:original_name: admin_guide_000282.html

.. _admin_guide_000282:

Configuring HDFS Data Encryption During Transmission
====================================================

Configuring HDFS Security Channel Encryption
--------------------------------------------

The channel between components is not encrypted by default. You can set parameters to enable security channel encryption.

Navigation path for setting parameters: On FusionInsight Manager, choose **Cluster** > *Name of the desired cluster* > **Services** > **HDFS** > **Configurations**. On the displayed page, click the **All Configurations** tab. Enter a parameter name in the search box.

.. note::

   After the configuration, restart the corresponding service for the settings to take effect.

.. table:: **Table 1** Parameters

    
   | Configuration Item                      | Description                                                                                                                                                                                                                                                                                                                                                                     | Default Value                                                                                             |
    
   | hadoop.rpc.protection                   | .. important::                                                                                                                                                                                                                                                                                                                                                                  | -  Security mode: privacy                                                                                 |
   |                                         |                                                                                                                                                                                                                                                                                                                                                                                 | -  Normal mode: authentication                                                                            |
   |                                         |    NOTICE:                                                                                                                                                                                                                                                                                                                                                                      |                                                                                                           |
   |                                         |                                                                                                                                                                                                                                                                                                                                                                                 | .. note::                                                                                                 |
   |                                         |    -  The setting takes effect only after the service is restarted. Rolling restart is not supported.                                                                                                                                                                                                                                                                           |                                                                                                           |
   |                                         |    -  After the setting, you need to download the client configuration file again. Otherwise, HDFS cannot provide the read and write services.                                                                                                                                                                                                                                  |    -  **authentication**: indicates that only authentication is required.                                 |
   |                                         |                                                                                                                                                                                                                                                                                                                                                                                 |    -  **integrity**: indicates that authentication and consistency check need to be performed.            |
   |                                         | Indicates whether the RPC channels of each module in Hadoop are encrypted. The channels include:                                                                                                                                                                                                                                                                                |    -  **privacy**: indicates that authentication, consistency check, and encryption need to be performed. |
   |                                         |                                                                                                                                                                                                                                                                                                                                                                                 |                                                                                                           |
   |                                         | -  RPC channels for clients to access HDFS                                                                                                                                                                                                                                                                                                                                      |                                                                                                           |
   |                                         | -  RPC channels between modules in HDFS, for example, between DataNode and NameNode                                                                                                                                                                                                                                                                                             |                                                                                                           |
   |                                         | -  RPC channels for clients to access Yarn                                                                                                                                                                                                                                                                                                                                      |                                                                                                           |
   |                                         | -  RPC channels between NodeManager and ResourceManager                                                                                                                                                                                                                                                                                                                         |                                                                                                           |
   |                                         | -  RPC channels for Spark to access Yarn and HDFS                                                                                                                                                                                                                                                                                                                               |                                                                                                           |
   |                                         | -  RPC channels for MapReduce to access Yarn and HDFS                                                                                                                                                                                                                                                                                                                           |                                                                                                           |
   |                                         | -  RPC channels for HBase to access HDFS                                                                                                                                                                                                                                                                                                                                        |                                                                                                           |
   |                                         |                                                                                                                                                                                                                                                                                                                                                                                 |                                                                                                           |
   |                                         | .. note::                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                           |
   |                                         |                                                                                                                                                                                                                                                                                                                                                                                 |                                                                                                           |
   |                                         |    The setting takes effect globally, that is, the encryption attribute of the RPC channel of each module in the Hadoop takes effect.                                                                                                                                                                                                                                           |                                                                                                           |
    
   | dfs.encrypt.data.transfer               | Indicates whether the HDFS data transfer channels and the channels for clients to access HDFS are encrypted. The HDFS data transfer channels include the data transfer channels between DataNodes and the Data Transfer (DT) channels for clients to access DataNodes. The value **true** indicates that the channels are encrypted. The channels are not encrypted by default. | false                                                                                                     |
   |                                         |                                                                                                                                                                                                                                                                                                                                                                                 |                                                                                                           |
   |                                         | .. note::                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                           |
   |                                         |                                                                                                                                                                                                                                                                                                                                                                                 |                                                                                                           |
   |                                         |    -  This parameter is valid only when **hadoop.rpc.protection** is set to **privacy**.                                                                                                                                                                                                                                                                                        |                                                                                                           |
   |                                         |    -  If a large amount of service data is transmitted, enabling encryption by default severely affects system performance.                                                                                                                                                                                                                                                     |                                                                                                           |
   |                                         |    -  If data transmission encryption is configured for one cluster in the trusted cluster, the same data transmission encryption must be configured for the peer cluster.                                                                                                                                                                                                      |                                                                                                           |
    
   | dfs.encrypt.data.transfer.algorithm     | Indicates the algorithm to encrypt the HDFS data transfer channels and the channels for clients to access HDFS. This parameter is valid only when **dfs.encrypt.data.transfer** is set to **true**.                                                                                                                                                                             | 3des                                                                                                      |
   |                                         |                                                                                                                                                                                                                                                                                                                                                                                 |                                                                                                           |
   |                                         | .. note::                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                           |
   |                                         |                                                                                                                                                                                                                                                                                                                                                                                 |                                                                                                           |
   |                                         |    The default value is **3des**, indicating that 3DES algorithm is used to encrypt data. The value can also be set to **rc4**. However, to avoid security risks, you are not advised to set the parameter to this value.                                                                                                                                                       |                                                                                                           |
    
   | dfs.encrypt.data.transfer.cipher.suites | This parameter can be left empty or set to **AES/CTR/NoPadding** to specify the cipher suite for data encryption. If this parameter is not specified, the encryption algorithm specified by **dfs.encrypt.data.transfer.algorithm** is used for data encryption. The default value is **AES/CTR/NoPadding**.                                                                    | AES/CTR/NoPadding                                                                                         |
    
