the name of the group.(Can only be performed by an admin)

Image Modified

• • Visibility of Groups
    • Hidden group does not appears in group listing page.To make the group hide select the check box near group group name.

Image Modified

Image Modified

Reports

• • The Reports module is used to manage the policies more efficiently as the number of policies grow.This page will list all the policies from HDFS,HIVE,HBASE,KNOX,YARN,KAFKA,SOLR and STORM. You can perform search based on  

• • Policy Name    : The policy name assigned to the policy while creating it.

• • Resource Path : The resource path used while creating the policy.

• • ‘Group’ / ‘User Name’: The group and the users to which the policy is assigned

Image Modified

Image Modified

Audit

• • Currently Ranger supports regular auditing. This includes logging at the resource level.It will support conditional auditing based on users, groups or date/time, etc.

 Access

• • Provides Service activity data for all Policies that have Audit set to On. The default service Policy is configured to log all user activity within the Service. This default policy does not contain user and group access rules.You can filter the data based on the following criteria:

Image Modified 

Admin

• • This module Contains all events for the HDP Security Administration Web UI, including Service, Policy Manager, Log in, etc. (actions like create,update,delete,password change).You can filter the data based on the following

Image Modified

• • Difference view when we click on an operation (Update operation in this case)

Image Modified

Logging Session

• • This module logs the information related to the sessions for each login.You can filter the data based on

Image Modified

• • Click on session id for session details.

Image Modified

Image Modified

Plugins

• • This module shows the upload history of the Security Agents.This module displays all the services Exported from the system.You can filter the data based on the followin.

Image Modified

• • Plugins tab is useful to check components are communicating successfully with ranger or not.

Permissions

Permissions Module

The aim of permission module is to provide flexibility of user roles.With the help of permission model, Admin can restrict access or assign permission to any module for non-admin users.The main purpose of Permission model is to assign dedicated roles to non-admin users based on services such as policy manager, audit, reporting, user management,Key Manager.

Step 1: Put the pointer on Settings tab. Click on ‘Permissions’ from dropdown.

Image Modified

Step 2 : You can search the permissions by Group Name,Module Name,User Name.

Image Modified

Add / Edit Permission

Step 3 : Click on edit button under Action column for access of particular module to selected user on permissions listing page.

Image Modified

Step 4 : You can select multiple users and groups from drop down.

1. 1. User Permission

Image Modified

             b.  Group Permission

Image Modified

Step 5 : If Steve user is having permission of only Audit and Reports tab then only this two module will be visible to to mark user on his login.

1. 1.  Admin Login

Image Modified

             b.  Steve user Login

Image Modified