Kerberos authentication in Hadoop - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to initialize Kerberos authentication in Hadoop configuration.

Hadoop

conf.set("hadoop.security.authentication", "[1]")

Drag options to blanks, or click blank then click option'

Akerberos

Bsimple

Cnone

Dtoken

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'simple' instead of 'kerberos' disables Kerberos authentication.

Leaving the value empty causes authentication failure.

Setting hadoop.security.authentication to kerberos enables Kerberos authentication in Hadoop.

2fill in blank

medium

Complete the code to login a user from a keytab file using Hadoop's UserGroupInformation.

Hadoop

UserGroupInformation.[1](principal, keytabFilePath)

Drag options to blanks, or click blank then click option'

AsetConfiguration

BloginUserFromTicketCache

CloginUserFromKeytab

DgetCurrentUser

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'loginUserFromTicketCache' instead of keytab login method.

Calling 'setConfiguration' instead of login method.

The method loginUserFromKeytab logs in a user using a principal and keytab file for Kerberos authentication.

3fill in blank

hard

Fix the error in the code to set the Kerberos realm in the configuration.

Hadoop

conf.set("[1]", "EXAMPLE.COM")

Drag options to blanks, or click blank then click option'

Ahadoop.security.auth_to_local

Bhadoop.security.krb5.realm

Chadoop.security.krb5.kdc

Dhadoop.security.authentication

Attempts:

3 left

💡 Hint

Common Mistakes

Setting 'hadoop.security.authentication' instead of the realm.

Confusing KDC and realm properties.

The correct property to set the Kerberos realm is hadoop.security.krb5.realm.

4fill in blank

hard

Fill both blanks to create a map of user principals to local usernames using the auth_to_local rules.

Hadoop

conf.set("[1]", "RULE:[1:$1@$0](.*@EXAMPLE.COM)s/@EXAMPLE.COM//")
conf.set("[2]", "kerberos")

Drag options to blanks, or click blank then click option'

Ahadoop.security.auth_to_local

Bhadoop.security.authentication

Chadoop.security.krb5.realm

Dhadoop.security.krb5.kdc

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up realm and auth_to_local properties.

Not setting authentication to kerberos.

The hadoop.security.auth_to_local property defines rules to map Kerberos principals to local usernames. The hadoop.security.authentication property must be set to kerberos to enable Kerberos authentication.

5fill in blank

hard

Fill all three blanks to configure Kerberos KDC, realm, and enable authentication in Hadoop configuration.

Hadoop

conf.set("[1]", "kdc.example.com")
conf.set("[2]", "EXAMPLE.COM")
conf.set("[3]", "kerberos")

Drag options to blanks, or click blank then click option'

Ahadoop.security.authentication

Bhadoop.security.krb5.kdc

Chadoop.security.krb5.realm

Dhadoop.security.auth_to_local

Attempts:

3 left

💡 Hint

Common Mistakes

Swapping KDC and realm properties.

Forgetting to enable authentication with 'kerberos'.

Set hadoop.security.krb5.kdc to the KDC server, hadoop.security.krb5.realm to the Kerberos realm, and hadoop.security.authentication to kerberos to enable Kerberos authentication.

Practice

1. What is the main purpose of Kerberos authentication in Hadoop?

easy

A. To manage Hadoop cluster hardware

B. To verify user identities and secure access

C. To store large datasets

D. To speed up data processing

Solution

1. Step 1: Understand Kerberos role in security

   Kerberos is a network authentication protocol that verifies user identities.

2. Step 2: Connect to Hadoop security needs

   Hadoop uses Kerberos to ensure only authorized users access its services.

3. Final Answer:

   To verify user identities and secure access -> Option B

4. Quick Check:

   Kerberos = User identity verification [OK]

Hint: Kerberos = user identity check in Hadoop [OK]

Common Mistakes:

• Confusing Kerberos with data storage
• Thinking it speeds up processing
• Assuming it manages hardware

2. Which command is used to obtain a Kerberos ticket before accessing Hadoop services?

easy

A. kinit

B. klist

C. ktutil

D. hdfs dfs

Solution

1. Step 1: Identify commands related to Kerberos

   Among the options, kinit is used to get a ticket granting ticket (TGT).

2. Step 2: Match command to Hadoop access

   Before accessing Hadoop, users run kinit to authenticate with Kerberos.

3. Final Answer:

   kinit -> Option A

4. Quick Check:

   Get ticket = kinit [OK]

Hint: Use kinit to get Kerberos ticket before Hadoop access [OK]

Common Mistakes:

• Using klist which lists tickets but doesn't get one
• Confusing ktutil which manages keytabs
• Using hdfs dfs which is for file operations

3. What will be the output of the following command if the Kerberos ticket is valid?

klist

medium

A. Lists the current Kerberos tickets with expiration times

B. Deletes all Kerberos tickets

C. Shows Hadoop file system contents

D. Generates a new Kerberos ticket

Solution

1. Step 1: Understand the klist command

   klist displays the current Kerberos tickets held by the user.

2. Step 2: Interpret output when ticket is valid

   If a ticket is valid, klist shows ticket details including expiration times.

3. Final Answer:

   Lists the current Kerberos tickets with expiration times -> Option A

4. Quick Check:

   klist = show tickets [OK]

Hint: klist shows your current Kerberos tickets [OK]

Common Mistakes:

• Thinking klist deletes tickets
• Confusing it with ticket creation
• Assuming it lists Hadoop files

4. You run kinit -kt user.keytab [e-mail] but get an error saying "Client not found in Kerberos database." What is the likely cause?

medium

A. Keytab file is missing

B. Network connection is slow

C. Hadoop service is down

D. Incorrect principal name in the command

Solution

1. Step 1: Analyze the error message

   "Client not found in Kerberos database" means the principal name is not recognized.

2. Step 2: Check command parameters

   If the principal name ([e-mail]) is wrong or misspelled, authentication fails.

3. Final Answer:

   Incorrect principal name in the command -> Option D

4. Quick Check:

   Principal name error = client not found [OK]

Hint: Check principal name spelling if client not found error [OK]

Common Mistakes:

• Assuming keytab file missing causes this error
• Blaming Hadoop service status
• Thinking network speed causes this error

5. You want to automate Hadoop jobs without typing passwords each time. Which method using Kerberos is best suited?

hard

A. Use kinit with manual password entry every time

B. Store passwords in plain text files

C. Use a keytab file with kinit -kt for password-free login

D. Disable Kerberos authentication

Solution

1. Step 1: Understand automation needs

   Automated jobs cannot manually enter passwords each time.

2. Step 2: Identify secure password-free method

   Using a keytab file with kinit -kt allows password-free authentication securely.

3. Step 3: Evaluate other options

   Manual entry is not automation-friendly; storing passwords in plain text is insecure; disabling Kerberos removes security.

4. Final Answer:

   Use a keytab file with kinit -kt for password-free login -> Option C

5. Quick Check:

   Keytab + kinit -kt = automated login [OK]

Hint: Use keytab with kinit -kt for automation [OK]

Common Mistakes:

• Trying manual password entry for automation
• Storing passwords insecurely
• Disabling security features