THIS IS A TEST INSTANCE. ALL YOUR CHANGES WILL BE LOST!!!!
Summary
In order to install Ranger in kerberized environment, user will have to enable kerberos on the cluster where Ranger is to be installed. Once, cluster is kerberized, user will have to create principals for each Ranger service and then follow below given steps to install Ranger.
Creating Keytab and principals
Note: Below steps required only for manual installation of ranger services and plugins
Do some initial Checks :
Login as “ranger” user:
If ranger user not found then create it i.e. useradd ranger
E.g : su - ranger
Check for HTTP Principal
-> kinit -kt <HTTP keytab path> HTTP/<FQDN_OF_Ranger_Admin_Cluster>@<REALM>
E.g : kinit -kt /etc/security/keytabs/spnego.service.keytab HTTP/mp-ranger-0703-3.novalocal@EXAMPLE.COM
(After above command there should not be any error. You can check using “klist” whether the above command was successful)
-> kdestroy (Please don't miss kdestroy after above step)
For Ranger Admin:
- Create rangeradmin/<FQDN of Ranger Admin>@<REALM>
-> kadmin.local
-> addprinc -randkey rangeradmin/<FQDN of Ranger Admin>
Eg: addprinc -randkey rangeradmin/mp-ranger-0703-3.novalocal@EXAMPLE.COM
-> xst -k /etc/security/keytabs/rangeradmin.keytab rangeradmin/<FQDN of Ranger Admin>@<REALM>
-> exit - Check ranger-admin created principal
-> kinit -kt /etc/security/keytabs/rangeradmin.keytab rangeradmin/<FQDN of Ranger Admin>@<REALM>
E.g : kinit -kt /etc/security/keytabs/rangeradmin.keytab rangeradmin/mp-ranger-0703-3.novalocal@EXAMPLE.COM
(After above command there should not be any error. You can check using “klist” whether the above command was successful)
-> kdestroy (Please don’t miss kdestroy after above step)
For Ranger Lookup:
Create rangerlookup/<FQDN of Ranger Admin>@<REALM>
-> kadmin.local
-> addprinc -randkey rangerlookup/<FQDN of Ranger Admin>
Eg: addprinc -randkey rangerlookup/mp-ranger-0703-3.novalocal@EXAMPLE.COM
-> xst -k /etc/security/keytabs/rangerlookup.keytab rangerlookup/<FQDN of Ranger Admin>@<REALM>
-> exit
Check ranger-lookup created principal
-> kinit -kt /etc/security/keytabs/rangerlookup.keytab rangerlookup/<FQDN of Ranger Admin>@<REALM>
E.g : kinit -kt /etc/security/keytabs/rangerlookup.keytab rangerlookup/mp-ranger-0703-3.novalocal@EXAMPLE.COM
(After above command there should not be any error u can check using “klist” whether the above command was successful)
-> kdestroy (Please don’t miss kdestroy after above step)
For Ranger Usersync:
Create rangerusersync/<FQDN>@<REALM>
-> kadmin.local
-> addprinc -randkey rangerusersync/<FQDN of Ranger usersync>
Eg: addprinc -randkey rangerusersync/mp-ranger-0703-3.novalocal@EXAMPLE.COM
-> xst -k /etc/security/keytabs/rangerusersync.keytab rangerusersync/<FQDN>@<REALM>
-> exit
Check rangerusersync created principal
-> kinit -kt /etc/security/keytabs/rangerusersync.keytab rangerusersync/<FQDN of Ranger usersync>@<REALM>
E.g : kinit -kt /etc/security/keytabs/rangerusersync.keytab rangerusersync/mp-ranger-0703-3.novalocal@EXAMPLE.COM
(After above command there should not be any error u can check using “klist” whether the above command was successful)
-> kdestroy (Please don’t miss kdestroy after above step)
For Ranger Tagsync:
Create rangertagsync/<FQDN>@<REALM>
-> kadmin.local
-> addprinc -randkey rangertagsync/<FQDN of Ranger tagsync>
Eg: addprinc -randkey rangertagsync/mp-ranger-0703-3.novalocal
-> xst -k /etc/security/keytabs/rangertagsync.keytab rangertagsync/<FQDN>@<REALM>
-> exit
Check rangertagsync created principal
-> kinit -kt /etc/security/keytabs/rangertagsync.keytab rangertagsync/<FQDN of Ranger tagsync>@<REALM>
E.g : kinit -kt /etc/security/keytabs/rangertagsync.keytab rangertagsync/mp-ranger-0703-3.novalocal@EXAMPLE.COM
(After above command there should not be any error u can check using “klist” whether the above command was successful)
-> kdestroy (Please don’t miss kdestroy after above step)
Note: Change the keytab permission to read only and assign it to “ranger” user
Installation Steps for Ranger-Admin
Untar the ranger-<verison>-admin.tar.gz
-> tar zxf ranger-<version>-admin.tar.gz
Change directory to ranger-<version>-admin
-> cd ranger-<version>-admin
- Edit install.properties (Enter appropriate values for the below given properties)
db_root_user= db_root_password= db_host= db_name= db_user= db_password= policymgr_external_url=http://<FQDN_OF_Ranger_Admin_Cluster>:6080 authentication_method=UNIX or LDAP or AD spnego_principal=HTTP/<FQDN_OF_Ranger_Admin_Cluster>@<REALM> spnego_keytab=<HTTP keytab path> token_valid=30 cookie_domain=<FQDN_OF_Ranger_Admin_Cluster> cookie_path=/ admin_principal=rangeradmin/<FQDN_OF_Ranger_Admin_Cluster>@<REALM> admin_keytab=<rangeradmin keytab path> lookup_principal=rangerlookup/<FQDN_OF_Ranger_Admin_Cluster>@<REALM> lookup_keytab=<rangerlookup keytab path> hadoop_conf=/etc/hadoop/conf |
Note: If kerberos server and admin are on different host then copy the keytab on admin host and assign permission to “ranger” user
- scp the rangeradmin keytab file to the respective path of another host
- chown ranger <rangeradmin keytab path>
- chmod 400 <rangeradmin keytab path>
4. Run setup
-> ./setup.sh
5. Start Ranger admin server
-> ./ranger-admin-services.sh start
Installation Steps for Ranger-Usersync
Untar the ranger-<verison>-usersync.tar.gz
-> tar zxf ranger-<version>-usersync.tar.gz
Change directory to ranger-<version>-usersync
-> cd ranger-<version>-usersync
- Edit install.properties (Enter appropriate values for the below given properties)
POLICY_MGR_URL =http://<FQDN_OF_Ranger_Admin_Cluster>:6080 usersync_principal=rangerusersync/<FQDN>@<REALM> usersync_keytab=<rangerusersync keytab path> hadoop_conf=/etc/hadoop/conf |
Note: If kerberos server and usersync are on different host then copy the keytab on usersync host and assign permission to “ranger” user
- scp the rangerusersync keytab file to the respective path of another host
- chown ranger <rangeusersync keytab path>
- chmod 400 <rangerusersync keytab path>
4. Run setup
-> ./setup.sh
5. Start Usersync server
-> ./ranger-usersync-services.sh start
Installation Steps for Ranger-Tagsync
Untar the ranger-<verison>-tagsync.tar.gz
-> tar zxf ranger-<version>-tagsync.tar.gz
Change directory to ranger-<version>-tagsync
-> cd ranger-<version>-tagsync
- Edit install.properties (Enter appropriate values for the below given properties)
| TAGADMIN_ENDPOINT =http://<FQDN_OF_Ranger_Admin_Cluster>:6080 tagsync_principal=rangertagsync/<FQDN>@<REALM> tagsync_keytab=<rangertagsync keytab path> hadoop_conf=/etc/hadoop/conf TAG_SOURCE= (either 'atlas' or 'file' or 'atlasrest') |
Note: If kerberos server and tagsync are on different host then copy the keytab on tagsync host and assign permission to “ranger” user
- scp the rangertagsync keytab file to the respective path of another host
- chown ranger <rangetagsync keytab path>
- chmod 400 <rangertagsync keytab path>
4. Run setup
-> ./setup.sh
5. Start Ranger tagsync server
-> ./ranger-tagsync-services.sh start
Installation Steps for Ranger-KMS
Untar the ranger-<verison>-SNAPSHOT-kms.tar.gz
-> tar zxf ranger-<version>-SNAPSHOT-kms.tar.gz
Change directory to ranger-<version>-SNAPSHOT-kms
-> Cd ranger-<version>-SNAPSHOT-kms
- Edit install.properties (Enter appropriate values for the below given properties)
| KMS_MASTER_KEY_PASSWD=<Master Key Password> kms_principal=rangerkms/<FQDN of ranger kms host>@<REALM> kms_keytab=<ranger kms keytab path> hadoop_conf=<hadoop core-site.xml path> POLICY_MGR_URL=http://<FQDN of ranger admin host>:6080 |
Note: if kerberos server and Ranger KMS are on different host then copy the keytab on Ranger KMS host and assign permission to “kms” user
- scp the rangerkms keytab file to the respective path
- chown ranger <rangekms keytab path>
- chmod 400 <rangerkms keytab path>
4. Run setup
-> ./setup.sh
5. Follow other setup required for kerberized cluster like creating keytab adding proxy user
6. Start Ranger tagsync server
-> ./ranger-kms start