{"id":17175,"date":"2018-05-31T06:47:05","date_gmt":"2018-05-31T06:47:05","guid":{"rendered":"https:\/\/data-flair.training\/blogs\/?p=17175"},"modified":"2018-05-31T06:47:05","modified_gmt":"2018-05-31T06:47:05","slug":"hbase-security","status":"publish","type":"post","link":"https:\/\/data-flair.training\/blogs\/hbase-security\/","title":{"rendered":"HBase Security: Kerberos Authentication & Authorization"},"content":{"rendered":"

Today, we will learn HBase Security. So, In this article “HBase Security: Authentication & Authorization”, we will learn the way we use Kerberos with Hadoop<\/strong>\u00a0and HBase<\/strong> to offer User Authentication i.e. HBase Kerberos Authorization. <\/span><\/p>\n

Also, the implementation of HBase Authorization to grant users permissions for particular actions on a specified set of data. Moreover, we will cover some HBase Commands<\/strong> for security in HBase. <\/span><\/p>\n

Along with this, we will discuss HDFS & Zookeeper SASL and also HBase ACL. At last, we will know about HBase Simple Authentication & HBase Client Authentication.<\/span><\/p>\n

So, let’s explore the HBase Security tutorial.<\/span><\/p>\n

HBase Security: Authentication & Authorization<\/span><\/h2>\n

Basically, protection of HBase against sniffers, unauthenticated\/unauthorized users and network-based attacks is what we meant by term \u201cHBase Security\u201d. However, it can not protect against authorized users especially those who accidentally delete all the data. <\/span><\/p>\n

But it is possible to configure HBase, to provide User Authentication. <\/span><\/p>\n

However, that ensures that only authorized users can communicate with HBase. Moreover, on the basis of HBase Simple Authentication and Security Layer (SASL), the HBase authorization system is implemented at the RPC level, that supports Kerberos. <\/span><\/p>\n

Further, on a per connection basis, SASL allows authentication, encryption negotiation and\/or message integrity verification.<\/span><\/p>\n

After enabling User Authentication, the next step is to give an admin the ability to define a series of User Authorization rules which allow or deny particular actions. <\/span><\/p>\n

Access Controller Coprocessor or Access Control List (ACL), which is the second name of the Authorization system, is available from HBase 0.92 (CDH4) onward. <\/span><\/p>\n

It provides the ability to define the authorization policy (Read\/Write\/Create\/Admin), with table\/family\/qualifier granularity, for a specified user.<\/span><\/p>\n

Kerberos in HBase Security<\/span><\/h2>\n

A networked authentication protocol is what we call Kerberos. Basically, by using secret-key cryptography, it offers strong authentication for client\/server applications. <\/span><\/p>\n

To help a client to prove its identity to a server (and vice versa) across an insecure network connection, the HBase Kerberos protocol uses strong cryptography (AES, 3DES, \u2026). <\/span><\/p>\n

A client and server can also encrypt all of their communications to assure privacy and data integrity as they go about their business if they have used Kerberos to prove their identities.<\/span><\/p>\n

i.\u00a0Ticket exchange protocol<\/h3>\n

There are 3 steps which must follow to access a service using HBase Kerberos, at a high level:<\/span><\/p>\n

\"HBase<\/a>

Kerberos in HBase Security<\/p><\/div>\n

a. Kerberos Authentication<\/strong><\/h4>\n

At very first, the HBase client authenticates itself to the Kerberos Authentication Server. Afterward, it receives a Ticket Granting Ticket (TGT).<\/span><\/p>\n

b. Kerberos Authorization<\/strong><\/h4>\n

Then from the Ticket Granting Server, client request a service ticket, so if the client TGT sent with the request is valid, that issues a ticket and a session key.<\/span><\/p>\n

c. Service Request<\/strong><\/h4>\n

Further, to authenticate client uses the service ticket itself to the server which is providing the service the client is using (e.g. HDFS, HBase, \u2026)<\/span><\/p>\n

HBase, HDFS, ZooKeeper SASL<\/span><\/h2>\n

As we know, secure HBase relies on a secure HDFS <\/strong>and a secure ZooKeeper, because HBase depends on HDFS and ZooKeeper. That says to communicate with HDFS and ZooKeeper, \u00a0the HBase servers need to create a secure service session.<\/span><\/p>\n

Further, in HDFS, all the files written by HBase are stored. Moreover, the access control provided by HDFS is based on users, groups, and permissions, as in Unix filesystems. <\/span><\/p>\n

On each znode, ZooKeeper<\/strong> has an Access Control List (ACL) which permits read\/write access to the users on the basis of user information in a similar manner to HDFS.<\/span><\/p>\n

HBase ACL<\/span><\/h2>\n

Basically, we are sure that the username that we received is one of our trusted users only if our users are authenticated via Kerberos. <\/span><\/p>\n

However, there are times when this is not enough granularity like when we want to control that a specified user is able to read or write a table so, HBase offers an Authorization mechanism which allows restricted access for specific users, to do that.<\/span><\/p>\n

However, we must enable the Access Controller coprocessor, to enable this feature. It is possible by adding it to hbase-site.xml under the master and region server coprocessor classes. On defining a coprocessor, it is a code which runs inside each HBase Region Server and\/or Master. \u00a0<\/span><\/p>\n