You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@drill.apache.org by br...@apache.org on 2017/03/16 23:47:48 UTC
drill git commit: update security docs with new images
Repository: drill
Updated Branches:
refs/heads/gh-pages 04a17a2db -> 3457d898d
update security docs with new images
Project: http://git-wip-us.apache.org/repos/asf/drill/repo
Commit: http://git-wip-us.apache.org/repos/asf/drill/commit/3457d898
Tree: http://git-wip-us.apache.org/repos/asf/drill/tree/3457d898
Diff: http://git-wip-us.apache.org/repos/asf/drill/diff/3457d898
Branch: refs/heads/gh-pages
Commit: 3457d898dbdbf9b0749eb1d6053bb25eb7b482c7
Parents: 04a17a2
Author: Bridget Bevens <bb...@maprtech.com>
Authored: Thu Mar 16 16:46:04 2017 -0700
Committer: Bridget Bevens <bb...@maprtech.com>
Committed: Thu Mar 16 16:46:04 2017 -0700
----------------------------------------------------------------------
.../020-secure-communication-paths.md | 7 +++----
.../080-configuring-plain-authentication.md | 4 ++--
.../090-configuring-kerberos-auththentication.md | 17 +++++++----------
_docs/img/kerberauthprocess.png | Bin 118447 -> 0 bytes
_docs/img/kerberclientserver.png | Bin 64107 -> 0 bytes
_docs/img/kerberos-auth-process.png | Bin 0 -> 112521 bytes
_docs/img/kerberos-client-server.png | Bin 0 -> 103706 bytes
_docs/img/plain-auth-process.png | Bin 0 -> 97833 bytes
_docs/img/plainauthprocess.png | Bin 95524 -> 0 bytes
_docs/img/secure-communication-paths.png | Bin 0 -> 53406 bytes
_docs/img/securecommunicationpaths.png | Bin 66242 -> 0 bytes
11 files changed, 12 insertions(+), 16 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/drill/blob/3457d898/_docs/configure-drill/securing-drill/020-secure-communication-paths.md
----------------------------------------------------------------------
diff --git a/_docs/configure-drill/securing-drill/020-secure-communication-paths.md b/_docs/configure-drill/securing-drill/020-secure-communication-paths.md
index 9bdc1ee..48f4650 100644
--- a/_docs/configure-drill/securing-drill/020-secure-communication-paths.md
+++ b/_docs/configure-drill/securing-drill/020-secure-communication-paths.md
@@ -1,6 +1,6 @@
---
title: "Secure Communication Paths"
-date: 2017-03-16 03:28:10 UTC
+date: 2017-03-16 23:46:05 UTC
parent: "Securing Drill"
---
As illustrated in the following figure, Drill 1.10 features five secure communication paths. Security features for each communication path are described their respective sections.
@@ -10,10 +10,9 @@ As illustrated in the following figure, Drill 1.10 features five secure communic
1. C++ client to drillbit
1. Java client to drillbit
1. Java client and drillbit to ZooKeeper
-1. Drillbit to storage plugin
-
-
+1. Drillbit to storage plugin
+
## Web Client to Drillbit
http://git-wip-us.apache.org/repos/asf/drill/blob/3457d898/_docs/configure-drill/securing-drill/080-configuring-plain-authentication.md
----------------------------------------------------------------------
diff --git a/_docs/configure-drill/securing-drill/080-configuring-plain-authentication.md b/_docs/configure-drill/securing-drill/080-configuring-plain-authentication.md
index 4e29260..4669237 100644
--- a/_docs/configure-drill/securing-drill/080-configuring-plain-authentication.md
+++ b/_docs/configure-drill/securing-drill/080-configuring-plain-authentication.md
@@ -1,6 +1,6 @@
---
title: "Configuring Plain Authentication"
-date: 2017-03-16 03:28:11 UTC
+date: 2017-03-16 23:46:05 UTC
parent: "Securing Drill"
---
Linux PAM provides a Plain (or username and password) authentication module that interface with any installed PAM authentication entity, such as the local operating system password file (`/etc/passwd`) or LDAP.
@@ -19,7 +19,7 @@ This section includes the following topics:
The following image illustrates the PAM user authentication process in Drill. The client passes a username and password to the drillbit as part of the connection request, which then passes the credentials to PAM. If PAM authenticates the user, the connection request passes the authentication phase and the connection is established. The user will be authorized to access Drill and issue queries against the file system or other storage plugins, such as Hive or HBase.
-
+
If PAM cannot authenticate the user, the connection request will not pass the authentication phase, and the user will not be authorized to access Drill. The connection is terminated as `AUTH_FAILED`.
http://git-wip-us.apache.org/repos/asf/drill/blob/3457d898/_docs/configure-drill/securing-drill/090-configuring-kerberos-auththentication.md
----------------------------------------------------------------------
diff --git a/_docs/configure-drill/securing-drill/090-configuring-kerberos-auththentication.md b/_docs/configure-drill/securing-drill/090-configuring-kerberos-auththentication.md
index ac6f76d..ca4af78 100644
--- a/_docs/configure-drill/securing-drill/090-configuring-kerberos-auththentication.md
+++ b/_docs/configure-drill/securing-drill/090-configuring-kerberos-auththentication.md
@@ -1,6 +1,6 @@
---
title: "Configuring Kerberos Authentication"
-date: 2017-03-16 03:28:12 UTC
+date: 2017-03-16 23:46:06 UTC
parent: "Securing Drill"
---
As of version 1.10, Drill supports Kerberos v5 network security authentication. Kerberos allows trusted hosts to prove their identity over a network to an information system. A Kerberos realm is unique authentication domain. A centralized key distribution center (KDC) coordinates authentication between a clients and servers. Clients and servers obtain and use tickets from the KDC using a special keytab file to communicate with the KDC and prove their identity to gain access to a drillbit. Administrators must create principal (user or server) identities and passwords to ensure the secure exchange of mutual authentication information passed to and from the drillbit.
@@ -34,8 +34,7 @@ This section shows a high-level overview of the client authentication process in
1. The drillbit service has access to the keytab, a file that contains a list of keys for principals. The key allows the service to decrypt the client\u2019s ticket granting service ticket, identify the principal, and grant access.
-
-
+
## Server Authentication Process
For Kerberos server authentication information, see the [MIT Kerberos](http://web.mit.edu/kerberos/ "MIT Kerberos") administration documentation.
@@ -49,10 +48,9 @@ During startup, a drillbit service must authenticate. At runtime, Drill uses the
Drill must run as a user capable of impersonation. The Kerberos provider in the SASL framework maps from the Kerberos identity to an OS user name. Drill impersonates the OS username when running queries.
----
+---
-
-
+
1. Create a Kerberos principal identity and a keytab file. You can create one principal for each drillbit or one principal for all drillbits in a cluster. The drill.keytab file must be owned by and readable by the administrator user.
@@ -69,8 +67,7 @@ Drill must run as a user capable of impersonation. The Kerberos provider in the
# kadmin
: addprinc -randkey <username>/<clustername>@<REALM>.COM
- : ktadd -k /opt/mapr/conf/drill.keytab <username>/<FQDN>@<REALM>.COM
-
+ : ktadd -k /opt/mapr/conf/drill.keytab <username>/<FQDN>@<REALM>.COM
2. Add the Kerberos principal identity and keytab file to the `drill-override.conf` file.
@@ -99,10 +96,10 @@ Drill must run as a user capable of impersonation. The Kerberos provider in the
auth.keytab:"/etc/drill/conf/drill.keytab"
}
}
-
+
3. Restart the drillbit process on each Drill node.
- <DRILLINSTALL_HOME>/bin/drillbit.sh restart
+ <DRILLINSTALL_HOME>/bin/drillbit.sh restart
http://git-wip-us.apache.org/repos/asf/drill/blob/3457d898/_docs/img/kerberauthprocess.png
----------------------------------------------------------------------
diff --git a/_docs/img/kerberauthprocess.png b/_docs/img/kerberauthprocess.png
deleted file mode 100644
index 1c57ede..0000000
Binary files a/_docs/img/kerberauthprocess.png and /dev/null differ
http://git-wip-us.apache.org/repos/asf/drill/blob/3457d898/_docs/img/kerberclientserver.png
----------------------------------------------------------------------
diff --git a/_docs/img/kerberclientserver.png b/_docs/img/kerberclientserver.png
deleted file mode 100644
index 1170144..0000000
Binary files a/_docs/img/kerberclientserver.png and /dev/null differ
http://git-wip-us.apache.org/repos/asf/drill/blob/3457d898/_docs/img/kerberos-auth-process.png
----------------------------------------------------------------------
diff --git a/_docs/img/kerberos-auth-process.png b/_docs/img/kerberos-auth-process.png
new file mode 100644
index 0000000..88a0fea
Binary files /dev/null and b/_docs/img/kerberos-auth-process.png differ
http://git-wip-us.apache.org/repos/asf/drill/blob/3457d898/_docs/img/kerberos-client-server.png
----------------------------------------------------------------------
diff --git a/_docs/img/kerberos-client-server.png b/_docs/img/kerberos-client-server.png
new file mode 100644
index 0000000..0743691
Binary files /dev/null and b/_docs/img/kerberos-client-server.png differ
http://git-wip-us.apache.org/repos/asf/drill/blob/3457d898/_docs/img/plain-auth-process.png
----------------------------------------------------------------------
diff --git a/_docs/img/plain-auth-process.png b/_docs/img/plain-auth-process.png
new file mode 100644
index 0000000..87d5749
Binary files /dev/null and b/_docs/img/plain-auth-process.png differ
http://git-wip-us.apache.org/repos/asf/drill/blob/3457d898/_docs/img/plainauthprocess.png
----------------------------------------------------------------------
diff --git a/_docs/img/plainauthprocess.png b/_docs/img/plainauthprocess.png
deleted file mode 100644
index b788d0a..0000000
Binary files a/_docs/img/plainauthprocess.png and /dev/null differ
http://git-wip-us.apache.org/repos/asf/drill/blob/3457d898/_docs/img/secure-communication-paths.png
----------------------------------------------------------------------
diff --git a/_docs/img/secure-communication-paths.png b/_docs/img/secure-communication-paths.png
new file mode 100644
index 0000000..b8d2e49
Binary files /dev/null and b/_docs/img/secure-communication-paths.png differ
http://git-wip-us.apache.org/repos/asf/drill/blob/3457d898/_docs/img/securecommunicationpaths.png
----------------------------------------------------------------------
diff --git a/_docs/img/securecommunicationpaths.png b/_docs/img/securecommunicationpaths.png
deleted file mode 100644
index df526bb..0000000
Binary files a/_docs/img/securecommunicationpaths.png and /dev/null differ