不多说,直接上干货!

  参考官网

https://www.cloudera.com/documentation/enterprise/5-2-x/topics/cm_sg_config_tls_security.html

Configuring TLS Security for Cloudera Manager

Important:

  • Cloudera strongly recommends that you set up a fully-functional CDH cluster and Cloudera Manager before you begin configuring the Cloudera Manager Server and Agents to use TLS.
  • Cloudera Manager will continue to accept HTTP requests on port 7180 (default) but will immediately redirect clients to port 7183 for HTTPS connectivity once TLS is enabled.
  • Once Level 3 TLS is configured, if you want to add new hosts running Agents, you must manually deploy the Cloudera Manager agent and daemon's packages for your platform, issue a new certificate for the host, configure /etc/cloudera-scm-agent/config.ini to use SSL/TLS and then bring the host online.

    Conversely, you can disable TLS to add the host, configure the new host for TLS, then re-enable with the proper configuration in place. Either approach is valid, based on your needs.

  • For all hosts running Agents, Cloudera recommends you start with creating the keystore in Java first, and then exporting the key and certificate using openSSL for use by the Agent or Hue.

翻译就是:

  重要:
  Cloudera强烈建议您在开始配置Cloudera Manager服务器和代理使用TLS之前,设置完整功能的CDH群集和Cloudera Manager。
  Cloudera Manager将继续接收端口7180上的HTTP请求(默认值),但一旦启用TLS,它将立即将客户端重定向到端口7183以进行HTTPS连接。
一旦配置了3级TLS,如果要添加运行代理的新主机,则必须手动部署适用于您的平台的Cloudera Manager代理和守护程序软件包,为主机发出新的证书,配置/ etc /   cloudera-scm-agent / config.ini使用SSL / TLS,然后使主机联机。
相反,您可以禁用TLS添加主机,配置TLS的新主机,然后重新启用适当的配置。任何一种方法都是有效的,根据您的需要。

  对于运行代理的所有主机,Cloudera建议您首先使用Java创建密钥库,然后使用openSSL导出密钥和证书以供代理或色相使用。

  

   Transport Layer Security (TLS) provides encryption and authentication in the communications between the Cloudera Manager Server and Agents. Encryption prevents snooping of communications, and authentication helps prevent malicious servers or agents from causing problems in your cluster.

  Cloudera Manager supports three levels of TLS security. It is necessary to work through the configuration of Level 1, and then Level 2 TLS to be able to configure Level 3 encryption. The configurations build on each other to reach Level 3 which is the strongest level of TLS security.

  翻译就是:

  传输层安全性(TLS)在Cloudera Manager服务器和代理之间的通信中提供加密和身份验证。 加密可防止通信侦听,并且身份验证有助于防止恶意服务器或代理在群集中引起问题。
  Cloudera Manager支持三种级别的TLS安全性。 有必要通过配置1级,然后2级TLS才能配置3级加密。 配置相互建立,达到3级,这是TLS安全性最强的级别。

  • Level 1 (Good) - This level only configures encrypted communication between the browser and Cloudera Manager, and between Agents and the Cloudera Manager Server. See Configuring TLS Encryption Only for Cloudera Manager followed by Level 1: Configuring TLS Encryption for Cloudera Manager Agents for instructions. Level 1 encryption prevents snooping of commands and controls ongoing communication between the Agents and Cloudera Manager.
  • Level 2 (Better) - This level includes encrypted communication between the Agents and the Server, as well as strong verification of the Cloudera Manager Server certificate by the Agents. See Level 2: Configuring TLS Verification of Cloudera Manager Server by the Agents. Level 2 provides Agents with an additional level of security by verifying trust for the certificate presented by the Cloudera Manager Server.
  • Level 3 (Best) - Encrypted communication between the Agents and the Server. Level 3 TLS includes encrypted communication between the Agents and the Server, strong verification of the Cloudera Manager Server certificate by the Agents and authentication of Agents to the Cloudera Manager Server using self-signed or CA-signed certs. See Level 3: Configuring TLS Authentication of Agents to the Cloudera Manager Server. Level 3 addresses the untrusted network scenario where you need to prevent cluster Servers being spoofed by untrusted Agents running on a host. Cloudera recommends you configure Level 3 TLS encryption for untrusted network environments before enabling Kerberos authentication. This provides secure communication of keytabs between the Cloudera Manager Server and verified Agents across the cluster.

  翻译就是:

  级别1(好) - 此级别仅配置浏览器和Cloudera Manager之间以及代理和Cloudera Manager服务器之间的加密通信。请参阅仅为Cloudera Manager配置TLS加密,然后按照级别1:为Cloudera Manager代理配置TLS加密,以获取说明。 1级加密可以防止对代理和Cloudera Manager之间的通信进行窥探。
  级别2(更好) - 此级别包括代理和服务器之间的加密通信,以及代理对Cloudera Manager服务器证书的强大验证。请参阅第2级:由代理配置Cloudera Manager服务器的TLS验证。级别2通过验证由Cloudera Manager服务器提供的证书的信任,为代理提供额外的安全级别。
  级别3(最佳) - 代理和服务器之间的加密通信。 3级TLS包括代理和服务器之间的加密通信,由代理对Cloudera Manager服务器证书进行强大的验证,并使用自签名或CA签名的证书将代理验证到Cloudera Manager服务器。请参阅第3级:将代理的TLS验证配置到Cloudera Manager服务器。级别3解决了不受信任的网络场景,您需要防止群集服务器被主机上运行的不受信任的代理人欺骗。 Cloudera建议您在启用Kerberos身份验证之前,为不受信任的网络环境配置3级TLS加密。这提供了Cloudera Manager服务器和集群中经过验证的代理之间的keytab的安全通信。

 

  

  To enable TLS encryption for all connections between your Web browser running the Cloudera Manager Admin Console and the Cloudera Manager Server, see the first 2 steps of Level 1: Configuring TLS Encryption for Cloudera Manager Agents.

  For more details on how various aspects of HTTPS communication are handled by the Cloudera Manager Agents and the Cloudera Management Services daemons, see HTTPS Communication in Cloudera Manager.

  翻译就是:

  要启用运行Cloudera Manager管理控制台和Cloudera Manager服务器的Web浏览器之间的所有连接的TLS加密,请参阅Level 1:为Cloudera Manager代理配置TLS加密的前两步。

  有关如何通过Cloudera Manager代理和Cloudera管理服务守护程序处理HTTPS通信的各个方面的更多详细信息,请参阅Cloudera Manager中的HTTPS通信。

 

  我这里选择, Level 1: Configuring TLS Encryption for Cloudera Manager Agents

欢迎大家,加入我的微信公众号:大数据躺过的坑        人工智能躺过的坑
 
 
 

同时,大家可以关注我的个人博客

   http://www.cnblogs.com/zlslch/   和     http://www.cnblogs.com/lchzls/      http://www.cnblogs.com/sunnyDream/   

   详情请见:http://www.cnblogs.com/zlslch/p/7473861.html

  人生苦短,我愿分享。本公众号将秉持活到老学到老学习无休止的交流分享开源精神,汇聚于互联网和个人学习工作的精华干货知识,一切来于互联网,反馈回互联网。
  目前研究领域:大数据、机器学习、深度学习、人工智能、数据挖掘、数据分析。 语言涉及:Java、Scala、Python、Shell、Linux等 。同时还涉及平常所使用的手机、电脑和互联网上的使用技巧、问题和实用软件。 只要你一直关注和呆在群里,每天必须有收获

对应本平台的讨论和答疑QQ群:大数据和人工智能躺过的坑(总群)(161156071) 


安装cloudermanager时如何正确Configuring TLS Security for Cloudera Manager的更多相关文章

  1. windows7 安装Apache2时出现failed to open the winNT service manager 提示

    因为电脑实在太慢了,C盘的空间所剩无几,要想再安装大一点的软件的话,可能性很小.加之系统已经好久没有重装过了,于是重新安装windows7旗舰版,系统装好后,免不了一堆软件的重装和开发环境配置,首要的 ...

  2. 安装cloudermanager时出现org.spingframework.web.bind.***** host[] is not present at AnnotationMethodHandlerAdapter.java line 738 ****错误(图文详解)(博主推荐)

    不多说,直接上干货! 首先,这个问题,写给需要帮助的朋友们,本人在此,搜索资料近半天,才得以解决.看过国内和国外,资料甚少.特此,写此博客,为了弥补此错误解决的资料少的缘故! 问题详解  解决办法   ...

  3. 安装cloudermanager时出现Acquiring installation lock问题(图文详解)

    不多说,直接上干货! 问题详情 解决办法 哪一个节点被锁就删除哪一个. 解决办法:进入/tmp 目录,ls -a查看,删除scm_prepare_node.*的文件,以及.scm_prepare_no ...

  4. 通过Cloudera Manager安装CDH 5.6

    CDH的简介 大家常常说CDH.其全称是:Cloudera's Distribution Including Apache Hadoop.简单的说是Cloudera公司的Hadoop平台,是在Apac ...

  5. Cloudera Manager 4.6 安装部署hadoop CDH集群

    Cloudera Manager 4.6 安装详解 1. Cloudera Manager介绍 1.1. 功能介绍 Cloudera Manager是一个针对hadoop集群的管理工具,功能包括:cd ...

  6. Cloudera Manager Free Edition 4.1 和CDH 4.1.2 简易安装教学

    转载:http://fenriswolf.me/2012/12/06/cloudera-manager-free-edition-4-1-和-cdh-4-1-2-简易安装教学/ 安装及管理一个大的Ha ...

  7. Cloudera Manager安装之Cloudera Manager 5.3.X安装(三)(tar方式、rpm方式和yum方式)

    不多说,直接上干货! 福利每天都有  =>  =>=>=>=> 欢迎大家,关注微信扫码并加入我的4个微信公众号:   大数据躺过的坑      Java从入门到架构师  ...

  8. 离线安装Cloudera Manager 5和CDH5(最新版5.1.3) 完全教程

    关于CDH和Cloudera Manager CDH (Cloudera's Distribution, including Apache Hadoop),是Hadoop众多分支中的一种,由Cloud ...

  9. 离线安装 Cloudera Manager 5 和 CDH5.10

    关于CDH和Cloudera Manager CDH (Cloudera's Distribution, including Apache Hadoop),是Hadoop众多分支中的一种,由Cloud ...

随机推荐

  1. java 生成20位唯一ID,生成不会重复的20位数字----https://blog.csdn.net/weixin_36751895/article/details/70331781

    java 生成20位唯一ID,生成不会重复的20位数字----https://blog.csdn.net/weixin_36751895/article/details/70331781

  2. Codeforces Round #544 (Div. 3) Editorial C. Balanced Team

    http://codeforces.com/contest/1133/problem/Ctime limit per test 2 secondsmemory limit per test 256 m ...

  3. [K/3Cloud]在插件中根据条件取消表单打开过程

    新建一个类,继承自动态表单抽象插件类AbstractBillPlugIn,重写PreOpenForm. /// <summary> /// 销售订单 单据维护界面插件 /// </s ...

  4. (13)Corner Detection角点检测

    import cv2 import numpy as np img=cv2.imread('opencv-corner-detection-sample.jpg') gray = cv2.cvtCol ...

  5. (三)用openCV在图片上绘画标记

    1.在图片上画图(直线,矩形,圆形,多边形) import numpy as np import cv2 img = cv2.imread('watch.jpg',cv2.IMREAD_COLOR) ...

  6. [bzoj 1025][SCOI2009]游戏(DP)

    题目:http://www.lydsy.com/JudgeOnline/problem.php?id=1025 分析:首先这个问题等价于A1+A2+……Ak=n,求lcm(A1,A2,……,Ak)的种 ...

  7. android 视频开发2分之1(仿美拍,糗百)

    近期比較忙,非常久没更新博客,今天我们仿一个美拍或者糗事百科的录像功能. 首先确认步奏: 1.打开摄像头: 2.開始录制: 3.支持分段录制,并支持分段删除: 4.把分段录制的视频进行合并: 不说废话 ...

  8. 自由宣言--《I Have a Dream》(马丁.路德.金)

    I Have a Dream by Martin Luther King, Jr. I am happy to join with you today in what will go down in ...

  9. hdu 5950 Recursive sequence

    题意:告诉你数列的递推公式为f(n+1)=f(n)+2*f(n-1)+(n+1)^4 以及前两项a,b:问第n项为多少,结果对2147493647取模. 题解:有递推公式,马上应该就能想到矩阵快速幂: ...

  10. 玩转iOS开发 - 视图控制器生命周期

    视图控制器生命周期