Configuring Hadoop Data Encryption During Transmission
During big data cluster running, Hadoop components (such as HDFS, YARN, Spark, and HBase) transmit data and instructions via RPC channels. By default, these communication channels are unencrypted, transmitting data in plaintext across the network. When deploying a cluster on a public or untrusted network, unencrypted data can be intercepted by a man-in-the-middle (MITM), causing sensitive data leaks. How can you encrypt data transmission channels between Hadoop components? MRS enables you to modify Hadoop component configuration parameters to turn on encryption protocols for RPC and data transmission channels, ensuring secure transmission. Additionally, you can configure the maximum number of concurrent web connections to prevent service outages caused by overload.
Configuring Security Channel Encryption for Hadoop Components
Encrypted channel is an encryption protocol of remote procedure call (RPC) in HDFS. When a user invokes an RPC, the user's login name will be transmitted to RPC through RPC head. Then RPC uses Simple Authentication and Security Layer (SASL) to determine an authorization protocol (Kerberos and DIGEST-MD5) to complete RPC authorization.
By default, the communication between components in the big data cluster is not encrypted. However, the communication can be encrypted to prevent data interception on the Internet or an untrusted network.
To do this, you just need to set related parameters to control whether to encrypt RPC channels of all Hadoop modules. The settings take effect globally.
RPC channels in Hadoop include:
- RPC channels for clients to access HDFS
- RPC channels between HDFS modules, for example, between DataNode and NameNode
- RPC channels for clients to access YARN
- RPC channels between NodeManager and ResourceManager
- RPC channels for Spark to access YARN and HDFS
- RPC channels for MapReduce to access YARN and HDFS
- RPC channels for HBase to access HDFS
The following procedure applies to setting parameters on the HDFS component configuration page. These settings take effect globally, so the RPC channel encryption status affects all Hadoop modules.
- Go to the HDFS service configuration page and update the data transmission encryption parameters.
On MRS Manager, choose Cluster > Services > Target service name. Click Configurations and then All Configurations. Search for the parameter name in the search box and change the parameter. Restart the corresponding service for the changes to take effect.
- Refer to the following table to set the parameters based on your service security requirements.
Table 1 Parameter description Service
Parameter
Description
Default Value
HDFS
hadoop.rpc.protection
Whether to encrypt the RPC channels of each module in Hadoop.
- privacy: indicates that the RPC channels are encrypted, and the authentication, integrity, and privacy functions are enabled. This mode may degrade the performance.
- integrity: indicates that the RPC channels are not encrypted, and only the authentication and integrity functions are enabled. To ensure data security, exercise caution when using this mode.
- authentication: indicates that the RPC channels are not encrypted, and only the authentication packet is required. The integrity and privacy are not required. This mode ensures performance but has security risks.
This parameter takes effect globally after being configured. That is, the RPC channel encryption setting applies to every Hadoop module.
- This setting takes effect only after you restart the service. Rolling restarts are not supported.
- After configuring this setting, you must download the client configuration file again. Otherwise, HDFS cannot provide read and write services.
- Security mode: privacy
- Normal mode: authentication
HDFS
dfs.encrypt.data.transfer
Whether to encrypt the Data Transfer (DT) channels through which the client accesses DataNodes and the data transmission channels between DataNodes.
This parameter is used only when hadoop.rpc.protection is set to privacy. Note that enabling encryption by default may severely affect performance when a large amount of service data is transmitted.
If data transmission encryption is configured for one cluster in a pair of trusted clusters, data transmission encryption must also be configured for the peer cluster.
- true: indicates that the channels are encrypted.
- false: indicates that the channels are not encrypted.
false
HDFS
dfs.encrypt.data.transfer.algorithm
Indicates the encryption algorithm of the HDFS data transfer channels and the channels for clients to access HDFS. This parameter is available only when dfs.encrypt.data.transfer is set to true.
- 3des: default value, which indicates that the 3DES algorithm is used to encrypt data.
- rc4: indicates that the RC4 algorithm is used to encrypt data. This value is not recommended because it may cause security risks.
3des
HDFS
dfs.encrypt.data.transfer.cipher.suites
The password suite for data encryption.
This parameter can be left empty or set to AES/CTR/NoPadding. If this parameter is left empty, the encryption algorithm specified by dfs.encrypt.data.transfer.algorithm is used to encrypt data.
AES/CTR/NoPadding
HBase
hbase.rpc.protection
Whether to encrypt HBase channels, including the RPC channels for HBase clients to access the HBase server and the RPC channels between the HMaster and RegionServer.
- privacy: indicates that the RPC channels are encrypted, and the authentication, integrity, and privacy functions are enabled.
- integrity: indicates that the RPC channels are not encrypted, and only the authentication and integrity functions are enabled.
- authentication: indicates that the RPC channels are not encrypted, and only the authentication packet is required. The integrity and privacy are not required.
The privacy mode encrypts transmitted content, including sensitive information such as user tokens. This mode ensures the security of transmitted information, but has a great impact on performance. Compared with the other two modes, this mode reduces the read/write performance by about 60%.
Modify the configuration based on the enterprise security requirements. The configuration items on the client and server must be the same.
- Security mode: privacy
- Normal mode: authentication
- Verify the configuration.
On MRS Manager, choose Cluster > Services > HDFS > Dashboard, and check whether the HDFS service status is normal.
Use the newly downloaded client to read and write HDFS files, and verify that data transmission encryption is enabled (by checking for encrypted handshake logs on the DataNode).
Setting the Maximum Number of Concurrent Web Connections
When configuring data transmission encryption, the cluster administrator may also need to ensure web server reliability. When many users access the web service simultaneously, the service can become overloaded or unavailable. By setting the maximum number of concurrent web connections, you can limit new user connections to prevent overload-induced service outages and protect against DDoS attacks.
- On MRS Manager, choose Cluster > Services > Target service name. Click Configurations and then All Configurations. Search for the parameter name in the search box and change the parameter. Restart the corresponding service for the changes to take effect.
- Refer to the following table to set the parameters based on your service requirements.
Table 2 Parameter description Service
Parameter
Description
Default Value
HDFS/Yarn
hadoop.http.server.MaxRequests
Specifies the maximum number of concurrent web connections for each component. When the number of concurrent connections reaches this limit, new connections are rejected. We recommend adjusting this value based on your cluster size and concurrent user count. The default value of 2000 works for most scenarios.
2000
Spark/Spark2x
spark.connection.maxRequest
Specifies the maximum number of request connections allowed by JobHistory. When concurrent requests reach this limit, new requests are rejected. We recommend adjusting this value based on the number of concurrent Spark jobs.
5000
- Verify the configuration.
After restarting the service, open the web page in a browser and verify that it loads correctly. You can simulate concurrent requests to test whether the connection limit works.
