[ 
https://issues.apache.org/jira/browse/AMBARI-18836?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15702608#comment-15702608
 ] 

Robert Levas edited comment on AMBARI-18836 at 11/28/16 5:41 PM:
-----------------------------------------------------------------

[~Wancy]..

I commited the update to the trunk:

{noformat}
commit cad0130d9d4a64a6bda1992758c5c7c05e06b39e
Author: Shi Wang <cntj...@gmail.com>
Date:   Mon Nov 28 12:39:05 2016 -0500
{noformat}



was (Author: rlevas):
[~Wancy]..

I commit the update to the trunk:

{noformat}
commit cad0130d9d4a64a6bda1992758c5c7c05e06b39e
Author: Shi Wang <cntj...@gmail.com>
Date:   Mon Nov 28 12:39:05 2016 -0500
{noformat}


> Remove group readable from hdfs headless keytab
> -----------------------------------------------
>
>                 Key: AMBARI-18836
>                 URL: https://issues.apache.org/jira/browse/AMBARI-18836
>             Project: Ambari
>          Issue Type: Bug
>    Affects Versions: trunk
>            Reporter: Shi Wang
>            Assignee: Shi Wang
>             Fix For: trunk
>
>         Attachments: 
> 0001-AMBARI-18836-Remove-group-readable-from-hdfs-headles.patch, 
> AMBARI-18836-test_failure.patch
>
>
> The Smoke and “Headless” Service users are used by Ambari to perform service 
> “smoke” checks and run alert health checks. 
> The permission for hdfs.headless.keytab is 440. But it will cause security 
> concern to allow other service user in hadoop group to kinit hdfs headless 
> principal using hdfs.headless.keytab. In this way, other service user could 
> "pretend" to be hdfs user and be granted hdfs user's authorities.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Reply via email to