[
https://issues.apache.org/jira/browse/HADOOP-14295?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15965343#comment-15965343
]
Yuanbo Liu commented on HADOOP-14295:
-------------------------------------
[~jeffreyr97] Thanks for filing this JIRA and good summary.
[~jojochuang] Thanks for looking into this JIRA.
Wei-chui, If you look into {{DatanodeHttpServer.java}}, you can find that it
uses a Netty to set up a internal proxy server. I also take a look at the http
server in NameNode, there is no such kind of proxy server. So getRemoteAddr
doesn't work as expected if users access some links in Datanode. Hope this info
can help you get the background of this JIRA.
The patch from Jeff looks nice and we've tested it in our personal cluster.
After Wei-chui's comments are addressed, I'm +1(no-binding) for your patch.
> Authentication proxy filter on firewall cluster may fail authorization
> because of getRemoteAddr
> -----------------------------------------------------------------------------------------------
>
> Key: HADOOP-14295
> URL: https://issues.apache.org/jira/browse/HADOOP-14295
> Project: Hadoop Common
> Issue Type: Bug
> Components: common
> Affects Versions: 2.7.4, 3.0.0-alpha2, 2.8.1
> Reporter: Jeffrey E Rodriguez
> Assignee: Jeffrey E Rodriguez
> Priority: Critical
> Fix For: 3.0.0-alpha2
>
> Attachments: hadoop-14295.001.patch
>
>
> Many production environments use firewalls to protect network traffic. In the
> specific case of DataNode UI and other Hadoop server for which their ports
> may fall on the list of firewalled ports the
> org.apache.hadoop.security.AuthenticationWithProxyUserFilter user getRemotAdd
> (HttpServletRequest) which may return the firewall host such as 127.0.0.1.
> This is unfortunately bad since if you are using a proxy in addition to do
> perimeter protection, and you have added your proxy as a super user when
> checking for the proxy IP to authorize user this would fail since
> getRemoteAdd would return the IP of the firewall (127.0.0.1).
> "2017-04-08 07:01:23,029 ERROR security.AuthenticationWithProxyUserFilter
> (AuthenticationWithProxyUserFilter.java:getRemoteUser(94)) - Unable to verify
> proxy user: Unauthorized connection for super-user: knox from IP 127.0.0.1"
> I propese to add a check for x-forwarded-for header since proxys usually
> inject that header before we do a getRemoteAddr
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-issues-h...@hadoop.apache.org
