Security

[fabianrbz]

No description provided.

[fabianrbz]

@HorizonNet would a self-signed certificate work for this?

[HorizonNet]

Why do you need a certificate?

[fabianrbz]

as part of https://www.cloudera.com/documentation/enterprise/5-9-x/topics/cm_sg_intro_kerb.html
it says that we need to configure tls encryption for cloudera manager, and in order to do that we need a certificate.

[HorizonNet]

TLS encryption is not part of the Kerberos setup as described in the lab. TLS is part of level-security for CM server and agents, which are out of scope. The hint in the Cloudera documentation just says that Kerberos alone is not enough for a secure cluster.

[fabianrbz]

@HorizonNet I'm using aws with elastic IPS for the cluster. Should I use the private DNS and IPS for KDC or the public ones?

[HorizonNet]

You should never rely on IPs in a cluster. On AWS it is best to stick with the private hostnames. This prevents additional traffic costs and allows some advanced security configurations.

[fabianrbz]

@HorizonNet thanks, but do i need to map the private hostnames to their private or public ips in the /etc/hosts or should work out of the box?

[HorizonNet]

On AWS using private hostnames only works out of the box. You shouldn't need to touch /etc/hosts at all.

[fabianrbz]

@HorizonNet I'm getting a kprop: Connection refused while connecting to server when trying to propagate the db as described here. According to the installation steps we shouldn't start krb5kdc until after the database is propagated. But how would the slave get the db if the daemon is not running?

[HorizonNet]

Why are you trying to set up multiple KDCs?

[fabianrbz]

I thought that the idea was to have a master in one of the hosts and a client/slave in each host. how should we setup the KDC then?

[HorizonNet]

You need to set up a central KDC and a Kerberos client on each host. The client is not part of the KDC. It only uses the KDC. You only have a master/slave architecture if you set up high availability for your KDC (which is what your link describes).

[fabianrbz]

@HorizonNet unrelated question, is it mandatory to take the challenge or we can just take the exam?

[HorizonNet]

The challenge is mandatory.