Configuring Mapr Security
Provides usage information for frequently used security functionality, including Access Control Lists (ACLs), Access Control Expressions (ACEs), file permissions, and subnet whitelisting.
Wired encryption and authentication (including impersonation) for the
MapR platform and for all supported ecosystem products are enabled on all new installations
through Installer and through manual installation by running the
configure.sh
command with the
-secure
option.
You can enable security features at any time, but additional configuration is required for the individual components to work with security enabled. This section discusses initial configuration of a secure cluster as well as other forms of security.
The following access control elements are available irrespective of whether you have enabled security features for your cluster. Additionally, once security features are enabled, these elements benefit from encrypted traffic within the cluster and strong authentication to the cluster.
- Access Control Lists (ACLs) for the cluster, the volumes in the cluster, and the MapReduce application queue
- Access Control Expression (ACE)s control user permissions for directories, files, and HPE Ezmeral Data Fabric Database tables that are stored natively
- File permissions for objects in the filesystem layer
- Subnet whitelisting restricts access to the cluster's FileServer service
On clusters with security features enabled, ecosystem components may require additional configuration. For example, Hive functionality has different security requirements depending on the interaction between the HiveServer2 component, the Hive command-line interface, and the Hive metastore.
See the Security Support Matrix for more information about supported security options for Ecosystem components. See the specific Ecosystem component in Ecosystem Components for information on security configuration.
See Security Vulnerabilities for a list of known vulnerabilities.
Verifying if Files Needed for Security are Present
When you run configure.sh
with the -secure
option, the following files are automatically
created in the /opt/mapr/conf
directory. To ensure that security is properly
configured, navigate to the /opt/mapr/conf
directory and verify that the files are
present.
File or Command | Description | Default Secure Setting | Alternate Possible Values/Notes |
---|---|---|---|
/opt/mapr/conf/mapr-clusters.conf maprcli dashboard info -cluster
<clusterName> -json | grep secure |
Master value controlling the cluster's secure or non-secure state. | secure=true |
secure=false disables security on restarting the
cluster. |
sudo passwd -S mapr |
MapR service account | Site Specific Password | No password. Use su to access. |
/opt/mapr/conf/cldb.key |
CLDB key file | Created at install, do not change | Must exist on all CLDB nodes and be identical. |
/opt/mapr/conf/maprserverticket |
Server ticket | Created at install, do not change | Must exist on all cluster nodes and be identical. |
/opt/mapr/conf/mapruserticket |
User ticket | Created at install, do not change | Must exist on all cluster nodes and be identical. This ticket is owned and used by the service account as needed. |
/opt/mapr/conf/ssl_truststore
|
SSL keys | Created at install, and should rarely change. These keys are used by web and REST HTTPS interfaces. | Add site specific certificates with the keytool utility. |
/opt/mapr/conf/mapr.login.conf |
Java (JAAS) authentication service settings | Created at install, do not change | Must exist on all cluster nodes and be identical. |
/opt/mapr/conf/m7_permissions_roles_refimpl.conf |
MapR roles for use with ACEs | Specific roles defined using automation | Use should be deprecated. Linux groups are a much better method, centralized and consistent with enterprise standards. |
/opt/mapr/conf/env.sh |
Default security settings for some MapR services | Created at install, do not change | Must exist on all cluster nodes and be identical. View the list of
settings with the command: |
/opt/mapr/zookeeper/zookeeper-$zkver/conf/zoo.cfg |
Zookeeper security setting | authMech=MAPR-SECURITYauthProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvide |
authMech=SIMPLE-SECURITY |
/opt/mapr/conf/jmxremote.{access,password} |
JMX remote access (debug and metrics monitoring) | read-only and with the password limited to the mapr service
account. |
read-write but is not recommended |
Determining if Wire-Level Security is Enabled Using the CLI
When you run configure.sh
with the -secure
option, wire-level security is automatically enabled at the cluster level. You can, optionally, disable
wire-level security at the individual volume-level. To determine if wire-level security is enabled for a volume, run the following command:
/opt/mapr/bin/maprcli volume list -json |grep wire
This command returns the value of wireSecurity
as 1
if
wire-level security is enabled for the volume; 0
otherwise.
Enabling Cluster Wide Data Access Auditing
To enable auditing data access operations at a cluster level, run:
/opt/mapr/bin/maprcli audit data -enabled
Determining if per Volume Data Access Auditing is Enabled
To determine if auditing data access operations is enabled for a volume, run:
/opt/mapr/bin/maprcli volume info -name <volume_name> -json | grep -i 'audited\|coalesce'
This command returns the value of audited
as 1
if data
access auditing is enabled for the volume; 0
otherwise.