Skip to content

Commit 2e67f4e

Browse files
mneethirajmneethiraj
committed
RANGER-5383: updated plugin install to support configurations for Kerberized Solr audit destination
1 parent c731ac3 commit 2e67f4e

31 files changed

Lines changed: 314 additions & 4 deletions

‎hbase-agent/conf/ranger-hbase-audit-changes.cfg‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,16 @@ xasecure.audit.destination.solr.user %XAAUDIT.SOLR.USER% mod create-if-not-exist
4747
xasecure.audit.destination.solr.password %XAAUDIT.SOLR.PASSWORD% mod create-if-not-exists
4848
xasecure.audit.destination.solr.zookeepers %XAAUDIT.SOLR.ZOOKEEPER% mod create-if-not-exists
4949
xasecure.audit.destination.solr.batch.filespool.dir %XAAUDIT.SOLR.FILE_SPOOL_DIR% mod create-if-not-exists
50+
xasecure.audit.destination.solr.force.use.inmemory.jaas.config %XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG% mod create-if-not-exists
51+
52+
xasecure.audit.jaas.Client.loginModuleName %XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME% mod create-if-not-exists
53+
xasecure.audit.jaas.Client.loginModuleControlFlag %XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG% mod create-if-not-exists
54+
xasecure.audit.jaas.Client.option.useKeyTab %XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB% mod create-if-not-exists
55+
xasecure.audit.jaas.Client.option.storeKey %XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY% mod create-if-not-exists
56+
xasecure.audit.jaas.Client.option.useTicketCache %XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE% mod create-if-not-exists
57+
xasecure.audit.jaas.Client.option.serviceName %XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME% mod create-if-not-exists
58+
xasecure.audit.jaas.Client.option.keyTab %XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB% mod create-if-not-exists
59+
xasecure.audit.jaas.Client.option.principal %XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL% mod create-if-not-exists
5060

5161
xasecure.audit.destination.elasticsearch %XAAUDIT.ELASTICSEARCH.ENABLE% mod create-if-not-exists
5262
xasecure.audit.destination.elasticsearch.urls %XAAUDIT.ELASTICSEARCH.URL% mod create-if-not-exists

‎hbase-agent/scripts/install.properties‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,16 @@ XAAUDIT.SOLR.USER=NONE
5555
XAAUDIT.SOLR.PASSWORD=NONE
5656
XAAUDIT.SOLR.ZOOKEEPER=NONE
5757
XAAUDIT.SOLR.FILE_SPOOL_DIR=/var/log/hbase/audit/solr/spool
58+
XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=false
59+
60+
XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=com.sun.security.auth.module.Krb5LoginModule
61+
XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=required
62+
XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=true
63+
XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=true
64+
XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=false
65+
XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=serviceName
66+
XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=/path/to/service.keytab
67+
XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=principal/hostname@REALM
5868

5969
# Enable audit logs to ElasticSearch
6070
#Example

‎hdfs-agent/conf/ranger-hdfs-audit-changes.cfg‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,16 @@ xasecure.audit.destination.solr.user %XAAUDIT.SOLR.USER% mod create-if-not-exist
4444
xasecure.audit.destination.solr.password %XAAUDIT.SOLR.PASSWORD% mod create-if-not-exists
4545
xasecure.audit.destination.solr.zookeepers %XAAUDIT.SOLR.ZOOKEEPER% mod create-if-not-exists
4646
xasecure.audit.destination.solr.batch.filespool.dir %XAAUDIT.SOLR.FILE_SPOOL_DIR% mod create-if-not-exists
47+
xasecure.audit.destination.solr.force.use.inmemory.jaas.config %XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG% mod create-if-not-exists
48+
49+
xasecure.audit.jaas.Client.loginModuleName %XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME% mod create-if-not-exists
50+
xasecure.audit.jaas.Client.loginModuleControlFlag %XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG% mod create-if-not-exists
51+
xasecure.audit.jaas.Client.option.useKeyTab %XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB% mod create-if-not-exists
52+
xasecure.audit.jaas.Client.option.storeKey %XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY% mod create-if-not-exists
53+
xasecure.audit.jaas.Client.option.useTicketCache %XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE% mod create-if-not-exists
54+
xasecure.audit.jaas.Client.option.serviceName %XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME% mod create-if-not-exists
55+
xasecure.audit.jaas.Client.option.keyTab %XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB% mod create-if-not-exists
56+
xasecure.audit.jaas.Client.option.principal %XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL% mod create-if-not-exists
4757

4858
xasecure.audit.destination.elasticsearch %XAAUDIT.ELASTICSEARCH.ENABLE% mod create-if-not-exists
4959
xasecure.audit.destination.elasticsearch.urls %XAAUDIT.ELASTICSEARCH.URL% mod create-if-not-exists

‎hdfs-agent/scripts/install.properties‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,16 @@ XAAUDIT.SOLR.USER=NONE
4949
XAAUDIT.SOLR.PASSWORD=NONE
5050
XAAUDIT.SOLR.ZOOKEEPER=NONE
5151
XAAUDIT.SOLR.FILE_SPOOL_DIR=/var/log/hadoop/hdfs/audit/solr/spool
52+
XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=false
53+
54+
XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=com.sun.security.auth.module.Krb5LoginModule
55+
XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=required
56+
XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=true
57+
XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=true
58+
XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=false
59+
XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=serviceName
60+
XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=/path/to/service.keytab
61+
XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=principal/hostname@REALM
5262

5363
# Enable audit logs to ElasticSearch
5464
#Example

‎hive-agent/conf/ranger-hive-audit-changes.cfg‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,16 @@ xasecure.audit.destination.solr.user %XAAUDIT.SOLR.USER% mod create-if-not-exist
4545
xasecure.audit.destination.solr.password %XAAUDIT.SOLR.PASSWORD% mod create-if-not-exists
4646
xasecure.audit.destination.solr.zookeepers %XAAUDIT.SOLR.ZOOKEEPER% mod create-if-not-exists
4747
xasecure.audit.destination.solr.batch.filespool.dir %XAAUDIT.SOLR.FILE_SPOOL_DIR% mod create-if-not-exists
48+
xasecure.audit.destination.solr.force.use.inmemory.jaas.config %XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG% mod create-if-not-exists
49+
50+
xasecure.audit.jaas.Client.loginModuleName %XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME% mod create-if-not-exists
51+
xasecure.audit.jaas.Client.loginModuleControlFlag %XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG% mod create-if-not-exists
52+
xasecure.audit.jaas.Client.option.useKeyTab %XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB% mod create-if-not-exists
53+
xasecure.audit.jaas.Client.option.storeKey %XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY% mod create-if-not-exists
54+
xasecure.audit.jaas.Client.option.useTicketCache %XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE% mod create-if-not-exists
55+
xasecure.audit.jaas.Client.option.serviceName %XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME% mod create-if-not-exists
56+
xasecure.audit.jaas.Client.option.keyTab %XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB% mod create-if-not-exists
57+
xasecure.audit.jaas.Client.option.principal %XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL% mod create-if-not-exists
4858

4959
xasecure.audit.destination.elasticsearch %XAAUDIT.ELASTICSEARCH.ENABLE% mod create-if-not-exists
5060
xasecure.audit.destination.elasticsearch.urls %XAAUDIT.ELASTICSEARCH.URL% mod create-if-not-exists

‎hive-agent/scripts/install.properties‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,16 @@ XAAUDIT.SOLR.USER=NONE
5252
XAAUDIT.SOLR.PASSWORD=NONE
5353
XAAUDIT.SOLR.ZOOKEEPER=NONE
5454
XAAUDIT.SOLR.FILE_SPOOL_DIR=/var/log/hive/audit/solr/spool
55+
XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=false
56+
57+
XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=com.sun.security.auth.module.Krb5LoginModule
58+
XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=required
59+
XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=true
60+
XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=true
61+
XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=false
62+
XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=serviceName
63+
XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=/path/to/service.keytab
64+
XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=principal/hostname@REALM
5565

5666
# Enable audit logs to ElasticSearch
5767
#Example

‎kms/scripts/install.properties‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -197,6 +197,16 @@ XAAUDIT.SOLR.USER=NONE
197197
XAAUDIT.SOLR.PASSWORD=NONE
198198
XAAUDIT.SOLR.ZOOKEEPER=NONE
199199
XAAUDIT.SOLR.FILE_SPOOL_DIR=/var/log/ranger/kms/audit/solr/spool
200+
XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=false
201+
202+
XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=com.sun.security.auth.module.Krb5LoginModule
203+
XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=required
204+
XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=true
205+
XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=true
206+
XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=false
207+
XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=serviceName
208+
XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=/path/to/service.keytab
209+
XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=principal/hostname@REALM
200210

201211
# Enable audit logs to ElasticSearch
202212
#Example

‎knox-agent/conf/ranger-knox-audit-changes.cfg‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,16 @@ xasecure.audit.destination.solr.user %XAAUDIT.SOLR.USER% mod create-if-not-exist
4545
xasecure.audit.destination.solr.password %XAAUDIT.SOLR.PASSWORD% mod create-if-not-exists
4646
xasecure.audit.destination.solr.zookeepers %XAAUDIT.SOLR.ZOOKEEPER% mod create-if-not-exists
4747
xasecure.audit.destination.solr.batch.filespool.dir %XAAUDIT.SOLR.FILE_SPOOL_DIR% mod create-if-not-exists
48+
xasecure.audit.destination.solr.force.use.inmemory.jaas.config %XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG% mod create-if-not-exists
49+
50+
xasecure.audit.jaas.Client.loginModuleName %XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME% mod create-if-not-exists
51+
xasecure.audit.jaas.Client.loginModuleControlFlag %XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG% mod create-if-not-exists
52+
xasecure.audit.jaas.Client.option.useKeyTab %XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB% mod create-if-not-exists
53+
xasecure.audit.jaas.Client.option.storeKey %XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY% mod create-if-not-exists
54+
xasecure.audit.jaas.Client.option.useTicketCache %XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE% mod create-if-not-exists
55+
xasecure.audit.jaas.Client.option.serviceName %XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME% mod create-if-not-exists
56+
xasecure.audit.jaas.Client.option.keyTab %XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB% mod create-if-not-exists
57+
xasecure.audit.jaas.Client.option.principal %XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL% mod create-if-not-exists
4858

4959
xasecure.audit.destination.elasticsearch %XAAUDIT.ELASTICSEARCH.ENABLE% mod create-if-not-exists
5060
xasecure.audit.destination.elasticsearch.urls %XAAUDIT.ELASTICSEARCH.URL% mod create-if-not-exists

‎knox-agent/scripts/install.properties‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,16 @@ XAAUDIT.SOLR.USER=NONE
4747
XAAUDIT.SOLR.PASSWORD=NONE
4848
XAAUDIT.SOLR.ZOOKEEPER=NONE
4949
XAAUDIT.SOLR.FILE_SPOOL_DIR=/var/log/knox/audit/solr/spool
50+
XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=false
51+
52+
XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=com.sun.security.auth.module.Krb5LoginModule
53+
XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=required
54+
XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=true
55+
XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=true
56+
XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=false
57+
XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=serviceName
58+
XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=/path/to/service.keytab
59+
XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=principal/hostname@REALM
5060

5161
# Enable audit logs to ElasticSearch
5262
#Example
@@ -173,4 +183,4 @@ CUSTOM_USER=knox
173183
# Custom component group
174184
# CUSTOM_COMPONENT_GROUP=<custom-group>
175185
# keep blank if component group is default
176-
CUSTOM_GROUP=knox
186+
CUSTOM_GROUP=knox

‎plugin-atlas/scripts/install.properties‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,16 @@ XAAUDIT.SOLR.URL=NONE
5151
XAAUDIT.SOLR.USER=NONE
5252
XAAUDIT.SOLR.PASSWORD=NONE
5353
XAAUDIT.SOLR.ZOOKEEPER=NONE
54+
XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=false
55+
56+
XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=com.sun.security.auth.module.Krb5LoginModule
57+
XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=required
58+
XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=true
59+
XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=true
60+
XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=false
61+
XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=serviceName
62+
XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=/path/to/service.keytab
63+
XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=principal/hostname@REALM
5464

5565
# Enable audit logs to ElasticSearch
5666
#Example

0 commit comments

Comments
 (0)