Cloudera Enterprise 5.15.x | Other versions

How to Configure Encrypted Transport for HDFS Data

This topic describes how to configure encrypted HDFS data transport using both, Cloudera Manager, and the command line.

You must enable Kerberos before configuring encrypted HDFS data transport. See Authentication for instructions.

Using Cloudera Manager

Minimum Required Role: Full Administrator

To enable encryption of data transferred between DataNodes and clients, and among DataNodes, perform the following steps:
  1. Enable Hadoop security using Kerberos.
  2. Select the HDFS service.
  3. Click the Configuration tab.
  4. Select Scope > HDFS (Service Wide).
  5. Select Category > Security.
  6. Configure the following properties: (You can type the property name in the Search box to locate the property.)
    Property Description
    Enable Data Transfer Encryption Check this field to enable wire encryption.
    Data Transfer Encryption Algorithm Optionally configure the algorithm used to encrypt data.
    Hadoop RPC Protection Select privacy.
  7. Click Save Changes.
  8. Restart the HDFS service.

Using the Command Line

  Important:
  • This configuration process can be completed using either Cloudera Manager or the command-line instructions.
  • This information applies specifically to CDH 5.15.0. If you use an earlier version of CDH, see the documentation for that version located at Cloudera Documentation.

To enable encrypted data transport using the command line, perform the following steps:

  1. Enable Kerberos authentication, following these instructions.
  2. Set the optional RPC encryption by setting hadoop.rpc.protection to "privacy" in the core-site.xml file in both client and server configurations.
      Note:

    If RPC encryption is not enabled, transmission of other HDFS data is also insecure.

  3. Set dfs.encrypt.data.transfer to true in the hdfs-site.xml file on all server systems.
  4. Restart all daemons.
Page generated May 18, 2018.