【配置/认证】Authentication for Hadoop（3.3.1） HTTP web-consoles : Hadoop的simple认证 不是银弹

文章目录一. Introduction二. Configuration1. 在每一个hadoop节点配置core-site.xml2.创建密钥3. 重启 hadoop 集群4. 访问示例三、不是银弹解决方案一解决方案二-自定义插件ing官网Authentication for Hadoop HTTP web-consoles一. Introduction可以通过Kerberos、Pseudo或Simple能够实现web页面的安全设置。本文通过使用user.name的Simple方式实现web页面的安全设置http://localhost:8088/cluster?user.namebabu.此外我们还可以自定义一个插件实现自己的安全机制参考AuthenticationHandlerBy default Hadoop HTTP web-consoles (ResourceManager,NameNode, NodeManagers and DataNodes) allow access without any form of authentication.Hadoop HTTP web-consoles can be configured to require Kerberosauthentication using HTTP SPNEGO protocol (supported by browsers like Firefox and Internet Explorer).In addition, Hadoop HTTP web-consoles support the equivalent ofHadoop’s Pseudo/Simple authentication. If this option is enabled, theuser name must be specified in the first browser interaction using theuser.name query string parameter. e.g.http://localhost:8088/cluster?user.namebabu.If acustomauthentication mechanism is required for the HTTPweb-consoles, it is possible to implement aplugin to support thealternate authentication mechanism(refer to Hadoop hadoop-auth fordetails on writing an AuthenticationHandler).二. Configuration1. 在每一个hadoop节点配置core-site.xmlThe following properties should be in the core-site.xml of all the nodes in the cluster.configuration......//此处省略已有配置!-- Authentication for Hadoop HTTP web-consoles --propertynamehadoop.http.filter.initializers/namevalueorg.apache.hadoop.security.AuthenticationFilterInitializer/value/propertypropertynamehadoop.http.authentication.type/namevaluesimple/value/propertypropertynamehadoop.http.authentication.token.validity/namevalue3600/value/propertypropertynamehadoop.http.authentication.signature.secret.file/namevalue/data/app/hadoop/etc/hadoop/secret/hadoop-http-auth-signature-secret/value/propertypropertynamehadoop.http.authentication.cookie.domain/namevalue/value/propertypropertynamehadoop.http.authentication.simple.anonymous.allowed/namevaluefalse/value/property/configuration2.创建密钥//在每个hadoop 节点都操作mkdir-p/data/app/hadoop/etc/hadoop/secret cd/data/app/hadoop/etc/hadoop/secret echo \hadoop\hadoop-http-auth-signature-secret3. 重启 hadoop 集群# 关闭hadoop 集群 cd/data/app/hadoop./sbin/stop-dfs.sh./sbin/stop-yarn.sh # 启动hadoop 集群 cd/data/app/hadoop./sbin/start-dfs.sh./sbin/start-yarn.sh4. 访问示例http://namenode_ip:18137 出现错误 http://namenode_ip:18137?user.namehadoop 访问正确三、不是银弹简单的说hadoop的simple认证的密钥文件并没有起作用输入任何认证例如http://namenode_ip:18137?user.namexxxx都可以进入hadoop界面。解决方案一详见其他博主博文Hadoop Web 控制台安全认证——使用用户名 密码登陆设置方法 Hadoop HTTP web-控制台认证 但似乎tengine要和管理节点namenode和resourcemanager放到一个位置方案有待完善。解决方案二-自定义插件ing此外我们还可以自定义一个插件实现自己的安全机制参考AuthenticationHandler