forked from docs/doc-exports
Yang, Tong
2195db241c
Reviewed-by: Pruthi, Vineet <vineet.pruthi@t-systems.com> Reviewed-by: Rechenburg, Matthias <matthias.rechenburg@t-systems.com> Co-authored-by: Yang, Tong <yangtong2@huawei.com> Co-committed-by: Yang, Tong <yangtong2@huawei.com>
27 lines
5.0 KiB
HTML
27 lines
5.0 KiB
HTML
<a name="admin_guide_000284"></a><a name="admin_guide_000284"></a>
|
|
|
|
<h1 class="topictitle1">Encrypting the Communication Between the Controller and the Agent</h1>
|
|
<div id="body1530067732207"><div class="section" id="admin_guide_000284__saa33116f21f2473a9144960266629fdf"><h4 class="sectiontitle">Scenario</h4><p id="admin_guide_000284__en-us_topic_0046736716_p48517864">After a cluster is installed, Controller and Agent need to communicate with each other. The Kerberos authentication is used during the communication. By default, the communication is not encrypted during the communication for the sake of cluster performance. Users who have demanding security requirements can use the method described in this section for encryption.</p>
|
|
</div>
|
|
<div class="section" id="admin_guide_000284__s921106f1d45841a9a48d5bf67d9cbc92"><h4 class="sectiontitle">Impact on the System</h4><ul id="admin_guide_000284__en-us_topic_0046736716_ul37632913"><li id="admin_guide_000284__en-us_topic_0046736716_li3151905">Controller and all Agents automatically restart, which interrupts <span id="admin_guide_000284__text67509419010">MRS</span> Manager.</li><li id="admin_guide_000284__en-us_topic_0046736716_li28367147">The performance of management nodes deteriorates in large clusters. You are advised to enable the encryption function for clusters with a maximum of 200 nodes.</li></ul>
|
|
</div>
|
|
<div class="section" id="admin_guide_000284__s380461e1b795408bb4fd6b8f418d5c81"><h4 class="sectiontitle">Prerequisites</h4><p id="admin_guide_000284__en-us_topic_0046736716_p16037598">You have obtained the IP addresses of the active and standby management nodes.</p>
|
|
</div>
|
|
<div class="section" id="admin_guide_000284__s058e1e0f2bec4ce587f8cdaf308d5f41"><h4 class="sectiontitle">Procedure</h4><ol id="admin_guide_000284__en-us_topic_0046736716_ol23977041"><li id="admin_guide_000284__en-us_topic_0046736716_li14466778"><span>Log in to the active management node as user <strong id="admin_guide_000284__b20932517317">omm</strong>.</span></li><li id="admin_guide_000284__en-us_topic_0046736716_li63092140"><span>Run the following command to disable logout upon timeout:</span><p><p id="admin_guide_000284__en-us_topic_0046736716_p30958352"><strong id="admin_guide_000284__en-us_topic_0046736716_b10189720">TMOUT=0</strong></p>
|
|
<div class="note" id="admin_guide_000284__note12497171716409"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="admin_guide_000284__p1614684417440">After the operations in this section are complete, run the <strong id="admin_guide_000284__b6757250143117">TMOUT=</strong><em id="admin_guide_000284__i17651250193112">Timeout interval</em> command to restore the timeout interval in a timely manner. For example, <strong id="admin_guide_000284__b27221054153114">TMOUT=600</strong> indicates that a user is logged out if the user does not perform any operation within 600 seconds.</p>
|
|
</div></div>
|
|
</p></li><li id="admin_guide_000284__en-us_topic_0046736716_li24598620"><span>Run the following command to go to the related directory:</span><p><p id="admin_guide_000284__en-us_topic_0046736716_p20060988"><strong id="admin_guide_000284__en-us_topic_0046736716_b46331171">cd ${CONTROLLER_HOME}/sbin</strong></p>
|
|
</p></li><li id="admin_guide_000284__en-us_topic_0046736716_li14327361"><span>Run the following command to enable communication encryption:</span><p><p id="admin_guide_000284__en-us_topic_0046736716_p61837391"><strong id="admin_guide_000284__en-us_topic_0046736716_b19665615">./enableRPCEncrypt.sh -t</strong></p>
|
|
<p id="admin_guide_000284__en-us_topic_0046736716_p42772808">Run the <strong id="admin_guide_000284__b224902374112723">sh ${BIGDATA_HOME}/om-server/om/sbin/status-oms.sh</strong> command to check whether <strong id="admin_guide_000284__b1171776179112723">ResHAStatus</strong> of the active management node Controller is <strong id="admin_guide_000284__b229846078112723">Normal</strong> and whether you can log in to <span id="admin_guide_000284__text98571750152518">MRS</span> Manager again. If yes, the enablement is successful.</p>
|
|
</p></li><li id="admin_guide_000284__en-us_topic_0046736716_li42045429"><span>Run the following command to disable communication encryption when necessary:</span><p><p id="admin_guide_000284__en-us_topic_0046736716_p42864547"><strong id="admin_guide_000284__en-us_topic_0046736716_b50236607">./enableRPCEncrypt.sh -f</strong></p>
|
|
<p id="admin_guide_000284__en-us_topic_0046736716_p49476282">Run the <strong id="admin_guide_000284__b8811134411407">sh ${BIGDATA_HOME}/om-server/om/sbin/status-oms.sh</strong> command to check whether <strong id="admin_guide_000284__b2081312446404">ResHAStatus</strong> of the active management node Controller is <strong id="admin_guide_000284__b38138447401">Normal</strong> and whether you can log in to <span id="admin_guide_000284__text1638455219251">MRS</span> Manager again. If yes, the enablement is successful.</p>
|
|
</p></li></ol>
|
|
</div>
|
|
</div>
|
|
<div>
|
|
<div class="familylinks">
|
|
<div class="parentlink"><strong>Parent topic:</strong> <a href="admin_guide_000271.html">Security Hardening</a></div>
|
|
</div>
|
|
</div>
|
|
|