Welcome!

Hi, everyone, and welcome to The Hadoop Doctor blog. The idea of this blog is to offer troubleshooting steps, share knowledge and eventually...

9/30/2017

Cloudera Technical Service Bulletin 2017-237 (TSB): Keystore password for the Spark History Server not properly secured

Title: Keystore password for the Spark History Server not properly secured 

Products affected: Cloudera Manager

Releases affected: 5.11.0

Users affected: All users with TLS enabled for the Spark History Server.

Date/time of detection: April 18, 2017

Severity (Low/Medium/High): Medium

Impact: The keystore password for the Spark History Server is exposed in a world-readable file on the machine running the Spark History Server. The keystore file itself is not exposed.

The password is also visible in the Cloudera Manager UI, by looking at the Spark History Server process’s configuration files.

CVE: CVE-2017-9326

Immediate action required: Upgrade to Cloudera Manager 5.11.1.

Addressed in release/refresh/patch: 5.11.1 or higher.



For the latest update on this issue see the corresponding Knowledge article:

TSB 2017-237: Keystore password for the Spark History Server not properly secured



All rights belong to: Cloudera, Inc. 395 Page Mill Rd, 3rd Floor · Palo Alto, CA 94306 USA

Cloudera Technical Service Bulletin 2017-242 (TSB): CDH Services crash with Java Virtual Machine error after application of Linux Security Kernel Patch for CVE-2017-1000364

CDH Services crash with Java Virtual Machine error after application of Linux Security Kernel Patch for CVE-2017-1000364

Cloudera has received a number of customer cases where CDH services using the JSVC set of libraries crash with a Java Virtual Machine error in CDH clusters after applying a recent Kernel Security Patch. The list below contains the announcements about the patch for a number of distributions.
We have been able to reproduce Cloudera services not starting after the application of the original patch.

Products affected: Impala, HDFS DataNodes, HDFS NFS Gateway

Releases affected: Any CDH release that runs on RHEL, CentOS, Oracle Linux, SUSE Linux and Ubuntu where this Security Kernel Patch is applied.

Users affected: All Impala & HDFS users

Severity (Low/Medium/High): High

Impact:

After applying the patch the service's daemon crashes with an error similar to the following:

----
> #
> # A fatal error has been detected by the Java Runtime Environment:
> #
> # SIGBUS (0x7) at pc=0x00007fe91ef6cebc, pid=30321, tid=0x00007fe930c67700
> #
> ----

Immediate action required:

Apply a kernel update containing the fix for your Operating System.

If you are unable to apply a kernel update, the Java thread stack size may be set for the affected service(s). The Java Configuration Options will need to include the following value: "-Xss1280k". For roles that do not have a parameter for Java Configuration Options in Cloudera Manager, the value will need to be set in the Environment Advanced Configuration Snippet (Safety Valve).

Example for adding the value in the Java Configuration Options:
  1. In Cloudera Manager, Navigate to Impala > Configuration > Category (Advanced)
  2. Type “Java Configuration Options” in the configuration search box and locate the required field
  3. Add “-Xss1280k” to the field
  4. Save Changes and restart the affected roles
Example for adding the value in the Advanced Configuration Snippet (Safety Valve):
  1. In Cloudera Manager, Navigate to Impala > Configuration > Category (Advanced)
  2. Type “Advanced Configuration Snippet” in the configuration search box and locate the required field
  3. Add “JAVA_TOOL_OPTIONS=-Xss1280k” to the field.
  4. Save Changes and restart the affected roles
The parameters to change for all affected services are shown in the table below.

ServiceParameter
 HDFS DataNodes Java Configuration Options for DataNode
 HDFS NFS Gateway Java Configuration Options for NFS Gateway
 Impala Impala Service Environment Advanced Configuration Snippet (Safety Valve)
 Impala Java Configuration Options for Catalog Server
 Impala Impala Daemon Environment Advanced Configuration Snippet






All rights belong to: Cloudera, Inc. 395 Page Mill Rd, 3rd Floor · Palo Alto, CA 94306 USA

Cloudera Technical Service Bulletin 2017-236 (TSB): Sample solrconfig.xml file for enabling Solr/Sentry Authorization is missing critical attribute

Title: Sample solrconfig.xml file for enabling Solr/Sentry Authorization is missing critical attribute 
The solrconfig.xml.secure sample configuration which was provided with CDH, if used to create solrconfig.xml, does not enforce Sentry authorization on the request URI /update/json/docs because it is missing a necessary attribute.
Products affected: Solr (if Sentry enabled)
Releases affected:
CDH 5.8 and lower
CDH 5.9.2 and lower
CDH 5.10.1 and lower
CDH 5.11.1 and lower
Users affected: Those who are using Sentry authorization with Cloudera Search and who have used the provided sample configuration and have not specified the below attributes in their solrconfig.xml file.
Date/time of detection: May 18, 2017
Detected by: István Farkas, Hrishikesh Gadre
Severity (Low/Medium/High): High

Impact: 
Unauthorized users using the request URI /update/json/docs may insert, update, or delete documents.
CVE: CVE-2017-9325

Immediate action required: 
Every solrconfig.xml of a collection protected by Sentry should be updated in Zookeeper.
Line of:
<updateRequestProcessorChain name="updateIndexAuthorization">
Must be replaced with
 
<updateRequestProcessorChain name="updateIndexAuthorization" default="true">
After updating the configuration in Zookeeper, the collections must be reloaded.
Addressed in release/refresh/patch:
The following releases will contain the fixed sample configuration file.
CDH 5.9.3 and higher
CDH 5.10.2 and higher
CDH 5.11.2 and higher
CDH 5.12.0 and higher
Upgrading will only correct the sample configuration file. The fix mentioned above will still need to be applied on the affected cluster.
For the latest update on this issue see the corresponding Knowledge article: 

TSB 2017-236: Sample solrconfig.xml file for enabling Solr/Sentry Authorization is missing critical attribute

All rights belong to: Cloudera, Inc. 395 Page Mill Rd, 3rd Floor · Palo Alto, CA 94306 USA

Cloudera Technical Service Bulletin 2017-226 (TSB): Impala Statestore exposes plaintext data with SSL TLS enabled

Title: Impala Statestore exposes plaintext data with SSL TLS enabled 
During a security analysis, Cloudera found that despite TLS being enabled for “internal” Impala ports, the Statestore thrift port did not actually use TLS. This gap would allow an adversary with network access to eavesdrop and potentially modify the packets going to and coming from that port.
Products affected: Impala
Releases affected:
CDH 5.7 and lower
CDH 5.8.0, 5.8.1, 5.8.2, 5.8.3, 5.8.4
CDH 5.9.0, 5.9.1, 5.9.2
CDH 5.10.0, 5.10.1
CDH 5.11.0
Users affected: Deployments that use “internal” TLS (TLS between Impala daemons).
Date/time of detection: April 27, 2017
Detected by: Cloudera
Severity (Low/Medium/High): High
Impact: Data on the wire may be intercepted by a malicious server.
CVE: CVE-2017-5652
Immediate action required: Affected customers should upgrade to latest maintenance version with the fix.
Addressed in release/refresh/patch:
CDH 5.8.5, CDH 5.9.3, CDH 5.10.2, CDH 5.11.1, CDH 5.12.0
For the latest update on this issue see the corresponding Knowledge article: 

TSB 2017-226: Impala Statestore exposes plaintext data with SSL TLS enabled

All rights belong to: Cloudera, Inc. 395 Page Mill Rd, 3rd Floor · Palo Alto, CA 94306 USA

September Cloudera Customer Advisory

Key Distribution Center (KDC) may be overwhelmed on large Kerberized Impala clusters

After cluster startup, when Impala runs a query that shuffles data amongst all nodes or a large subset of nodes in a Kerberos-secured cluster, every node will need to acquire a Ticket Granting Server (TGS) for every other node. In a cluster of hundreds of nodes or more, this can overwhelm the KDC, and queries can exit with an error ("Could not contact KDC for realm").

For example, queries that could fail with kerberos errors just after cluster startup are those that involve one or more joins on large tables that have data spread out over the entire cluster.

Users affected:

Affected users are those running Kerberized Impala clusters with 100 nodes or up.

Impact:

Failed queries for a few minutes immediately after cluster startup.

Action required:

A simple workaround is to run a warm-up query a few times until all the tickets are established (which can take a few minutes after cluster startup). Any KDC related errors from the warm-up query can be ignored, since they are expected.

An example query is given below:

   select count(*) from t1 join [SHUFFLE] t2;

t1 should be a large table whose data is spread on all hosts.
t2 can be a table that has a moderate amount of data, i.e. around 200M-300M of data.

Once the service tickets are established between nodes, this will not be a problem until the said service tickets have to be renewed again, thereby incentivizing longer ticket lifetimes. A good balance between security and performance is to have tickets with the lifetime of at least a day.

A secondary workaround is to scale the KDC (e.g. with secondary KDC nodes). If KDC’s are managed by Cloudera Manager, please follow the documentation found here.



All rights belong to: Cloudera, Inc. 395 Page Mill Rd, 3rd Floor · Palo Alto, CA 94306

Cloudera Technical Service Bulletin 2017-249: Unsafe deserialization in Apache Spark launcher API

Title: Unsafe deserialization in Apache Spark launcher API 
In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the SparkLauncher#startApplication() API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine. It does not affect apps run by spark-submit or spark-shell. The attacker would be able to execute code as the user that ran the Spark application. Users are encouraged to update to Spark version 2.2.0 or later.
Products affected: Cloudera's distribution of Apache Spark and Spark in CDH.
Releases affected: 
  • CDH: 5.9.0-5.9.2, 5.10.0-5.10.1, 5.11.0-5.11.1
  • Cloudera's Distribution of Apache Spark: 2.0 Release 1, 2.0 Release 2, 2.1 Release 1
Users affected: All
Date/time of detection: June 1, 2017
Detected by: Aditya Sharad (Semmle)
Severity (Low/Medium/High): Medium
Impact: Privilege escalation to the user who ran the Spark application
CVE: CVE-2017-12612
Immediate action required: 
  • Spark 1.x users: update to CDH 5.9.3, 5.10.2, 5.11.2, or 5.12.0 or later
  • Spark 2.x users: update to Cloudera's Distribution of Apache Spark 2.2 Release 1 or later
  • Or, discontinue use of the programmatic launcher API
Addressed in release/refresh/patch: 
  • CDH: 5.9.3, 5.10.2, 5.11.2, 5.12.0
  • Cloudera's Distribution of Apache Spark: 2.2 Release 1
For the latest update on this issue see the corresponding Knowledge article: 

TSB 2017-249: Unsafe deserialization in Apache Spark launcher API *

All rights belong to: Cloudera, Inc. 395 Page Mill Rd, 3rd Floor · Palo Alto, CA 94306

9/01/2017

Kafka - How to create a multi-node Apache Kafka cluster

Apache Kafka


MULTI-NODE CLUSTER CREATION


This guide covers the installation of a multi-node cluster only. Be aware that this setup is not compatible with Cloudera, Hortonworks or other vendors' clusters and it’s based on the official Apache Kafka documentation and steps for standalone clusters.

See also: Kafka - How to create a single-node Apache Kafka cluster

1.  Download Kafka


a. Log in via SSH to the first node that will be part of the Kafka cluster, switch to root user and download the Kafka tar file.
You can find out what the latest stable Kafka release is in https://kafka.apache.org:

$ sudo -i
$ mkdir /tmp/kafka
$ cd /tmp/kafka

b. Extract the tar file, create the required directories and copy the extracted files within, then apply specific permissions on them:

$ tar -xzf kafka_2.11-0.10.2.0.tgz
$ mkdir /usr/lib/kafka
$ chown -R root:root /usr/lib/kafka
$ rsync -av kafka_2.11-0.10.2.0/* /usr/lib/kafka/

Move to the /usr/lib/kafka directory and create a symlink between the config subdirectory and /etc/kafka/conf

$ mkdir /etc/kafka
$ cd /etc/kafka
$ ln -s /usr/lib/kafka/config /etc/kafka/conf

Create a directory for Kafka in /var/log and a symlink between /usr/lib/kafka/logs and /var/log/kafka/logs:

$ mkdir /var/log/kafka/
$ chmod -R 774 /var/log/kafka/
$ chown -R root:root /var/log/kafka/
$ cd /var/log/kafka
$ ln -s /usr/lib/kafka/logs /var/log/kafka/logs


c. Repeat the same process for the rest of the cluster’s nodes.


2.  Configure Kafka

In the below example, we will configure 3 broker nodes. Note that each broker will exist in a separate node as we are configuring a multi-node Kafka cluster.


a. Log in to the first node of the cluster

b. Look for the extra mounted disk (not covered in this guide) that will be used to store Kafka data. In the below example, the disk is mounted in /DATA

$ df -h



Create the Kafka’s data and Zookeeper directories, and apply permissions as below:

$ mkdir -p /DATA/kafka/data
$ chown -R root:root /DATA/kafka
$ chmod -R 775 /DATA/kafka

$ mkdir -p /DATA/kafka/zookeeper
$ chown -R root:root /DATA/kafka/zookeeper
$ chmod -R 775 /DATA/kafka/zookeeper

c. Create a backup of the original server.properties file:

$ cp /etc/kafka/conf/server.properties /etc/kafka/conf/server.properties.bkp

d. Create a backup of the original zookeeper.properties file

$ cp /etc/kafka/conf/zookeeper.properties /etc/kafka/conf/zookeeper.properties.bkp

e. Repeat the above steps for all the nodes in the cluster.

f. Edit the server.properties file and add/modify each line as shown below. Make sure to replace the lines that already exist instead of adding them twice. We will make these changes in all the nodes in the cluster:

Node 1:

$ vi /etc/kafka/conf/server.properties

broker.id=1
listeners=PLAINTEXT://:9092
log.dirs=/DATA/kafka/data
zookeeper.connect=<Node1_FQDN>:2181,<Node2_FQDN>:2181,<Node3_FQDN>:2181

Repeat the same for the rest of the nodes in the cluster. Make sure to increment the “broker.id” and the port in “listeners” as shown below.
Node 2:

$ vi /etc/kafka/conf/server.properties

broker.id=2
listeners=PLAINTEXT://:9093
log.dirs=/DATA/kafka/data
zookeeper.connect=<Node1_FQDN>:2181,<Node2_FQDN>:2181,<Node3_FQDN>:2181

Node 3:

$ vi /etc/kafka/conf/server.properties

broker.id=3
listeners=PLAINTEXT://:9094
log.dirs=/DATA/kafka/data
zookeeper.connect=<Node1_FQDN>:2181,<Node2_FQDN>:2181,<Node3_FQDN>:2181

Make sure to replace <Node#_FQDN> by the actual FQDN of each Kafka server.
          
g. Edit the zookeeper.properties file and add/modify each line as shown below. Make sure to replace the lines that already exist instead of adding them twice. We will make these changes in all the nodes in the cluster:

Node 1:

$ vi /etc/kafka/conf/zookeeper.properties

            dataDir=/DATA/kafka/zookeeper
            clientPort=2181
maxClientCnxns=0
server.1=<Node1_FQDN>:2888:3888
server.2=<Node1_FQDN>:2888:3888
server.3=<Node1_FQDN>:2888:3888
initLimit=5
syncLimit=2

Node 2:

$ vi /etc/kafka/conf/zookeeper.properties

            dataDir=/DATA/kafka/zookeeper
            clientPort=2181
maxClientCnxns=0
server.1=<Node1_FQDN>:2888:3888
server.2=<Node1_FQDN>:2888:3888
server.3=<Node1_FQDN>:2888:3888
initLimit=5
syncLimit=2

Node 3:

$ vi /etc/kafka/conf/zookeeper.properties

            dataDir=/DATA/kafka/zookeeper
            clientPort=2181
maxClientCnxns=0
server.1=<Node1_FQDN>:2888:3888
server.2=<Node1_FQDN>:2888:3888
server.3=<Node1_FQDN>:2888:3888
initLimit=5
syncLimit=2


       h. Create a “myid” file in the zookeeper directory as shown below. We will make these changes in all the nodes in the cluster, setting the myid number accordingly:

Node 1:

$ echo "1" > /DATA/kafka/zookeeper/myid
$ sudo chown root:root /DATA/kafka/zookeeper/myid
$ sudo chmod 644 /DATA/kafka/zookeeper/myid

Node 2:

$ echo "2" > /DATA/kafka/zookeeper/myid
$ sudo chown root:root /DATA/kafka/zookeeper/myid
$ sudo chmod 644 /DATA/kafka/zookeeper/myid

Node 3:

$ echo "3" > /DATA/kafka/zookeeper/myid
$ sudo chown root:root /DATA/kafka/zookeeper/myid
$ sudo chmod 644 /DATA/kafka/zookeeper/myid

          

i. Modify the permissions of the start and stop scripts so that no one other than root can execute them. We will make these changes in all the nodes in the cluster:

Node 1, 2 and 3:

$ cd /usr/lib/kafka/bin
$ chmod 774 zookeeper-server-start.sh zookeeper-server-stop.sh
$ chmod 774 kafka-server-start.sh kafka-server-stop.sh



3.  Start and Test Kafka


To start Kafka, we first need to start the embedded Zookeeper daemons in all the nodes, which will act as coordinators for the different Kafka brokers and their corresponding jobs.
Once the Zookeeper daemons are started, we can proceed to start the Kafka servers (a.k.a. brokers) as per our previous configuration.

  • To start all the above-mentioned daemons in the background, we will add the “-daemon” argument right before specifying the configuration files (where the daemons get the required settings to start).
  • To start the daemons in the foreground, no arguments must be passed to the script, other than including the configuration files (as mentioned above).


Since we’re starting the daemons for the first time, we will execute them in the foreground (using several different terminals) to easily visualize any error that may occur.

a. Log in to each Kafka node, then start the Zookeeper daemon in the foreground as root. Make sure to pay attention to the command’s output in case of any error:

Node 1:

$ sudo /usr/lib/kafka/bin/zookeeper-server-start.sh /etc/kafka/conf/zookeeper.properties

Node 2:

$ sudo /usr/lib/kafka/bin/zookeeper-server-start.sh /etc/kafka/conf/zookeeper.properties

Node 3:

$ sudo /usr/lib/kafka/bin/zookeeper-server-start.sh /etc/kafka/conf/zookeeper.properties


b. With separate terminals, log in to each Kafka node again and start each Kafka broker (configured as per the server.properties file on each node) in the foreground as root:

Node 1:

$ sudo /usr/lib/kafka/bin/kafka-server-start.sh /usr/lib/kafka/config/server.properties

Node 2:
           
$ sudo /usr/lib/kafka/bin/kafka-server-start.sh /usr/lib/kafka/config/server.properties

            Node 3:

$ sudo /usr/lib/kafka/bin/kafka-server-start.sh /usr/lib/kafka/config/server.properties


c. We now have Zookeeper running in all the nodes, as well as 3 instances of Kafka broker, one per node.

The next step will be to create a test topic with a replication factor of 3 (consistent with the number of brokers previously created). Make sure to replace <Node#_FQDN> by the actual FQDN of each of the Kafka nodes.
Open a new terminal connected to any node in the cluster and run the following command (in this example we’re using the Node 1):


Node 1:

$ sudo /usr/lib/kafka/bin/kafka-topics.sh --create --zookeeper <Node1_FQDN>:2181,<Node2_FQDN>:2181,<Node3_FQDN>:2181 --replication-factor 3 --partitions 1 --topic testtopic

You can validate the topic was created by running the below script:

$ /usr/lib/kafka/bin/kafka-topics.sh --describe --zookeeper <Node1_FQDN>:2181,<Node2_FQDN>:2181,<Node3_FQDN>:2181 --topic testtopic

d. Once the topic is created and validated, we can test the following scenarios:
·         Sending messages from a Kafka producer
·         Visualizing those messages in a Kafka consumer
·         Testing failover between the 3 brokers (i.e. force-stopping brokers to validate that the remaining ones keep on sending/receiving messages)


In a different node, execute a Kafka consumer pointing to our testtopic, which will listen for incoming messages from a Kafka producer (we will use Node 3 in this example):

Node 3:

$ /usr/lib/kafka/bin/kafka-console-consumer.sh --bootstrap-server <Node1_FQDN>:9092, <Node2_FQDN>:9093, <Node3_FQDN>:9094 --topic testtopic --from-beginning

Open another terminal, connect to a different node and execute a Kafka producer pointing to the same topic (in this example we’re using the Node 2):

Node 2:

$ /usr/lib/kafka/bin/kafka-console-producer.sh --broker-list <Node1_FQDN>:9092, <Node2_FQDN>:9093, <Node3_FQDN>:9094 --topic testtopic

Once the producer in Node 2 is started, type any message you want and press <ENTER> to submit it. You can send as much messages as you want.

Go back to the Node 3 and make sure that all messages are being received in the Kafka consumer console.
See thee below examples for clarification (disregard the number of brokers showed after “--broker-list”):

Producer terminal (sending messages)


Consumer terminal (receiving messages)



e. Open yet another terminal to force-stop a broker and test a failover scenario (in this example we will stop Kafka in Node 1):

Node 1:

Look for the process associated with the server.properties file and stop it.

$ ps -ef | grep server.properties
(…)


$ kill -9 12831

Once stopped, you should still be able to send and receive messages with the Kafka producer and consumer (if there’s at least one broker up). Repeat the process described in step d to validate that you can still send and receive messages.

f.      f. Once you’ve validated that the failover scenario works, stop all the running kafka processes, including Zookeeper. The below script will stop all the processes associated with Kafka brokers:

Node 1, 2 and 3:

$ sudo /usr/lib/kafka/bin/kafka-server-stop.sh

Wait a few seconds and then stop the Zookeeper process:

$ sudo /usr/lib/kafka/bin/zookeeper-server-stop.sh

Validate that no Kafka/Zookeeper daemons are still running:

$ ps -ef | grep kafka

g. In the next step, we will start Zookeeper and Kafka as daemons so that they can run in the background and don’t depend on any opened user session.


4.  Start/Stop Zookeeper and Kafka daemons



In this section, we will finally start Zookeeper and Kafka as background daemons so that the cluster is operational. We will do so using the root user, but you can always create and use a specific account for that purpose (if that's the case, make sure to grant sudo permissions accordingly in /etc/sudoers).

a. Start Zookeeper and Kafka brokers. Make sure to start them in order as shown below:

Node 1, 2 and 3:

$ sudo /usr/lib/kafka/bin/zookeeper-server-start.sh -daemon /usr/lib/kafka/config/zookeeper.properties

Wait a few seconds and then start the Kafka brokers:

Node 1, 2, and 3:

$ sudo /usr/lib/kafka/bin/kafka-server-start.sh -daemon  /usr/lib/kafka/config/server.properties

Once all is started, you can repeat the steps described in 3.d to make sure that everything works as expected.

b. In case you need to, here’s how you can stop Kafka brokers and then Zookeeper. Make sure to stop them in order as shown below:

$ sudo /usr/lib/kafka/bin/kafka-server-stop.sh

Wait a few seconds and then stop Zookeeper:

$ sudo /usr/lib/kafka/bin/zookeeper-server-stop.sh