You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 20 Next »

Summary

In order to install Ranger in kerberized environment, user will have to enable kerberos on the cluster where Ranger is to be installed. Once, cluster is kerberized, user will have to create principals for each Ranger service and then follow below given steps to install Ranger.

Creating Keytab and principals

Note: Below steps required only for manual installation of ranger services and plugins

Do some initial Checks :

  • Login as “ranger” user: 

        If ranger user not found then create it i.e. useradd ranger

        E.g :  su - ranger

  • Check for HTTP Principal

    -> kinit -kt <HTTP keytab path> HTTP/<FQDN_OF_Ranger_Admin_Cluster>@<REALM>

               E.g : kinit -kt /etc/security/keytabs/spnego.service.keytab HTTP/mp-ranger-0703-3.novalocal@EXAMPLE.COM

         (After above command there should not be any error. You can check using “klist” whether the above command was successful)

           -> kdestroy (Please don't miss kdestroy after above step)

For Ranger Admin:

  • Create rangeradmin/<FQDN of Ranger Admin>@<REALM>
    -> kadmin.local

    -> addprinc -randkey rangeradmin/<FQDN of Ranger Admin>
          Eg: addprinc -randkey rangeradmin/mp-ranger-0703-3.novalocal@EXAMPLE.COM

    -> xst -k /etc/security/keytabs/rangeradmin.keytab rangeradmin/<FQDN of Ranger Admin>@<REALM>

    -> exit

  •  Check ranger-admin created principal

          -> kinit -kt  /etc/security/keytabs/rangeradmin.keytab rangeradmin/<FQDN of Ranger Admin>@<REALM>
                 E.g : kinit -kt  /etc/security/keytabs/rangeradmin.keytab rangeradmin/mp-ranger-0703-3.novalocal@EXAMPLE.COM 
                 (After above command there should not be any error. You can check using “klist” whether the above command was successful)

         -> kdestroy (Please don’t miss kdestroy after above step)

 For Ranger Lookup:

  •   Create rangerlookup/<FQDN of Ranger Admin>@<REALM>

    -> kadmin.local

  -> addprinc -randkey  rangerlookup/<FQDN of Ranger Admin>

Eg: addprinc -randkey rangerlookup/mp-ranger-0703-3.novalocal@EXAMPLE.COM

  -> xst -k /etc/security/keytabs/rangerlookup.keytab rangerlookup/<FQDN of Ranger Admin>@<REALM>           

  -> exit

  • Check ranger-lookup created principal

  -> kinit -kt  /etc/security/keytabs/rangerlookup.keytab rangerlookup/<FQDN of Ranger Admin>@<REALM>

 E.g : kinit -kt  /etc/security/keytabs/rangerlookup.keytab rangerlookup/mp-ranger-0703-3.novalocal@EXAMPLE.COM

                (After above command there should not be any error u can check using “klist” whether the above command was successful)

          -> kdestroy (Please don’t miss kdestroy after above step)

 For Ranger Usersync:

  • Create rangerusersync/<FQDN>@<REALM>

    -> kadmin.local

    -> addprinc -randkey rangerusersync/<FQDN of Ranger usersync>

   Eg: addprinc -randkey rangerusersync/mp-ranger-0703-3.novalocal@EXAMPLE.COM

 -> xst -k /etc/security/keytabs/rangerusersync.keytab rangerusersync/<FQDN>@<REALM>

 -> exit

  • Check rangerusersync created principal

 -> kinit -kt  /etc/security/keytabs/rangerusersync.keytab rangerusersync/<FQDN of Ranger usersync>@<REALM>

               E.g : kinit -kt  /etc/security/keytabs/rangerusersync.keytab rangerusersync/mp-ranger-0703-3.novalocal@EXAMPLE.COM

               (After above command there should not be any error u can check using “klist” whether the above command was successful)

         -> kdestroy (Please don’t miss kdestroy after above step)

 For Ranger Tagsync:

  • Create rangertagsync/<FQDN>@<REALM>

 -> kadmin.local

 -> addprinc -randkey rangertagsync/<FQDN of Ranger tagsync>

  Eg: addprinc -randkey rangertagsync/mp-ranger-0703-3.novalocal

 -> xst -k /etc/security/keytabs/rangertagsync.keytab rangertagsync/<FQDN>@<REALM>

 -> exit

  • Check rangertagsync created principal

 -> kinit -kt  /etc/security/keytabs/rangertagsync.keytab rangertagsync/<FQDN of Ranger tagsync>@<REALM>

               E.g : kinit -kt  /etc/security/keytabs/rangertagsync.keytab rangertagsync/mp-ranger-0703-3.novalocal@EXAMPLE.COM

               (After above command there should not be any error u can check using “klist” whether the above command was successful)

 -> kdestroy (Please don’t miss kdestroy after above step)


Note: Change the keytab permission to read only and assign it to “ranger” user


Installation Steps for Ranger-Admin

  1. Untar the ranger-<verison>-admin.tar.gz

    -> tar zxf ranger-<version>-admin.tar.gz


  2. Change directory to ranger-<version>-admin

    -> cd ranger-<version>-admin

     

  3. Edit install.properties (Enter appropriate values for the below given properties)

     

    db_root_user=

    db_root_password=

    db_host=


    db_name=

    db_user=

    db_password=


    policymgr_external_url=http://<FQDN_OF_Ranger_Admin_Cluster>:6080

    authentication_method=UNIX or LDAP or AD


    spnego_principal=HTTP/<FQDN_OF_Ranger_Admin_Cluster>@<REALM>

    spnego_keytab=<HTTP keytab path>

    token_valid=30

    cookie_domain=<FQDN_OF_Ranger_Admin_Cluster>

    cookie_path=/

    admin_principal=rangeradmin/<FQDN_OF_Ranger_Admin_Cluster>@<REALM>

    admin_keytab=<rangeradmin keytab path>

    lookup_principal=rangerlookup/<FQDN_OF_Ranger_Admin_Cluster>@<REALM>

    lookup_keytab=<rangerlookup keytab path>

    hadoop_conf=/etc/hadoop/conf

    Note: If kerberos server and admin are on different host then copy the keytab on admin host and assign permission to “ranger” user

     

    • scp the rangeradmin keytab file to the respective path of another host

    • chown ranger <rangeradmin keytab path>

    • chmod 400 <rangeradmin keytab path>


  4. Run setup

    -> ./setup.sh

     

  5. Start Ranger admin server

 

-> ./ranger-admin-services.sh start

Installation Steps for Ranger-Usersync

 

  1. Untar the ranger-<verison>-usersync.tar.gz

    1. tar zxf ranger-<version>-usersync.tar.gz

  2. Change directory to ranger-<version>-usersync

    1. cd ranger-<version>-usersync

  3. Edit install.properties (Enter appropriate values for the below given properties)


 

POLICY_MGR_URL =http://<FQDN_OF_Ranger_Admin_Cluster>:6080

usersync_principal=rangerusersync/<FQDN>@<REALM>

usersync_keytab=<rangerusersync keytab path>

hadoop_conf=/etc/hadoop/conf

 


Note: If kerberos server and usersync are on different host then copy the keytab on usersync host and assign permission to “ranger” user

  • scp the rangerusersync keytab file to the respective path of another host

  • chown ranger <rangeusersync keytab path>

  • chmod 400 <rangerusersync keytab path>


  1. Run setup

    1. ./setup.sh

  2. Start Ranger usersync server

    1. ./ranger-usersync-services.sh start

  • No labels