[HDFS-13081] Datanode#checkSecureConfig should allow SASL and privileged HTTP

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0.0
• Fix Version/s: 3.1.0, 3.0.3
• Component/s: datanode, security
• Hadoop Flags: Reviewed
• Assignee: Ajay Kumar
• Reporter: Xiaoyu Yao
• Created: 29/Jan/18 20:15
• Updated: 15/Oct/19 20:57
• Resolved: 28/Feb/18 18:28

Description

Datanode#checkSecureConfig currently check the following to determine if secure datanode is enabled. 

1. The server has bound to privileged ports for RPC and HTTP via SecureDataNodeStarter.
2. The configuration enables SASL on DataTransferProtocol and HTTPS (no plain HTTP) for the HTTP server.

Authentication of Datanode RPC server can be done either via SASL handshake or JSVC/privilege RPC port.
This guarantees authentication of the datanode RPC server before a client transmits a secret, such as a block access token.

Authentication of the HTTP server can also be done either via HTTPS/SSL or JSVC/privilege HTTP port. This guarantees authentication of datandoe HTTP server before a client transmits a secret, such as a delegation token.

This ticket is open to allow privileged HTTP as an alternative to HTTPS to work with SASL based RPC protection.
 
cc: cnauroth , daryn, jnpandey for additional feedback.

 

Issue Links

• blocks: AMBARI-22981 Update Hadoop RPC Encryption Properties During Upgrade