Configuring Mapr Security

Provides usage information for frequently used security functionality, including Access Control Lists (ACLs), Access Control Expressions (ACEs), file permissions, and subnet whitelisting.

Note: MapR 6.1 makes it easier to secure new MapR installations. See Using the Enable Secure Cluster Option in the Installer.

Wired encryption and authentication (including impersonation) for the MapR platform and for all supported ecosystem products are enabled on all new installations through Installer and through manual installation by running the configure.sh command with the -secure option.

You can enable security features at any time, but additional configuration is required for the individual components to work with security enabled. This section discusses initial configuration of a secure cluster as well as other forms of security.

The following access control elements are available irrespective of whether you have enabled security features for your cluster. Additionally, once security features are enabled, these elements benefit from encrypted traffic within the cluster and strong authentication to the cluster.

Access Control Lists (ACLs) for the cluster, the volumes in the cluster, and the MapReduce application queue
Access Control Expression (ACE)s control user permissions for directories, files, and HPE Ezmeral Data Fabric Database tables that are stored natively
File permissions for objects in the filesystem layer
Subnet whitelisting restricts access to the cluster's FileServer service

On clusters with security features enabled, ecosystem components may require additional configuration. For example, Hive functionality has different security requirements depending on the interaction between the HiveServer2 component, the Hive command-line interface, and the Hive metastore.

See the MapR Security Support Matrix for more information about supported security options for Ecosystem components. See the specific Ecosystem component in Ecosystem Components for information on security configuration.

See Security Vulnerabilities for a list of known vulnerabilities.

Verifying if Files Needed for Security are Present

When you run configure.sh with the -secure option, the following files are automatically created in the /opt/mapr/conf directory. To ensure that security is properly configured, navigate to the /opt/mapr/conf directory and verify that the files are present.

File or Command	Description	Default Secure Setting	Alternate Possible Values/Notes
`/opt/mapr/conf/mapr-clusters.conf` `maprcli dashboard info -cluster <clusterName> -json \| grep secure`	Master value controlling the cluster's secure or non-secure state.	`secure=true`	`secure=false` disables security on restarting the cluster.
`sudo passwd -S mapr`	MapR service account	Site Specific Password	No password. Use `su` to access.
`/opt/mapr/conf/cldb.key`	CLDB key file	Created at install, do not change	Must exist on all CLDB nodes and be identical.
`/opt/mapr/conf/maprserverticket`	Server ticket	Created at install, do not change	Must exist on all cluster nodes and be identical.
`/opt/mapr/conf/mapruserticket`	User ticket	Created at install, do not change	Must exist on all cluster nodes and be identical. This ticket is owned and used by the service account as needed.
`/opt/mapr/conf/ssl_truststore` `/opt/mapr/conf/ssl_keystore`	SSL keys	Created at install, and should rarely change. These keys are used by web and REST HTTPS interfaces.	Add site specific certificates with the keytool utility.
`/opt/mapr/conf/mapr.login.conf`	Java (JAAS) authentication service settings	Created at install, do not change	Must exist on all cluster nodes and be identical.
`/opt/mapr/conf/m7_permissions_roles_refimpl.conf`	MapR roles for use with ACEs	Specific roles defined using automation	Use should be deprecated. Linux groups are a much better method, centralized and consistent with enterprise standards.
`/opt/mapr/conf/env.sh`	Default security settings for some MapR services	Created at install, do not change	Must exist on all cluster nodes and be identical. View the list of settings with the command: `grep -i secure env.sh`
`/opt/mapr/zookeeper/zookeeper-$zkver/conf/zoo.cfg`	Zookeeper security setting	`authMech=MAPR-SECURITYauthProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvide`	`authMech=SIMPLE-SECURITY`
`/opt/mapr/conf/jmxremote.{access,password}`	JMX remote access (debug and metrics monitoring)	`read-only` and with the password limited to the mapr service account.	`read-write` but is not recommended

Determining if Wire-Level Security is Enabled Using the CLI

When you run configure.sh with the -secure option, wire-level security is automatically enabled at the cluster level. You can, optionally, disable wire-level security at the individual volume-level. To determine if wire-level security is enabled for a volume, run the following command:

/opt/mapr/bin/maprcli volume list -json |grep wire

This command returns the value of wireSecurity as 1 if wire-level security is enabled for the volume; 0 otherwise.

Enabling Cluster Wide Data Access Auditing

To enable auditing data access operations at a cluster level, run:

/opt/mapr/bin/maprcli audit data -enabled

Determining if per Volume Data Access Auditing is Enabled

To determine if auditing data access operations is enabled for a volume, run:

/opt/mapr/bin/maprcli volume info -name <volume_name> -json | grep -i 'audited\|coalesce'

This command returns the value of audited as 1 if data access auditing is enabled for the volume; 0 otherwise.