MapR 5.1 is at End of Life (EOL) and no longer supported. Please see the latest documentation. This documentation is not being updated.

Home
5.1 Administration
This section contains administration information such as managing your cluster, data, users, jobs and security information such as configuring your security environment and auditing.
Security Guide
Configuring MapR Security
Describes how to enable security features and configure the components on a secure cluster.
Enabling and Disabling Security Features on Your Cluster
Describes how to enable and disable wire-level security on the nodes of your cluster.
Generating Certificates After Initial Installation
Describes how to generate a ssl_keystore file during or after initial installation.

MapR 5.1 Documentation

5.1 Administration
This section contains administration information such as managing your cluster, data, users, jobs and security information such as configuring your security environment and auditing.
- Administrator Guide
- Security Guide
  - Security Overview
    Describes the security features of the MapR Converged Data Platform.
  - Security Architecture
    Describes the default security architecture and additional authentication and encryption capabilities.
  - Logging into a Secure Cluster
    Describes how to use tickets to access a secure MapR cluster.
  - Tickets and Certificates
    Describes how tickets and certificates authenticate users and servers to a cluster.
  - Getting Started with MapR Security
    Describes the two core scenarios that allow quick implementation of security features.
  - Configuring MapR Security
    Describes how to enable security features and configure the components on a secure cluster.
    - Enabling and Disabling Security Features on Your Cluster
      Describes how to enable and disable wire-level security on the nodes of your cluster.
      - Generating Certificates After Initial Installation
        Describes how to generate a ssl_keystore file during or after initial installation.
      - System Behavior Changes After Enabling Security
        Describes the authentication, communication, and encryption changes that take place after enabling security.
    - Configuring Impersonation
      Describes how to use impersonation to centralize control over user actions.
    - Running Commands on Remote Secure Clusters
      Describes how to manage multiple secure clusters from one secure cluster.
    - Adding Cross-Cluster Tickets to Secure Clusters
      Describes how to add cross-cluster tickets to secure clusters that push and pull data.
    - PAM Configuration
      Describes how to use PAM to verify passwords.
    - Secured TaskTracker
      Describes how to control user access to TaskTracker.
    - Access Control Lists
      Describes how to create different types of ACLs.
    - Access Control Expressions
      Describes how to use ACEs to control user permissions for MapR-DB tables.
    - Permissions
      Describes requirements for API user permissions and file permissions.
    - Securing Open Source Components
      Describes how to use JAAS to configure security for open source components.
    - Configuring Kerberos User Authentication
      Describes how to configure Kerberos for the CLDB.
    - Mirror Volumes and Secure Clusters
      Describes how to configure security for the source and destination clusters of a mirror.
    - Configuring a MapR Cluster to Access a HDFS Cluster
      Describes how to create a connection between a MapR cluster and an HDFS cluster.
  - Auditing of Cluster Administration and Operations on Directories, Files, Tables, and Streams
    Describes how to process and use audit records to improve data analysis.

Generating Certificates After Initial Installation

Describes how to generate a ssl_keystore file during or after initial installation.

When you run the configure.sh script at initial installation, but do not specify the -genkeys option, the script generates a ssl_keystore file for use by the web server for the MapR Control system. When the configure.sh script is run with the -genkeys option after initial installation, the system detects the existing ssl_keystore file and exits with an error to prevent inadvertent deletion or reuse of the ssl_keystore file. The error message will look similar to the following example:

/opt/mapr/server/configure.sh
-secure -genkeys -C $CLDB_GRP -Z $ZK_GRP -RM $RM -HS
$HISTORYSERVER
<hostname1>: Configuring Hadoop-2.x at
/opt/mapr/hadoop/hadoop-2.x
<hostname1>: Done configuring Hadoop
<hostname1>: CLDB node list:
<hostname1>:7222,<hostname2>:7222,<hostname3>:7222

<hostname1>: Zookeeper node
list: <hostname1>:5181,<hostname2>:5181,<hostname3>:5181

<hostname1>: Node setup configuration: cldb fileserver
historyserver nfs nodemanager resourcemanager webserver
zookeeper
<hostname1>: Log can be found at:
/opt/mapr/logs/configure.log
<hostname1>: /opt/mapr/conf/ssl_keystore already exists
<hostname1>: ERROR: could not generate ssl keys. See log file
for more details
clush: <hostname1>: exited with exit code 1

On clusters without security features enabled, the contents of the ssl_keystore file are unique to each node. In this case, manually delete the ssl_keystore file on each node, then run the command configure.sh -genkeys.

On clusters where you have customized the contents of the ssl_keystore file, run the command configure.sh -genkeys -nocerts to preserve your customizations.

For general information on security tickets and certificates, see Tickets and Certificates.