I guess, I forgot to restart namenode after changes. It is working fine now. Apologies for the spam.
Thanks Pallavi ----- Original Message ----- From: "Pallavi Palleti" <pallavi.pall...@corp.aol.com> To: common-user@hadoop.apache.org Sent: Friday, July 24, 2009 6:45:02 PM GMT +05:30 Chennai, Kolkata, Mumbai, New Delhi Subject: Re: Remote access to cluster using user as hadoop Hi all, I tried to trackdown to the place where I can add some conditions for not allowing any remote user with username as hadoop(root user) (other than some specific hostnames or ipaddresses). I could see the call path as FsShell -> DistributedFileSystem ->DFSClient - ClientProtocol. As there is no way to debug the code via eclipse (when I ran thru eclipse it points to LocalFileSystem), I followed naive way of debugging by adding print commands. After DFSClient, I couldn't figure out which Class is getting called. From the code, I could see only NameNode extended ClientProtocol, so I was pretty sure that NameNode methods are getting called, but I coudln't see my debug print statements in the logs when I added some print statements in the namenode. Can some one help me what is the flow when a call from Remote machine with same root user name(hadoop) is made? I tried for mkdir command which essentially calls mkdirs() method in DFSClient and there by ClientProtocol mkdirs() method. Thanks Pallavi ----- Original Message ----- From: "Ted Dunning" <ted.dunn...@gmail.com> To: common-user@hadoop.apache.org Sent: Friday, July 24, 2009 6:22:12 AM GMT +05:30 Chennai, Kolkata, Mumbai, New Delhi Subject: Re: Remote access to cluster using user as hadoop Interesting approach. My guess is that this would indeed protect the datanodes from accidental "attack" by stopping access before they are involved. You might also consider just changing the name of the magic hadoop user to something that is more unlikely. The name "hadoop" is not far off what somebody might come up with as a user name for experimenting or running scheduled jobs. On Thu, Jul 23, 2009 at 3:28 PM, Ian Holsman <li...@holsman.net> wrote: > I was thinking of alternatives similar to creating a proxy nameserver that > non-privileged users can attach to that forwards those to the "real" > nameserver or just hacking the nameserver so that it switches "hadoop" to > "hadoop_remote" for sessions from untrusted IP's. > > not being familiar with the code, I am presuming that there is a point > where the code determines the userID. can anyone point me to that bit? > I just want to hack it to downgrade superusers, and it doesn't have to be > too clean or work for every edge case. it's more to stop accidental > problems. > -- Ted Dunning, CTO DeepDyve
