文章来源：加米谷大数据

在hbase-2.x之后，默认的“hbase.security.authorization”发生了变化。在hbase-2.x之前，它默认为true，在后来的HBase版本中，默认值变为false。因此，要启用hbase授权，必须在hbase-site.xml中配置以下属性：

1<property>
2<name>hbase.security.authorization</name>   
3<value>true</value> 
4</property>

此配置示例包括对HFile v3，ACL，可见性标签以及对静态数据和WAL的透明加密的支持。所有选项已在上面的文章中单独讨论。

示例：hbase-site.xml中的安全设置示例

<!-- HFile v3 Support --> 
<property>
   <name>hfile.format.version</name>   
   <value>3</value> 
</property> 
<!-- HBase Superuser --> 
<property>
   <name>hbase.superuser</name>   
   <value>hbase, admin</value> 
</property> 
<!-- Coprocessors for ACLs and Visibility Tags --> 
<property>
   <name>hbase.security.authorization</name>   
   <value>true</value> 
</property> 
<property>
   <name>hbase.coprocessor.region.classes</name>   
   <value>org.apache.hadoop.hbase.security.access.AccessController,   
   org.apache.hadoop.hbase.security.visibility.VisibilityController,   
   org.apache.hadoop.hbase.security.token.TokenProvider</value> 
</property> 
<property>
   <name>hbase.coprocessor.master.classes</name>   
   <value>org.apache.hadoop.hbase.security.access.AccessController,   
   org.apache.hadoop.hbase.security.visibility.VisibilityController</value> 
</property> 
<property>
   <name>hbase.coprocessor.regionserver.classes</name>   
   <value>org.apache.hadoop/hbase.security.access.AccessController,   
   org.apache.hadoop.hbase.security.access.VisibilityController</value> 
</property> 
<!-- Executable ACL for Coprocessor Endpoints --> 
<property>
   <name>hbase.security.exec.permission.checks</name>   
   <value>true</value> 
</property> 
<!-- Whether a user needs authorization for a visibility tag to set it on a cell --> 
<property>
   <name>hbase.security.visibility.mutations.checkauth</name>   
   <value>false</value> 
</property> 
<!-- Secure RPC Transport --> 
<property>
   <name>hbase.rpc.protection</name>   
   <value>privacy</value>  
 </property>  
 <!-- Transparent Encryption --> 
 <property>
    <name>hbase.crypto.keyprovider</name>   
    <value>org.apache.hadoop.hbase.io.crypto.KeyStoreKeyProvider</value> 
</property> 
<property>
   <name>hbase.crypto.keyprovider.parameters</name>   
   <value>jceks:///path/to/hbase/conf/hbase.jks?password=***</value> 
</property> 
<property>
   <name>hbase.crypto.master.key.name</name>   
   <value>hbase</value> 
</property> 
<!-- WAL Encryption --> 
<property>
   <name>hbase.regionserver.hlog.reader.impl</name>   
   <value>org.apache.hadoop.hbase.regionserver.wal.SecureProtobufLogReader</value> 
</property> 
<property>
   <name>hbase.regionserver.hlog.writer.impl</name>   
   <value>org.apache.hadoop.hbase.regionserver.wal.SecureProtobufLogWriter</value> 
</property> 
<property>
   <name>hbase.regionserver.wal.encryption</name>   
   <value>true</value> 
</property> 
<!-- For key rotation --> 
<property>
   <name>hbase.crypto.master.alternate.key.name</name>   
   <value>hbase.old</value> 
</property> 
<!-- Secure Bulk Load --> 
<property>
   <name>hbase.bulkload.staging.dir</name>   
   <value>/tmp/hbase-staging</value> 
</property> 
<property>
   <name>hbase.coprocessor.region.classes</name>   
   <value>org.apache.hadoop.hbase.security.token.TokenProvider,   
   org.apache.hadoop.hbase.security.access.AccessController,
   org.apache.hadoop.hbase.security.access.SecureBulkLoadEndpoint</value> 
</property>

示例：Hadoop core-site.xml中的组映射器示例

调整下述些设置以适用您的环境。

<property>
   <name>hadoop.security.group.mapping</name>   
   <value>org.apache.hadoop.security.LdapGroupsMapping</value> 
</property> 
<property>
   <name>hadoop.security.group.mapping.ldap.url</name>   
   <value>ldap://server</value> 
</property> 
<property>
   <name>hadoop.security.group.mapping.ldap.bind.user</name>   
   <value>Administrator@example-ad.local</value> 
</property> 
<property>
   <name>hadoop.security.group.mapping.ldap.bind.password</name>   
   <value>****</value> 
<!-- Replace with the actual password --> 
</property> 
<property>
   <name>hadoop.security.group.mapping.ldap.base</name>   
   <value>dc=example-ad,dc=local</value> 
</property> 
<property>
   <name>hadoop.security.group.mapping.ldap.search.filter.user</name>   
   <value>(&amp;(objectClass=user)(sAMAccountName={0}))</value> 
</property> 
<property>
   <name>hadoop.security.group.mapping.ldap.search.filter.group</name>   
   <value>(objectClass=group)</value> 
</property> 
<property>
   <name>hadoop.security.group.mapping.ldap.search.attr.member</name>   
   <value>member</value> 
</property> 
<property>
   <name>hadoop.security.group.mapping.ldap.search.attr.group.name</name>   
   <value>cn</value> 
</property>

ITPub博客

HBase安全启用与安全配置示例

最新文章