-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/53629/
-----------------------------------------------------------
(Updated Nov. 10, 2016, 6:49 a.m.)
Review request for Ambari, Andrew Onischuk, Laszlo Puskas, and Robert Levas.
Bugs: AMBARI-18836
https://issues.apache.org/jira/browse/AMBARI-18836
Repository: ambari
Description
-------
The Smoke and “Headless” Service users are used by Ambari to perform service
“smoke” checks and run alert health checks.
The permission for hdfs.headless.keytab is 440. But it will cause security
concern to allow other service user in hadoop group to kinit hdfs headless
principal using hdfs.headless.keytab. In this way, other service user could
"pretend" to be hdfs user and be granted hdfs user's authorities.
Diffs
-----
ambari-server/src/main/resources/common-services/HDFS/2.1.0.2.0/kerberos.json
3d6e25c
ambari-server/src/main/resources/common-services/HIVE/0.12.0.2.0/package/scripts/webhcat.py
816b6af
Diff: https://reviews.apache.org/r/53629/diff/
Testing
-------
Hi Robert,
What will be your opinion on this?
Is it necessary to set 440 permission to hdfs headless keytab? The kinit hdfs
headless principal operation for webhcat seems useless, I kdestroy the hdfs
ticket for hcat user and hive service check/start/stop all works fine. Is there
any other tests I should try? Thanks.
Thanks,
Shi Wang
