Before You Begin

• Before enabling TLS/SSL, keystores containing certificates bound to the appropriate domain names will need to be accessible on all hosts on which at least one HDFS, MapReduce, or YARN daemon role is running.
• Since HDFS, MapReduce, and YARN daemons act as TLS/SSL clients as well as TLS/SSL servers, they must have access to truststores. In many cases, the most practical approach is to deploy truststores to all hosts in the cluster, as it may not be desirable to determine in advance the set of hosts on which clients will run.
• Keystores for HDFS, MapReduce and YARN must be owned by the hadoop group, and have permissions 0440 (that is, readable by owner and group). Truststores must have permissions 0444 (that is, readable by all)
• Cloudera Manager supports TLS/SSL configuration for HDFS, MapReduce and YARN at the service level. For each of these services, you must specify absolute paths to the keystore and truststore files. These settings apply to all hosts on which daemon roles of the service in question run. Therefore, the paths you choose must be valid on all hosts.

  An implication of this is that the keystore file names for a given service must be the same on all hosts. If, for example, you have obtained separate certificates for HDFS daemons on hosts node1.example.com and node2.example.com, you might have chosen to store these certificates in files called hdfs-node1.keystore and hdfs-node2.keystore (respectively). When deploying these keystores, you must give them both the same name on the target host — for example, hdfs.keystore.

• Multiple daemons running on a host can share a certificate. For example, in case there is a DataNode and an Oozie server running on the same host, they can use the same certificate.

Configuring TLS/SSL for HDFS

1. Go to the HDFS service.
2. Click the Configuration tab.
3. Select Scope > HDFS (Service-Wide).
4. Select Category > Security.
5. In the Search field, type TLS/SSL to show the TLS/SSL properties (found under the Service-Wide > Security category).
6. Edit the following properties according to your cluster configuration:

   Property	Description
   Hadoop TLS/SSL Server Keystore File Location	Path to the keystore file containing the server certificate and private key.
   Hadoop TLS/SSL Server Keystore File Password	Password for the server keystore file.
   Hadoop TLS/SSL Server Keystore Key Password	Password that protects the private key contained in the server keystore.

7. If you are not using the default truststore, configure TLS/SSL client truststore properties:
     Important: The HDFS properties below define a cluster-wide default truststore that can be overridden by YARN and MapReduce (see the Configuring TLS/SSL for YARN and MapReduce section below).

   Property	Description
   Cluster-Wide Default TLS/SSL Client Truststore Location	Path to the client truststore file. This truststore contains certificates of trusted servers, or of Certificate Authorities trusted to identify servers.
   Cluster-Wide Default TLS/SSL Client Truststore Password	Password for the client truststore file.

8. Cloudera recommends you enable Web UI authentication for the HDFS service.

   Enter web consoles in the Search field to bring up the Enable Authentication for HTTP Web-Consoles property (found under the Service-Wide>Security category). Check the property to enable web UI authentication.

   Enable Authentication for HTTP Web-Consoles

   Enables authentication for Hadoop HTTP web-consoles for all roles of this service.   Note: This is effective only if security is enabled for the HDFS service.

9. Click Save Changes.
10. Follow the procedure described in the following Configuring TLS/SSL for YARN and MapReduce section, at the end of which you will be instructed to restart all the affected services (HDFS, MapReduce and YARN).

Configuring TLS/SSL for YARN and MapReduce