0

I have set up hadoop cluster with HA and all the services where good and running, now I tried to enable kerberos where everything went well but restarting services didn't finish and I aborted. I see kerberos is in enable state. Now when I start services one by one I had these findings and errors.

  1. Both NameNodes went to standby mode and I don't see any Active node, because of this I am unable to start some services like YARN
  2. HDFS started but 0/3 DN's are alive 0 dead and 0 decommissioned

  3. DN logs are as below

    2016-07-08 10:59:05,831 WARN ipc.Client (Client.java:run(676)) - Couldn't setup connection for dn/dvtcbdqd102.corp.cox.com@HDP_QA.COX.COM to dvtcbdqd02.corp.cox.com/10.220.3.5:8020 org.apache.hadoop.ipc.RemoteException(javax.security.sasl.SaslException): GSS initiate failed

  4. NN log

    2016-07-08 11:01:48,140 WARN ipc.Server (Server.java:saslProcess(1371)) - Auth failed for 10.220.3.8:34998:null (GSS initiate failed) 2016-07-08 11:01:48,140 INFO ipc.Server (Server.java:doRead(850)) - Socket Reader #1 for port 8020: readAndProcess from client 10.220.3.8 threw exception [javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: Failure unspecified at GSS-API level (Mechanism level: Encryption type AES256 CTS mode with HMAC SHA1-96 is not supported/enabled)]]

  5. I also tried to regenerate keytabs and restart the services still same errors

I have installed HDP2.3.4

Please help me on this.

Regards, Sudheer.

sudheer
  • 338
  • 1
  • 6
  • 17
  • *"Encryption type AES256 ... is not supported/enabled"* => long ago the USA did not want foreign countries to use "strong keys", such as AES256, so that they could spy on them. Nowadays AES256 is not "strong" any more and the restrictions on *export policy* for cryptography have been removed; **but the Sun/Oracle JRE still does not support AES256 by default -- you must download specific, signed JARs and install them manually** >> google for `download java 1.8 unlimited strength cryptography` and make sure you don't follow the link about Java 1.7 *(or vice versa)* – Samson Scharfrichter Jul 08 '16 at 15:42
  • A must-read for all SysAdmins and Devs who have to meddle with Kerberos: https://www.gitbook.com/book/steveloughran/kerberos_and_hadoop/details >> especially useful are the explanations of various error messages in "errors" / "terrors" chapters, and the debug flags in "low-level secrets" – Samson Scharfrichter Jul 08 '16 at 15:45

0 Answers0