Siyao Meng created HDDS-17613:
---------------------------------
Summary: Accept Datanode protocols only from the Datanode
principal with service authorization
Key: HDDS-17613
URL: https://issues.apache.org/jira/browse/HDDS-17613
Project: Apache Ozone
Issue Type: Improvement
Components: Security
Reporter: Siyao Meng
With {{hadoop.security.authorization}} enabled,
{{StorageContainerDatanodeProtocol}} (SCM) and {{ReconDatanodeProtocol}}
(Recon) accept any principal allowed by their service ACL. HDFS
{{DatanodeProtocol}} also sets {{clientPrincipal =
dfs.datanode.kerberos.principal}} in its {{@KerberosInfo}}, so the NameNode
accepts that protocol only from the DataNode principal.
Add {{clientPrincipal = hdds.datanode.kerberos.principal}} to the
{{@KerberosInfo}} of both protocols.
This only takes effect with Kerberos and
{{hadoop.security.authorization=true}}. Hadoop resolves {{_HOST}} in the
principal from the caller's address and requires an exact match, so a Datanode
that reaches SCM or Recon under a different hostname than the one in its
principal is rejected.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
