Your suggested change has been received. Thank you.

close
Thales Logo

All

  • All
  • CipherTrust Manager
  • CipherTrust Application Data Protection (CADP)
  • CipherTrust Application Key Management (CAKM)
  • CipherTrust Batch Data Transformation (BDT)
  • CipherTrust Cloud Key Management (CCKM)
  • CipherTrust Data Discovery and Classification (DDC)
  • CipherTrust Data Protection Gateway (DPG)
  • CipherTrust Database Protection (CDP)
  • CipherTrust Intelligent Protection (CIP)
  • CipherTrust Integrations
  • CipherTrust Migrations
  • CipherTrust RESTful Data Protection (CRDP)
  • CipherTrust Transparent Encryption (CTE)
  • CipherTrust Transparent Encryption Userspace (CTE-U)
  • CipherTrust Secrets Management (CSM)
  • CipherTrust Vaulted Tokenization (CT-V)
  • CipherTrust Vaultless Tokenization (CT-VL)
  • CTE-Linux
  • CTE-Windows
  • CTE-AIX
  • CTE-K8s
  • CTE-U
  • Crypto Command Center
  • Data Protection on Demand
  • Luna Cloud HSM
  • Luna Network HSM
  • Luna PCIe HSM
  • Luna USB HSM
  • OneWelcome Identity Platform
  • ProtectApp LUKS
  • ProtectServer 2 HSM
  • ProtectServer 3 HSM
  • SafeNet Trusted Access (STA)
  • SafeNet MobilePASS+
  • SafeNet MobilePASS+ for Android
  • SafeNet MobilePASS+ for Chrome
  • SafeNet MobilePASS+ for macOS
  • SafeNet MobilePASS+ for iOS
  • SafeNet MobilePASS+ for WatchOS
  • SafeNet MobilePASS+ for Windows
  • SafeNet Synchronization Agent
  • SafeNet Logging Agent
  • SafeNet Agent for FreeRADIUS
  • SafeNet Agent for NPS
  • SafeNet Agent for Windows Logon
  • SafeNet Authentication Service Private Cloud Edition (SAS PCE)
  • SafeNet Remote Logging Agent
  • SafeNet Keycloak Agent
  • SafeNet IDPrime Virtual (IDPV)
  • SafeNet FIDO Key Manager
  • SafeNet FIDO Key Manager for Android
  • SafeNet FIDO Key Manager for iOS
  • SafeNet FIDO Key Manager for Windows
back

Implementing CTE on HDFS

Adding a New DataNode to a CTE-protected HDFS

search

Please Note:

printsuggest an edit

Adding a New DataNode to a CTE-protected HDFS

Use the following procedure to add a new DataNode to a CTE-protected HDFS. If not followed, HDFS encrypted files could be exposed in cleartext.

Note

If you already have CTE installed on the cluster nodes before Ambari installs the Hadoop software, see Install CTE on the Cluster Nodes before Ambari Installs Hadoop.

  1. Install the HDFS client on the host. This option is available in Ambari when adding a new DataNode to the cluster.

  2. Add the new node to the CipherTrust Manager database and make sure that host/client settings of the new node is the same as existing nodes in the cluster. See the CTE Installation for Hadoop chapter in the CTE Installation and Configuration Guide.

  3. Install CTE on the new node, register to CipherTrust Manager, and run config-hadoop.sh to prepare the libraries. See the Configuring Hadoop to use CTE section in the CTE Installation and Configuration Guide.

  4. Make sure that the data directories (specified in dfs.datanode.data.dir property) exist on the new node. They must have the same permission and ownership as the other existing nodes in the cluster. If necessary, create them.

  5. Add the host/client to the HDFS Host Group that is guarding the cluster. This is important: Do not rely on the DataNode to create the data directories as the data replication can occur before the GuardPoints are in effect.

  6. Add the DataNode service to the new node. Again this option is available through Ambari.

  7. If using Kerberos, check that the keytab files are created correctly.

  8. Start the DataNode service on the new node.

  9. Execute some hdfs dfs shell commands to ensure that encryption/decryption of data works correctly.

copy link to clipboardInstall CTE on the Cluster Nodes before Ambari Installs Hadoop

If CTE is already installed on the cluster nodes before Ambari installs the Hadoop software, Ambari can mistakenly pick up the .sec directory in configuration steps to store the HDFS data. Make sure the following properties do not contain the .sec directory:

  • DataNode data directory

  • NameNode data directory

  • Secondary NameNode checkpoint directory

  • Zookeeper directory

  • yarn.nodemanager.local-dirs

  • yarn.nodemanager.log-dirs

  • yarn.timeline-service.leveldb-timeline-store.path

  • yarn.timeline-service.leveldb-state-store.path

Note

This list is not exhaustive. Depending on the Hadoop ecosystem packages installed, there can be others.

On this page