mirror of
https://github.com/apache/impala.git
synced 2025-12-19 09:58:28 -05:00
d484d2f684
This now gives a clean RAT check with bin/check-rat-report.py, which is one way for the Impala community to check compliance with ASF rules on intellectual property. Change-Id: I2ad06435f84a65ba126759e42a18fdaf52cd7036 Reviewed-on: http://gerrit.cloudera.org:8080/5232 Reviewed-by: Jim Apple <jbapple-impala@apache.org> Tested-by: Impala Public Jenkins Reviewed-by: John Russell <jrussell@cloudera.com>
85 lines
4.1 KiB
XML
85 lines
4.1 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!--
|
|
Licensed to the Apache Software Foundation (ASF) under one
|
|
or more contributor license agreements. See the NOTICE file
|
|
distributed with this work for additional information
|
|
regarding copyright ownership. The ASF licenses this file
|
|
to you under the Apache License, Version 2.0 (the
|
|
"License"); you may not use this file except in compliance
|
|
with the License. You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing,
|
|
software distributed under the License is distributed on an
|
|
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
KIND, either express or implied. See the License for the
|
|
specific language governing permissions and limitations
|
|
under the License.
|
|
-->
|
|
<!DOCTYPE concept PUBLIC "-//OASIS//DTD DITA Concept//EN" "concept.dtd">
|
|
<concept rev="1.1" id="security_webui">
|
|
|
|
<title>Securing the Impala Web User Interface</title>
|
|
<prolog>
|
|
<metadata>
|
|
<data name="Category" value="Impala"/>
|
|
<data name="Category" value="Troubleshooting"/>
|
|
<data name="Category" value="Security"/>
|
|
<data name="Category" value="Administrators"/>
|
|
</metadata>
|
|
</prolog>
|
|
|
|
<conbody>
|
|
|
|
<p>
|
|
The instructions in this section presume you are familiar with the
|
|
<xref href="http://en.wikipedia.org/wiki/.htpasswd" scope="external" format="html">
|
|
<filepath>.htpasswd</filepath> mechanism</xref> commonly used to password-protect pages on web servers.
|
|
</p>
|
|
|
|
<p>
|
|
Password-protect the Impala web UI that listens on port 25000 by default. Set up a
|
|
<filepath>.htpasswd</filepath> file in the <codeph>$IMPALA_HOME</codeph> directory, or start both the
|
|
<cmdname>impalad</cmdname> and <cmdname>statestored</cmdname> daemons with the
|
|
<codeph>--webserver_password_file</codeph> option to specify a different location (including the filename).
|
|
</p>
|
|
|
|
<p>
|
|
This file should only be readable by the Impala process and machine administrators, because it contains
|
|
(hashed) versions of passwords. The username / password pairs are not derived from Unix usernames, Kerberos
|
|
users, or any other system. The <codeph>domain</codeph> field in the password file must match the domain
|
|
supplied to Impala by the new command-line option <codeph>--webserver_authentication_domain</codeph>. The
|
|
default is <codeph>mydomain.com</codeph>.
|
|
<!-- Password generator cited by Henry: <xref href="http://www.askapache.com/online-tools/htpasswd-generator/" scope="external" format="html"/> -->
|
|
</p>
|
|
|
|
<p>
|
|
Impala also supports using HTTPS for secure web traffic. To do so, set
|
|
<codeph>--webserver_certificate_file</codeph> to refer to a valid <codeph>.pem</codeph> TLS/SSL certificate file.
|
|
Impala will automatically start using HTTPS once the TLS/SSL certificate has been read and validated. A
|
|
<codeph>.pem</codeph> file is basically a private key, followed by a signed TLS/SSL certificate; make sure to
|
|
concatenate both parts when constructing the <codeph>.pem</codeph> file.
|
|
<!-- Certificate info cited by Henry: <xref href="http://www.akadia.com/services/ssh_test_certificate.html" scope="external" format="html"/>
|
|
This page was very useful for creating a certificate and private key file;
|
|
the last step which was missing was to append one file to the other to make the <codeph>.pem</codeph> file. -->
|
|
</p>
|
|
|
|
<p>
|
|
If Impala cannot find or parse the <codeph>.pem</codeph> file, it prints an error message and quits.
|
|
</p>
|
|
|
|
<note>
|
|
<p>
|
|
If the private key is encrypted using a passphrase, Impala will ask for that passphrase on startup, which
|
|
is not useful for a large cluster. In that case, remove the passphrase and make the <codeph>.pem</codeph>
|
|
file readable only by Impala and administrators.
|
|
</p>
|
|
<p>
|
|
When you turn on TLS/SSL for the Impala web UI, the associated URLs change from <codeph>http://</codeph>
|
|
prefixes to <codeph>https://</codeph>. Adjust any bookmarks or application code that refers to those URLs.
|
|
</p>
|
|
</note>
|
|
</conbody>
|
|
</concept>
|