Configuring Mapr Security

Provides usage information for frequently used security functionality, including Access Control Lists (ACLs), Access Control Expressions (ACEs), file permissions, and subnet whitelisting.

Note: MapR 6.1 makes it easier to secure new MapR installations. See Using the Enable MapR Secure Cluster Option in the MapR Installer.

Wired encryption and authentication (including impersonation) for the MapR platform and for all supported ecosystem products are enabled on all new installations through MapR Installer and through manual installation by running the configure.sh command with the -secure option.

You can enable security features at any time, but additional configuration is required for the individual components to work with security enabled. This section discusses initial configuration of a secure cluster as well as other forms of security.

The following access control elements are available irrespective of whether you have enabled security features for your cluster. Additionally, once security features are enabled, these elements benefit from encrypted traffic within the cluster and strong authentication to the cluster.

  • Access Control Lists (ACLs) for the cluster, the volumes in the cluster, and the MapReduce application queue
  • Access Control Expression (ACE)s control user permissions for directories, files, and MapR Database tables that are stored natively
  • File permissions for objects in the MapR Filesystem layer
  • Subnet whitelisting restricts access to the cluster's FileServer service

On clusters with security features enabled, ecosystem components may require additional configuration. For example, Hive functionality has different security requirements depending on the interaction between the HiveServer2 component, the Hive command-line interface, and the Hive metastore.

See the MapR Security Support Matrix for more information about supported security options for Ecosystem components. See the specific Ecosystem component in Ecosystem Components for information on security configuration.

See Security Vulnerabilities for a list of known vulnerabilities.

Verifying if Files Needed for Security are Present

When you run configure.sh with the -secure option, the following files are automatically created in the /opt/mapr/conf directory. To ensure that security is properly configured, navigate to the /opt/mapr/conf directory and verify that the files are present.

File or Command Description Default Secure Setting Alternate Possible Values/Notes
/opt/mapr/conf/mapr-clusters.conf

maprcli dashboard info -cluster <clusterName> -json | grep secure
Master value controlling the cluster's secure or non-secure state. secure=true secure=false disables security on restarting the cluster.
sudo passwd -S mapr MapR service account Site Specific Password No password. Use su to access.
/opt/mapr/conf/cldb.key CLDB key file Created at install, do not change Must exist on all CLDB nodes and be identical.
/opt/mapr/conf/maprserverticket Server ticket Created at install, do not change Must exist on all cluster nodes and be identical.
/opt/mapr/conf/mapruserticket User ticket Created at install, do not change Must exist on all cluster nodes and be identical.

This ticket is owned and used by the service account as needed.

/opt/mapr/conf/ssl_truststore

/opt/mapr/conf/ssl_keystore

SSL keys Created at install, and should rarely change. These keys are used by web and REST HTTPS interfaces. Add site specific certificates with the keytool utility.
/opt/mapr/conf/mapr.login.conf Java (JAAS) authentication service settings Created at install, do not change Must exist on all cluster nodes and be identical.
/opt/mapr/conf/m7_permissions_roles_refimpl.conf MapR roles for use with ACEs Specific roles defined using automation Use should be deprecated. Linux groups are a much better method, centralized and consistent with enterprise standards.
/opt/mapr/conf/env.sh Default security settings for some MapR services Created at install, do not change Must exist on all cluster nodes and be identical.

View the list of settings with the command: grep -i secure env.sh

/opt/mapr/zookeeper/zookeeper-$zkver/conf/zoo.cfg Zookeeper security setting authMech=MAPR-SECURITYauthProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvide authMech=SIMPLE-SECURITY
/opt/mapr/conf/jmxremote.{access,password} JMX remote access (debug and metrics monitoring) read-only and with the password limited to the mapr service account. read-write but is not recommended

Determining if Wire-Level Security is Enabled Using the CLI

When you run configure.sh with the -secure option, wire-level security is automatically enabled at the cluster level. You can, optionally, disable wire-level security at the individual volume-level. To determine if wire-level security is enabled for a volume, run the following command:

/opt/mapr/bin/maprcli volume list -json |grep wire

This command returns the value of wireSecurity as 1 if wire-level security is enabled for the volume; 0 otherwise.

Enabling Cluster Wide Data Access Auditing

To enable auditing data access operations at a cluster level, run:

/opt/mapr/bin/maprcli audit data -enabled

Determining if per Volume Data Access Auditing is Enabled

To determine if auditing data access operations is enabled for a volume, run:

/opt/mapr/bin/maprcli volume info -name <volume_name> -json | grep -i 'audited\|coalesce'

This command returns the value of audited as 1 if data access auditing is enabled for the volume; 0 otherwise.