-
Notifications
You must be signed in to change notification settings - Fork 10
/
enable-ssl.sh
466 lines (400 loc) · 20.6 KB
/
enable-ssl.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
#!/usr/bin/env bash
#
# Enable SSL for Hadoop Web UIs
#
#TODO add support for multiple Ranger Admin hosts
#TODO automatically figure out the hostnames for each component
#TODO add ranger yarn plugin ssl
#TODO add ranger hive plugin ssl
server1="sandbox.hortonworks.com"
server2="sandbox.hortonworks.com"
server3="sandbox.hortonworks.com"
OOZIE_SERVER_ONE=$server2
NAMENODE_SERVER_ONE=$server1
RESOURCE_MANAGER_SERVER_ONE=$server3
HISTORY_SERVER=$server1
HBASE_MASTER_SERVER_ONE=$server2
RANGER_ADMIN_SERVER=$server1
ALL_NAMENODE_SERVERS="${NAMENODE_SERVER_ONE} $server2"
ALL_OOZIE_SERVERS="${OOZIE_SERVER_ONE} $server3"
ALL_HADOOP_SERVERS="$server1 $server2 $server3"
ALL_HBASE_MASTER_SERVERS="${HBASE_MASTER_SERVER_ONE} $server3"
ALL_HBASE_REGION_SERVERS="$server1 $server2 $server3"
ALL_REAL_SERVERS="$server1 $server2 $server3"
DOMAIN=$(hostname -d)
export AMBARI_SERVER=$server1
AMBARI_PASS=4o12t0n
CLUSTER_NAME=Sandbox
#
# PREP
#
mkdir -p /tmp/security
chmod -R 755 /tmp/security
cd /tmp/security
TRUST_STORE=/etc/pki/java/cacerts
#remove ssh host key checks
cat <<EOF > ~/.ssh/config
Host *
PasswordAuthentication no
StrictHostKeyChecking no
ConnectTimeout 20
EOF
#generate an ssh key for passwordless ssh if this is on the sandbox
if echo $AMBARI_SERVER | grep -q -i "sandbox.hortonworks.com" ; then
if [ ! -e ~/.ssh/id_rsa ]; then
ssh-keygen -f ~/.ssh/id_rsa -N "" -q
fi
cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
fi
#copy over configs.sh from Ambari server to what ever server this is
if [ ! -e "/var/lib/ambari-server/resources/scripts/configs.sh" ]; then
mkdir -p /var/lib/ambari-server/resources/scripts/
scp ${AMBARI_SERVER}:/var/lib/ambari-server/resources/scripts/configs.sh /var/lib/ambari-server/resources/scripts/
fi
#
# create all SSL certificates, and keys
# 1. CA SSL certificate
# 2. Server SSL certificate
# 3. Generate an SSL cert for just the domain name of the cluster
#
function generateSSLCerts() {
rm -f /etc/pki/CA/index.txt
touch /etc/pki/CA/index.txt
echo '1000' > /etc/pki/CA/serial
# 1. CA SSL certificate
if [ ! -e "ca.crt" ]; then
openssl genrsa -out ca.key 2048
openssl req -new -x509 -days 1826 -key ca.key -out ca.crt -subj "/C=US/ST=New York/L=New York City/O=Hortonworks/OU=Consulting/CN=HortonworksCA"
fi
# 2. Server SSL certificates
for host in ${ALL_REAL_SERVERS}; do
if [ -e "${host}.crt" ]; then break; fi
openssl req -new -newkey rsa:2048 -nodes -keyout ${host}.key -out ${host}.csr -subj "/C=US/ST=New York/L=New York City/O=Hortonworks/OU=Consulting/CN=$host"
openssl ca -batch -startdate 20160101120000Z -cert ca.crt -keyfile ca.key -out ${host}.crt -infiles ${host}.csr
done
# 3. Generate an SSL cert for just the domain name of the cluster, which is needed for Oozie
if [ ! -e "${DOMAIN}.crt" ]; then
openssl req -new -newkey rsa:2048 -nodes -keyout ${DOMAIN}.key -out ${DOMAIN}.csr -subj "/C=US/ST=New York/L=New York City/O=Hortonworks/OU=Consulting/CN=*.${DOMAIN}"
openssl ca -batch -startdate 20160101120000Z -cert ca.crt -keyfile ca.key -out ${DOMAIN}.crt -infiles ${DOMAIN}.csr
fi
#copy public ssl certs to all hosts
for host in ${ALL_REAL_SERVERS}; do
scp ca.crt ${host}:/tmp/ca.crt
ssh $host "keytool -import -noprompt -alias myOwnCA -file /tmp/ca.crt -storepass changeit -keystore $TRUST_STORE; rm -f /tmp/ca.crt"
for cert in ${ALL_REAL_SERVERS}; do
scp $cert.crt ${host}:/tmp/$cert.crt
ssh $host "keytool -import -noprompt -alias ${cert} -file /tmp/${cert}.crt -storepass changeit -keystore $TRUST_STORE; rm -f \"/tmp/${cert}.crt\""
done
done
#verify certs
for host in ${ALL_REAL_SERVERS}; do
if [ $(openssl rsa -noout -modulus -in $host.key) != $(openssl x509 -noout -modulus -in $host.crt) ]; then
echo $host failed verification of private key and public key pair
else
echo $host verified private key and public key pair
fi
done
}
#
# Enable Ambari SSL encryption and truststore.
#
function ambariSSLEnable() {
rpm -q expect || yum install -y expect
cat <<EOF > ambari-ssl-expect.exp
#!/usr/bin/expect
spawn "/usr/sbin/ambari-server" "setup-security"
expect "Enter choice"
send "1\r"
expect "Do you want to configure HTTPS"
send "y\r"
expect "SSL port"
send "\r"
expect "Enter path to Certificate"
send "/tmp/security/\$env(AMBARI_SERVER).crt\r"
expect "Enter path to Private Key"
send "/tmp/security/\$env(AMBARI_SERVER).key\r"
expect "Please enter password for Private Key"
send "\r"
send "\r"
interact
EOF
cat <<EOF > ambari-truststore-expect.exp
#!/usr/bin/expect
spawn "/usr/sbin/ambari-server" "setup-security"
expect "Enter choice"
send "4\r"
expect "Do you want to configure a truststore"
send "y\r"
expect "TrustStore type"
send "jks\r"
expect "Path to TrustStore file"
send "/etc/pki/java/cacerts\r"
expect "Password for TrustStore"
send "changeit\r"
expect "Re-enter password"
send "changeit\r"
interact
EOF
if ! grep -q 'api.ssl=true' /etc/ambari-server/conf/ambari.properties; then
/usr/bin/expect ambari-ssl-expect.exp
/usr/bin/expect ambari-truststore-expect.exp
service ambari-server restart
while true; do if tail -100 /var/log/ambari-server/ambari-server.log | grep -q 'Started Services'; then break; else echo -n .; sleep 3; fi; done; echo
fi
rm -f ambari-ssl-expect.exp ambari-truststore-expect.exp
#validate wget -O- --no-check-certificate "https://${AMBARI_SERVER}:8443/#/main/dashboard/metrics"
}
#
# Enable Oozie UI SSL encryption
#
function oozieSSLEnable() {
openssl pkcs12 -export -in ${DOMAIN}.crt -inkey ${DOMAIN}.key -out oozie-server.p12 -name tomcat -CAfile ca.crt -chain -passout pass:password
#copy and add private key to both oozie servers
for host in ${ALL_OOZIE_SERVERS}; do
scp oozie-server.p12 ${host}:/tmp/oozie-server.p12
ssh $host "
su - oozie -c \"keytool --importkeystore -noprompt -deststorepass password -destkeypass password -destkeystore ~/.keystore -srckeystore /tmp/oozie-server.p12 -srcstoretype PKCS12 -srcstorepass password -alias tomcat\";
rm -f /tmp/oozie-server.p12;
"
done
#copy the public key to all servers and add to truststore
for host in ${ALL_REAL_SERVERS}; do
scp ${DOMAIN}.crt ${host}:/tmp/${DOMAIN}.crt
ssh $host "
keytool -import -noprompt -alias tomcat -file /tmp/${DOMAIN}.crt -storepass changeit -keystore $TRUST_STORE;
rm -f \"/tmp/${DOMAIN}.crt\";
"
done
#make changes to Ambari to set oozie.base.url and add OOZIE_HTTP(S)_PORT
/var/lib/ambari-server/resources/scripts/configs.sh -u admin -p $AMBARI_PASS -port 8443 -s set $AMBARI_SERVER $CLUSTER_NAME oozie-site oozie.base.url https://${OOZIE_SERVER_ONE}:11443/oozie &> /dev/null
/var/lib/ambari-server/resources/scripts/configs.sh -u admin -p $AMBARI_PASS -port 8443 -s get $AMBARI_SERVER $CLUSTER_NAME oozie-env oozie-env
perl -pe 's/(\"content\".*?)\",$/$1\\nexport OOZIE_HTTP_PORT=11000\\nexport OOZIE_HTTPS_PORT=11443\",/' -i oozie-env
/var/lib/ambari-server/resources/scripts/configs.sh -u admin -p $AMBARI_PASS -port 8443 -s set $AMBARI_SERVER $CLUSTER_NAME oozie-env oozie-env &> /dev/null
rm -f doSet_* oozie-env
# Now restart Oozie
#validate using
# openssl s_client -connect ${OOZIE_SERVER_ONE}:11443 -showcerts < /dev/null
# and
# oozie jobs -oozie https://${OOZIE_SERVER_ONE}:11443/oozie
#
}
#
# Enable Hadoop UIs SSL encryption. Stop all Hadoop components first
#
function hadoopSSLEnable() {
for host in ${ALL_HADOOP_SERVERS}; do
if [ -e "${host}.p12" ]; then continue; fi
openssl pkcs12 -export -in ${host}.crt -inkey ${host}.key -out ${host}.p12 -name ${host} -CAfile ca.crt -chain -passout pass:password
done
for host in ${ALL_HADOOP_SERVERS}; do
scp ${host}.p12 ${host}:/tmp/${host}.p12
scp ca.crt ${host}:/tmp/ca.crt
ssh $host "
keytool -import -noprompt -alias myOwnCA -file /tmp/ca.crt -storepass password -keypass password -keystore /etc/hadoop/conf/hadoop-private-keystore.jks
keytool --importkeystore -noprompt -deststorepass password -destkeypass password -destkeystore /etc/hadoop/conf/hadoop-private-keystore.jks -srckeystore /tmp/${host}.p12 -srcstoretype PKCS12 -srcstorepass password -alias ${host}
chmod 440 /etc/hadoop/conf/hadoop-private-keystore.jks
chown yarn:hadoop /etc/hadoop/conf/hadoop-private-keystore.jks
rm -f /tmp/ca.crt \"/tmp/${host}.p12\";
"
done
cat <<EOF | while read p; do p=${p/,}; p=${p//\"}; if [ -z "$p" ]; then continue; fi; /var/lib/ambari-server/resources/scripts/configs.sh -u admin -p $AMBARI_PASS -port 8443 -s set $AMBARI_SERVER $CLUSTER_NAME $p &> /dev/null || echo "Failed to change $p in Ambari"; done
hdfs-site "dfs.https.enable" "true",
hdfs-site "dfs.http.policy" "HTTPS_ONLY",
hdfs-site "dfs.datanode.https.address" "0.0.0.0:50475",
hdfs-site "dfs.namenode.https-address" "0.0.0.0:50470",
core-site "hadoop.ssl.require.client.cert" "false",
core-site "hadoop.ssl.hostname.verifier" "DEFAULT",
core-site "hadoop.ssl.keystores.factory.class" "org.apache.hadoop.security.ssl.FileBasedKeyStoresFactory",
core-site "hadoop.ssl.server.conf" "ssl-server.xml",
core-site "hadoop.ssl.client.conf" "ssl-client.xml",
mapred-site "mapreduce.jobhistory.http.policy" "HTTPS_ONLY",
mapred-site "mapreduce.jobhistory.webapp.https.address" "${HISTORY_SERVER}:19443",
mapred-site mapreduce.jobhistory.webapp.address "${HISTORY_SERVER}:19443",
yarn-site "yarn.http.policy" "HTTPS_ONLY"
yarn-site "yarn.log.server.url" "https://${HISTORY_SERVER}:19443/jobhistory/logs",
yarn-site "yarn.resourcemanager.webapp.https.address" "${RESOURCE_MANAGER_SERVER_ONE}:8090",
yarn-site "yarn.nodemanager.webapp.https.address" "0.0.0.0:45443",
ssl-server "ssl.server.keystore.password" "password",
ssl-server "ssl.server.keystore.keypassword" "password",
ssl-server "ssl.server.keystore.location" "/etc/hadoop/conf/hadoop-private-keystore.jks",
ssl-server "ssl.server.truststore.location" "${TRUST_STORE}",
ssl-server "ssl.server.truststore.password" "changeit",
ssl-client "ssl.client.keystore.location" "${TRUST_STORE}",
ssl-client "ssl.client.keystore.password" "changeit",
ssl-client "ssl.client.truststore.password" "changeit",
ssl-client "ssl.client.truststore.location" "${TRUST_STORE}"
EOF
rm -f doSet_version*
# In Ambari, perform Start ALL
#validate through:
}
#
# Enable HBase UI SSL encryption. Stop all HBase services first
#
## each host gets its own SSL certificate
## some of the keyimports may fail because the HBase services run on the same hosts as the Hadoop services
function hbaseSSLEnable() {
for host in ${ALL_HBASE_MASTER_SERVERS}; do
if [ -e "${host}.p12" ]; then continue; fi
openssl pkcs12 -export -in ${host}.crt -inkey ${host}.key -out ${host}.p12 -name ${host} -CAfile ca.crt -chain -passout pass:password
done
#copy ssl private cert to all hbase masters
for host in ${ALL_HBASE_MASTER_SERVERS}; do
scp ${host}.p12 ${host}:/tmp/${host}.p12
scp ca.crt ${host}:/tmp/ca.crt
ssh $host "
keytool -import -noprompt -alias myOwnCA -file /tmp/ca.crt -storepass password -keypass password -keystore /etc/hadoop/conf/hadoop-private-keystore.jks
keytool --importkeystore -noprompt -deststorepass password -destkeypass password -destkeystore /etc/hadoop/conf/hadoop-private-keystore.jks -srckeystore /tmp/${host}.p12 -srcstoretype PKCS12 -srcstorepass password -alias ${host}
chmod 440 /etc/hadoop/conf/hadoop-private-keystore.jks
chown yarn:hadoop /etc/hadoop/conf/hadoop-private-keystore.jks
rm -f /tmp/ca.crt \"/tmp/${host}.p12\"
"
done
/var/lib/ambari-server/resources/scripts/configs.sh -u admin -p $AMBARI_PASS -port 8443 -s set $AMBARI_SERVER $CLUSTER_NAME hbase-site "hbase.ssl.enabled" "true" &> /dev/null || echo "Failed to change hbase.ssl.enabled in Ambari"
rm -f doSet_version*
# In Ambari, perform Start ALL
#validate through: openssl s_client -connect ${HBASE_MASTER_SERVER_ONE}:16010 -showcerts < /dev/null
}
#
# Enable Ranger Admin UI SSL encryption. Keep Ranger Admin and Ranger user-sync on the same hostname
#
function rangerAdminSSLEnable() {
RANGER_PRIVATE_KEYSTORE=ranger-admin-keystore.jks
openssl pkcs12 -export -in ${RANGER_ADMIN_SERVER}.crt -inkey ${RANGER_ADMIN_SERVER}.key -out ranger-admin.p12 -name rangeradmintrust -CAfile ca.crt -chain -passout pass:password
keytool -import -noprompt -alias myOwnCA -file ca.crt -storepass password -keystore ${RANGER_PRIVATE_KEYSTORE}
keytool --importkeystore -noprompt -deststorepass password -destkeypass password -destkeystore ${RANGER_PRIVATE_KEYSTORE} -srckeystore ranger-admin.p12 -srcstoretype PKCS12 -srcstorepass password -alias rangeradmintrust
scp ${RANGER_PRIVATE_KEYSTORE} ${RANGER_ADMIN_SERVER}:/etc/ranger/admin/conf/${RANGER_PRIVATE_KEYSTORE}
ssh ${RANGER_ADMIN_SERVER} "
chmod 400 /etc/ranger/admin/conf/${RANGER_PRIVATE_KEYSTORE}
chown ranger:ranger /etc/ranger/admin/conf/${RANGER_PRIVATE_KEYSTORE}
"
cat <<EOF | while read p; do p=${p/,}; p=${p//\"}; if [ -z "$p" ]; then continue; fi; /var/lib/ambari-server/resources/scripts/configs.sh -u admin -p $AMBARI_PASS -port 8443 -s set $AMBARI_SERVER $CLUSTER_NAME $p &>/dev/null || echo "Failed to change $p in Ambari"; done
ranger-admin-site ranger.https.attrib.keystore.file /etc/ranger/admin/conf/${RANGER_PRIVATE_KEYSTORE}
ranger-admin-site ranger.service.https.attrib.keystore.file /etc/ranger/admin/conf/${RANGER_PRIVATE_KEYSTORE}
ranger-admin-site ranger.service.https.attrib.client.auth "false"
ranger-admin-site ranger.service.https.attrib.keystore.pass "changeit"
ranger-admin-site ranger.service.https.attrib.keystore.keyalias rangeradmintrust
ranger-admin-site "ranger.service.http.enabled" "false",
ranger-admin-site "ranger.service.https.attrib.clientAuth" "want",
ranger-admin-site "ranger.service.https.attrib.keystore.pass" "password",
ranger-admin-site "ranger.service.https.attrib.ssl.enabled" "true",
ranger-ugsync-site "ranger.usersync.truststore.file" "${TRUST_STORE}",
ranger-ugsync-site "ranger.usersync.truststore.password" "changeit",
admin-properties "policymgr_external_url" "https://${RANGER_ADMIN_SERVER}:6182"
EOF
rm -f doSet_version*
#restart Ranger via Ambari
}
#
# Ranger HDFS Plugin
#
# even though there are two NameNodes, the same SSL certificate must be used
function rangerHDFSSSLEnable() {
RANGER_HDFS_PRIVATE_KEYSTORE=ranger-hdfs-plugin-keystore.jks
openssl pkcs12 -export -in ${NAMENODE_SERVER_ONE}.crt -inkey ${NAMENODE_SERVER_ONE}.key -out rangerHdfsAgent.p12 -name rangerHdfsAgent -CAfile ca.crt -chain -passout pass:password
keytool -import -noprompt -alias myOwnCA -file ca.crt -storepass password -keystore ${RANGER_HDFS_PRIVATE_KEYSTORE}
keytool -importkeystore -noprompt -deststorepass password -destkeypass password -destkeystore ${RANGER_HDFS_PRIVATE_KEYSTORE} -srckeystore rangerHdfsAgent.p12 -srcstoretype PKCS12 -srcstorepass password -alias rangerHdfsAgent
keytool -import -noprompt -alias rangeradmintrust -file ${RANGER_ADMIN_SERVER}.crt -storepass password -keystore ${RANGER_HDFS_PRIVATE_KEYSTORE}
for host in ${ALL_NAMENODE_SERVERS}; do
scp ${RANGER_HDFS_PRIVATE_KEYSTORE} ${host}:/etc/hadoop/conf/${RANGER_HDFS_PRIVATE_KEYSTORE}
ssh ${host} "
chown hdfs:hadoop /etc/hadoop/conf/${RANGER_HDFS_PRIVATE_KEYSTORE}
chmod 440 /etc/hadoop/conf/${RANGER_HDFS_PRIVATE_KEYSTORE}
"
done
cat <<EOF | while read p; do p=${p/,}; p=${p//\"}; if [ -z "$p" ]; then continue; fi; /var/lib/ambari-server/resources/scripts/configs.sh -u admin -p $AMBARI_PASS -port 8443 -s set $AMBARI_SERVER $CLUSTER_NAME $p &> /dev/null || echo "Failed to change $p in Ambari"; done
ranger-hdfs-policymgr-ssl "xasecure.policymgr.clientssl.keystore" /etc/hadoop/conf/${RANGER_HDFS_PRIVATE_KEYSTORE},
ranger-hdfs-policymgr-ssl "xasecure.policymgr.clientssl.keystore.password" "password",
ranger-hdfs-policymgr-ssl "xasecure.policymgr.clientssl.truststore" "${TRUST_STORE}",
ranger-hdfs-policymgr-ssl "xasecure.policymgr.clientssl.truststore.password" "changeit"
EOF
rm -f doSet_version*
#add to Ranger Admin UI
#restart HDFS
#[root@node1 security]# cat node1.vzlatkin.com.key node1.vzlatkin.com.crt >> node1.vzlatkin.com.pem
# [root@node1 security]# curl --cacert /tmp/security/ca.crt --cert /tmp/security/node1.vzlatkin.com.pem "https://node1.vzlatkin.com:6182/service/plugins/policies/download/cluster1_hadoop?lastKnownVersion=3&[email protected]_hadoop"
# look for "util.PolicyRefresher" in logs
}
#
# Ranger HBase Plugin
#
function rangerHBaseSSLEnable() {
RANGER_HBASE_PRIVATE_KEYSTORE=ranger-hbase-plugin-keystore.jks
openssl pkcs12 -export -in ${HBASE_MASTER_SERVER_ONE}.crt -inkey ${HBASE_MASTER_SERVER_ONE}.key -out rangerHbaseAgent.p12 -name rangerHbaseAgent -CAfile ca.crt -chain -passout pass:password
keytool -importkeystore -noprompt -deststorepass password -destkeypass password -destkeystore ${RANGER_HBASE_PRIVATE_KEYSTORE} -srckeystore rangerHbaseAgent.p12 -srcstoretype PKCS12 -srcstorepass password -alias rangerHbaseAgent
keytool -import -noprompt -alias rangeradmintrust -file ${RANGER_ADMIN_SERVER}.crt -storepass password -keystore ${RANGER_HBASE_PRIVATE_KEYSTORE}
keytool -import -noprompt -alias myOwnCA -file ca.crt -storepass password -keystore ${RANGER_HBASE_PRIVATE_KEYSTORE}
for host in ${ALL_HBASE_MASTER_SERVERS} ${ALL_HBASE_REGION_SERVERS}; do
scp ${RANGER_HBASE_PRIVATE_KEYSTORE} ${host}:/etc/hadoop/conf/${RANGER_HBASE_PRIVATE_KEYSTORE}
ssh ${host} "
chown hbase:hadoop /etc/hadoop/conf/${RANGER_HBASE_PRIVATE_KEYSTORE}
chmod 440 /etc/hadoop/conf/${RANGER_HBASE_PRIVATE_KEYSTORE}
"
done
cat <<EOF | while read p; do p=${p/,}; p=${p//\"}; if [ -z "$p" ]; then continue; fi; /var/lib/ambari-server/resources/scripts/configs.sh -u admin -p $AMBARI_PASS -port 8443 -s set $AMBARI_SERVER $CLUSTER_NAME $p &> /dev/null || echo "Failed to change $p in Ambari"; done
ranger-hbase-policymgr-ssl "xasecure.policymgr.clientssl.keystore" /etc/hadoop/conf/${RANGER_HBASE_PRIVATE_KEYSTORE},
ranger-hbase-policymgr-ssl "xasecure.policymgr.clientssl.keystore.password" "password"
ranger-hbase-policymgr-ssl "xasecure.policymgr.clientssl.truststore" "${TRUST_STORE}",
ranger-hbase-policymgr-ssl "xasecure.policymgr.clientssl.truststore.password" "changeit"
EOF
rm -f doSet_version*
#add CN via Ranger Admin UI
#restart HBase via Ambari
#validate via
# [root@node1 security]# cat node2.vzlatkin.com.key node2.vzlatkin.com.crt >> node2.vzlatkin.com.pem
#[root@node1 security]# curl --cacert /tmp/security/ca.crt --cert /tmp/security/node2.vzlatkin.com.pem "https://node1.vzlatkin.com:6182/service/plugins/policies/download/cluster1_hbase?lastKnownVersion=3&[email protected]_hbase"
}
function usage() {
echo "Usage: $0 [--all] [--hbaseSSL] [--oozieSSL] [--hadoopSSL] [ --rangerSSL] [--ambariSSL]"
exit 1
}
if [ "$#" -lt 1 ]; then
usage
fi
while [ "$#" -ge 1 ]; do
key="$1"
case $key in
--all)
generateSSLCerts
ambariSSLEnable
oozieSSLEnable
hadoopSSLEnable
hbaseSSLEnable
rangerAdminSSLEnable
rangerHDFSSSLEnable
rangerHBaseSSLEnable
;;
--hbaseSSL)
generateSSLCerts
ambariSSLEnable
hadoopSSLEnable
hbaseSSLEnable
;;
--oozieSSL)
generateSSLCerts
ambariSSLEnable
oozieSSLEnable
;;
--hadoopSSL)
generateSSLCerts
ambariSSLEnable
hadoopSSLEnable
;;
--rangerSSL)
generateSSLCerts
ambariSSLEnable
rangerAdminSSLEnable
rangerHDFSSSLEnable
rangerHBaseSSLEnable
;;
--ambariSSL)
generateSSLCerts
ambariSSLEnable
;;
*)
usage
;;
esac
shift
done