Re: trojan in hadoop-2.7.6.tar.gz!?

2018-07-05 Thread Jeff Hubbs
Doesn't even have to be open to the Internet; even interoffice LANs or especially academic ones should always be considered hostile. My cluster is on a captive LAN with a single "edge node" that's dual-homed and doesn't run daemons. I ran some tests today and it turns out that my yarn, hdfs, a

Re: trojan in hadoop-2.7.6.tar.gz!?

2018-07-05 Thread Sandeep Nemuri
Is this cluster open to internet? we've seen few clusters which are open to internet are affected to this attack. On Thu, Jul 5, 2018 at 8:32 PM Cliff Mattern < clifford.matt...@alphacarina.de> wrote: > Dear all, > > we downloaded > http://www.apache.org/dyn/closer.cgi/hadoop/common/hadoop-2.7.6

Re: trojan in hadoop-2.7.6.tar.gz!?

2018-07-05 Thread Sean Busbey
For folks on this list, please see the response I sent when this message came in on the yarn-dev@hadoop mailing list: https://s.apache.org/nO7O On Fri, Jun 29, 2018 at 7:46 AM, Cliff Mattern wrote: > Dear all, > > we downloaded > http://www.apache.org/dyn/closer.cgi/hadoop/common/hadoop-2.7.6/h

Re: trojan in hadoop-2.7.6.tar.gz!?

2018-07-05 Thread István Fajth
Hi Cliff, this issue pops up a few questions... - Have you set up kerberos authentication? - Have you installed the jars on a machine that is having a public internet address? I assume so, so the second question is whether you have set up any firewall rules to prevent unwanted access to YARN port

trojan in hadoop-2.7.6.tar.gz!?

2018-07-05 Thread Cliff Mattern
Dear all, we downloaded http://www.apache.org/dyn/closer.cgi/hadoop/common/hadoop-2.7.6/hadoop-2.7.6.tar.gz and install the unpacked files as described. The md5 check was correct. After few days we found in the log files of YARN following entries: 2018-06-29 05:37:21,490 INFO org.apache.hadoop