Kerberos authentication in Hadoop

Introduction

Kerberos authentication helps keep your data safe by making sure only the right people can access Hadoop services.

When you want to protect your Hadoop cluster from unauthorized access.

When multiple users need to securely access shared data in Hadoop.

When you want to verify the identity of users and services automatically.

When you need to comply with security rules in your organization.

When you want to avoid sending passwords over the network.

Syntax

Hadoop

kinit -kt /path/to/keytab user@REALM
hadoop fs -ls /user/hadoop

kinit is used to get a Kerberos ticket for a user.

The -kt option uses a keytab file so you don't have to type your password.

Examples

Authenticate user interactively and list files in Hadoop.

Hadoop

kinit [e-mail]
hadoop fs -ls /user/hadoop

Authenticate user using a keytab file and list files.

Hadoop

kinit -kt /etc/security/keytabs/hadoop.keytab [e-mail]
hadoop fs -ls /user/hadoop

Sample Program

This script shows how to authenticate a Hadoop user with Kerberos using a keytab file, then list files in their Hadoop directory.

Hadoop

# This is a shell script example to authenticate and list files

# Authenticate using keytab
kinit -kt /etc/security/keytabs/hadoop.keytab [e-mail]

# List files in Hadoop user's directory
hadoop fs -ls /user/hadoop

Important Notes

Make sure your system clock is correct; Kerberos tickets depend on time.

Keytab files should be kept secret and secure.

Kerberos realm names are usually uppercase, like EXAMPLE.COM.

Summary

Kerberos authentication protects Hadoop by verifying user identities.

Use kinit to get a ticket before accessing Hadoop services.

Keytab files allow password-free authentication for automated tasks.