You are viewing a plain text version of this content. The canonical link for it is here.
Posted to hdfs-issues@hadoop.apache.org by "Ajay Kumar (JIRA)" <ji...@apache.org> on 2018/03/01 02:03:00 UTC
[jira] [Commented] (HDFS-13081) Datanode#checkSecureConfig should
allow SASL and privileged HTTP
[ https://issues.apache.org/jira/browse/HDFS-13081?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16381389#comment-16381389 ]
Ajay Kumar commented on HDFS-13081:
-----------------------------------
[~xyao], [~jlowe], [~daryn] thanks for input and reviews.
> Datanode#checkSecureConfig should allow SASL and privileged HTTP
> ----------------------------------------------------------------
>
> Key: HDFS-13081
> URL: https://issues.apache.org/jira/browse/HDFS-13081
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: datanode, security
> Affects Versions: 3.0.0
> Reporter: Xiaoyu Yao
> Assignee: Ajay Kumar
> Priority: Major
> Fix For: 3.1.0, 3.0.2, 3.2.0
>
> Attachments: HDFS-13081.000.patch, HDFS-13081.001.patch, HDFS-13081.002.patch, HDFS-13081.003.patch, HDFS-13081.004.patch, HDFS-13081.005.patch, HDFS-13081.006.patch
>
>
> Datanode#checkSecureConfig currently check the following to determine if secure datanode is enabled.
> # The server has bound to privileged ports for RPC and HTTP via SecureDataNodeStarter.
> # The configuration enables SASL on DataTransferProtocol and HTTPS (no plain HTTP) for the HTTP server.
> Authentication of Datanode RPC server can be done either via SASL handshake or JSVC/privilege RPC port.
> This guarantees authentication of the datanode RPC server before a client transmits a secret, such as a block access token.
> Authentication of the HTTP server can also be done either via HTTPS/SSL or JSVC/privilege HTTP port. This guarantees authentication of datandoe HTTP server before a client transmits a secret, such as a delegation token.
> This ticket is open to allow privileged HTTP as an alternative to HTTPS to work with SASL based RPC protection.
>
> cc: [~cnauroth] , [~daryn], [~jnpandey] for additional feedback.
>
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: hdfs-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: hdfs-issues-help@hadoop.apache.org