Configuring Encrypted Transport for HDFS

This topic describes how to configure encrypted HDFS data transport using both, Cloudera Manager, and the command line.

You must enable Kerberos before configuring encrypted HDFS data transport. See Authentication for instructions.

Using Cloudera Manager

Minimum Required Role: Full Administrator

To enable encryption of data transferred between DataNodes and clients, and among DataNodes, perform the following steps:
  1. Enable Hadoop security using Kerberos.
  2. Select the HDFS service.
  3. Click the Configuration tab.
  4. Select Scope > HDFS (Service Wide).
  5. Select Category > Security.
  6. Configure the following properties: (You can type the property name in the Search box to locate the property.)
    Property Description
    Enable Data Transfer Encryption Check this field to enable wire encryption.
    Data Transfer Encryption Algorithm Optionally configure the algorithm used to encrypt data.
    Hadoop RPC Protection Select privacy.
  7. Click Save Changes.
  8. Restart the HDFS service.

Using the Command Line

To enable encrypted data transport using the command line, perform the following steps:

  1. Enable Kerberos authentication, following these instructions.
  2. Set the optional RPC encryption by setting hadoop.rpc.protection to "privacy" in the core-site.xml file in both client and server configurations.
  3. Set dfs.encrypt.data.transfer to true in the hdfs-site.xml file on all server systems.
  4. Restart all daemons.