You are viewing a plain text version of this content. The canonical link for it is here.
Posted to hdfs-issues@hadoop.apache.org by "Jakob Homan (JIRA)" <ji...@apache.org> on 2010/08/02 04:50:17 UTC
[jira] Created: (HDFS-1326) Provide pluggable mechanism for
securing datanodes
Provide pluggable mechanism for securing datanodes
--------------------------------------------------
Key: HDFS-1326
URL: https://issues.apache.org/jira/browse/HDFS-1326
Project: Hadoop HDFS
Issue Type: New Feature
Components: security
Reporter: Jakob Homan
Assignee: Jakob Homan
As discussed in HDFS-1150, it would be good to allow datanodes to use other methods than jsvc to secure their ports.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (HDFS-1326) Provide pluggable mechanism for
securing datanodes
Posted by "Jakob Homan (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-1326?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12894625#action_12894625 ]
Jakob Homan commented on HDFS-1326:
-----------------------------------
This is for those for whom the jsvc solution doesn't work, as they have access to other methods of securing and verifying that the process running on the datanodes' non-RPC ports really is the datanode. Some options that were brought up on 1150 including Solaris' capabilities to grant user access to privileged ports, or SELinux's ability to restrict who can bind to high ports. I opened this so we can make sure whatever we come up with will work reasonably for as many users as possible. Also, it would be good to maybe get HADOOP-6822 and HADOOP-6823 in some form so that Ops can see what method is running on their cluster.
> Provide pluggable mechanism for securing datanodes
> --------------------------------------------------
>
> Key: HDFS-1326
> URL: https://issues.apache.org/jira/browse/HDFS-1326
> Project: Hadoop HDFS
> Issue Type: New Feature
> Components: security
> Reporter: Jakob Homan
> Assignee: Jakob Homan
>
> As discussed in HDFS-1150, it would be good to allow datanodes to use other methods than jsvc to secure their ports.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (HDFS-1326) Provide pluggable mechanism for
securing datanodes
Posted by "Allen Wittenauer (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-1326?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12894584#action_12894584 ]
Allen Wittenauer commented on HDFS-1326:
----------------------------------------
So is this the JIRA for the rest of the community?
> Provide pluggable mechanism for securing datanodes
> --------------------------------------------------
>
> Key: HDFS-1326
> URL: https://issues.apache.org/jira/browse/HDFS-1326
> Project: Hadoop HDFS
> Issue Type: New Feature
> Components: security
> Reporter: Jakob Homan
> Assignee: Jakob Homan
>
> As discussed in HDFS-1150, it would be good to allow datanodes to use other methods than jsvc to secure their ports.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (HDFS-1326) Provide pluggable mechanism for
securing datanodes
Posted by "Allen Wittenauer (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HDFS-1326?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12894629#action_12894629 ]
Allen Wittenauer commented on HDFS-1326:
----------------------------------------
So in other words, yes.
For Solaris, I think the patch used in HDFS-1150 would work unmodified save two things:
a) need to remove the uid 0 check
b) need to include directions on setting PRIV_NET_PRIVADDR to the HDFS user's role
We could optionally set tcp_extra_priv_ports to include >1024 ports dedicated to HDFS if we didn't want to use a 'real' privileged port.
I suspect SELinux capabilities are configured similarly.
> Provide pluggable mechanism for securing datanodes
> --------------------------------------------------
>
> Key: HDFS-1326
> URL: https://issues.apache.org/jira/browse/HDFS-1326
> Project: Hadoop HDFS
> Issue Type: New Feature
> Components: security
> Reporter: Jakob Homan
> Assignee: Jakob Homan
>
> As discussed in HDFS-1150, it would be good to allow datanodes to use other methods than jsvc to secure their ports.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.