This is the documentation for Cloudera Enterprise 5.8.x. Documentation for other versions is available at Cloudera Documentation.

Configuring Encrypted HDFS Data Transport

This topic describes how to configure encrypted HDFS data transport using both, Cloudera Manager, and the command line.

You must enable Kerberos before configuring encrypted HDFS data transport. See Configuring Authentication for instructions.

Using Cloudera Manager

Minimum Required Role: Full Administrator

To enable encryption of data transferred between DataNodes and clients, and among DataNodes, proceed as follows:
  1. Enable Hadoop security using Kerberos.
  2. Select the HDFS service.
  3. Click the Configuration tab.
  4. Select Scope > HDFS (Service Wide)
  5. Select Category > Security.
  6. Configure the following properties: (You can type the property name in the Search box to locate the property.)
    Property Description
    Enable Data Transfer Encryption Check this field to enable wire encryption.
    Data Transfer Encryption Algorithm Optionally configure the algorithm used to encrypt data.
    Hadoop RPC Protection Select privacy.
  7. Click Save Changes.
  8. Restart the HDFS service.

Using the Command Line

  Important:
  • You can use either Cloudera Manager or the following command-line instructions to complete this configuration.
  • This information applies specifically to CDH 5.8.x. If you use an earlier version of CDH, see the documentation for that version located at Cloudera Documentation.

To enable encrypted data transport using the command line, proceed as follows:

  1. Enable Kerberos authentication, following these instructions.
  2. Set the optional RPC encryption by setting hadoop.rpc.protection to "privacy" in the core-site.xml file in both client and server configurations.
      Note:

    If RPC encryption is not enabled, transmission of other HDFS data is also insecure.

  3. Set dfs.encrypt.data.transfer to true in the hdfs-site.xml file on all server systems.
  4. Restart all daemons.
Page generated July 8, 2016.