Encrypted Shuffle and Encrypted Web UIs

hadoop.ssl.enabled

Default value: false

For MRv1, set this value to true to enable encryption for both the MapReduce shuffle and the web UI.

For YARN, this property enables encryption for the web UI only . Enable shuffle encryption with a property in the mapred-site.xml file as described here.

hadoop.ssl.require.client.cert

Default value: false

When this property is set to true, client certificates are required for all shuffle operations and all browsers used to access web UIs.

Cloudera recommends that this be set to false. This is because client certificates are easily susceptible to attacks from malicious clients or jobs. For more details, see Client Certificates.

hadoop.ssl.hostname.verifier

Default value: DEFAULT

The SSLHostnameVerifier interface present inside the hadoop-common security library checks if a hostname matches the name stored inside the server's X.509 certificate. The value assigned to this property determines how Hadoop verifies hostnames when it establishes new HttpsURLConnection instances. Valid values are:

• DEFAULT: The hostname must match either the first common name (CN) or any of the subjectAltNames (SAN). Wildcards can occur in either the CN or the SANs. For example, a hostname, such as *.example.com, will match all subdomains, including test.cloudera.example.com.
• DEFAULT_AND_LOCALHOST: This verifier mechanism works just like DEFAULT. However, it also allows all hostnames of the type: localhost, localhost.example, or 127.0.0.1.
• STRICT: This verifier works just like DEFAULT with an additional restriction for hostnames with wildcards. For example, a hostname with a wildcard such as *.example.com, will only match subdomains at the same level. Hence, cloudera.example.com will match, but, unlike DEFAULT, test.cloudera.example.com will be rejected.
• STRICT_IE6: This verifier works just like STRICT, however, it will allow hostnames that match any of the common names (CN) within the server's X.509 certificate, not just the first one.
• ALLOW_ALL: Using this verifier will essentially turn off the hostname verifier mechanism.

hadoop.ssl.keystores.factory.class

Default value: org.apache.hadoop.security.ssl.FileBasedKeyStoresFactory

The KeyStoresFactory implementation to be used. Currently, FileBasedKeyStoresFactory is the only implementation of KeyStoresFactory.

hadoop.ssl.server.conf

Default value: ssl-server.xml

Resource file from which TLS/SSL server keystore information is extracted. Typically, it should be in the /etc/hadoop/conf/ directory so that it can be looked up in the CLASSPATH.

hadoop.ssl.client.conf

Default value: ssl-client.xml

Resource file from which TLS/SSL client keystore information is extracted. Typically, it should be in the /etc/hadoop/conf/ directory so that it can be looked up in the CLASSPATH.

...
    <property>
      <name>hadoop.ssl.require.client.cert</name>
      <value>false</value>
      <final>true</final>
    </property>

    <property>
      <name>hadoop.ssl.hostname.verifier</name>
      <value>DEFAULT</value>
      <final>true</final>
    </property>

    <property>
      <name>hadoop.ssl.keystores.factory.class</name>
      <value>org.apache.hadoop.security.ssl.FileBasedKeyStoresFactory</value>
      <final>true</final>
    </property>

    <property>
      <name>hadoop.ssl.server.conf</name>
      <value>ssl-server.xml</value>
      <final>true</final>
    </property>

    <property>
      <name>hadoop.ssl.client.conf</name>
      <value>ssl-client.xml</value>
      <final>true</final>
    </property>

    <property>
      <name>hadoop.ssl.enabled</name>
      <value>true</value>
    </property>
...

...
    <property>
      <name>mapreduce.shuffle.ssl.enabled</name>
      <value>true</value>
      <final>true</final>
    </property>
...