mode. In the simple authorization mode, the HDFS network protocol provides no authentication mechanism, so it
is subject to spoofing by code that can emulate the HDFS client protocol on the internal Urika-GX network. Adding
the Kerberos authentication layer to the HDFS protocol adds strong authentication, but limits use of HDFS to
applications written to use Kerberos with HDFS. HDFS with Kerberos ensures that transactions between user
jobs and HDFS do not permit a user to impersonate any other user while accessing HDFS resources across the
internal networks in the Urika-GX cluster.
Urika-GX's authentication mechanism uses two separate authentication secrets, one for Kerberos and one for
Mesos.
●
Mesos User Secrets and Principals- For Mesos the authentication secret is the secret element of the
principal:secret pair used to authenticate a user's job to Mesos.
●
Kerberos keytabs - To keep the use of Kerberos as transparent as possible, Urika-GX uses special Kerberos
authentication secrets called keytabs, which permit password free authentication of a user to Kerberos within
the cluster. A keytab is a cryptographic token that can be used to obtain Kerberos tickets without the need for
a user to enter a Kerberos password. Similarly to the way Mesos principal/secret pairs are managed by the
Urika-GX Secret Manager, Kerberos keytabs are assigned by the Secret Manager as well when a user is
detected in the authorized user list. Once a keytab has been generated, a user logging into the Urika-GX will
automatically receive a Kerberos session key and all associated tickets for the duration of their session
without needing to enter a Kerberos password. Until the user has a keytab, however, the user will not have
access to HDFS. Kerberos is only used in the Urika-GX secure service mode.
Both of these secrets are user specific and both of them are stored in files for use by their respective
mechanisms.
7.2
Urika-GX Service Modes
Urika-GX features application and data security for a number of applications. Many security mechanisms play a
role in the overall security architecture to ensure the system is protected against unauthorized access.
●
Default Mode - All the installed analytic applications are available under the default service mode.
Applications are configured with basic security levels wherever possible, though certain applications may
provide no security features. More specifically, HDFS runs using its simple authentication mode under the
default service mode.
●
Secure Mode - Urika-GX uses Kerberos authentication while running under the secure mode. Only a limited
number of analytic applications are available under this mode and those applications are configured to run in
a secure configuration, the exact details of which vary by application. Typically, this means that applications
that interact with HDFS require valid Kerberos credentials. Moreover, user interfaces are either disabled or
require authentication under this mode.
CAUTION: If the Urika GX system is running in the secure mode, Cray does not recommend toggling
back to the default mode while in production. In the default service mode, the security assurances
provided by secure service mode are not in place and the security of data that was protected by secure
mode may be compromised while running in the default mode. Cray cannot extend the secure mode
security assurances to any system that has run in a production state in the default mode until that system
has been fully re-deployed.
Security
S3016
177
