[
https://issues.apache.org/jira/browse/HDDS-17613?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Siyao Meng updated HDDS-17613:
------------------------------
Status: Patch Available (was: Open)
> Accept Datanode protocols only from the Datanode principal with service
> authorization
> -------------------------------------------------------------------------------------
>
> Key: HDDS-17613
> URL: https://issues.apache.org/jira/browse/HDDS-17613
> Project: Apache Ozone
> Issue Type: Improvement
> Components: Security
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
> Labels: pull-request-available
>
> With {{hadoop.security.authorization}} enabled,
> {{StorageContainerDatanodeProtocol}} (SCM) and {{ReconDatanodeProtocol}}
> (Recon) accept any principal allowed by their service ACL. HDFS
> {{DatanodeProtocol}} also sets {{clientPrincipal =
> dfs.datanode.kerberos.principal}} in its {{@KerberosInfo}}, so the NameNode
> accepts that protocol only from the DataNode principal.
> Add {{clientPrincipal = hdds.datanode.kerberos.principal}} to the
> {{@KerberosInfo}} of both protocols.
> This only takes effect with Kerberos and
> {{hadoop.security.authorization=true}}. Hadoop resolves {{_HOST}} in the
> principal from the caller's address and requires an exact match, so a
> Datanode that reaches SCM or Recon under a different hostname than the one in
> its principal is rejected.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
