Level 2: Enabling Cloudera Manager Agent Hosts to Authenticate the Server's Certificate
Required Role: Cluster Administrator or Full Administrator
Level 2 TLS ensures that all Cloudera Manager Agent host systems check the validity of the certificate presented by Cloudera Manager Server during the TLS handshake. If the certificate is missing or expired, or if its authenticity cannot be verified through the associated CA chain, the agent aborts the connection, thus ensuring that Cloudera Manager Agent hosts are not spoofed by a bogus server.
Step 1: Modifying the Cloudera Manager Agent Configuration File
- Use a text editor to open the configuration file, located in this path:
- In the [Security] section, find this text:
[Security] ... # verify_cert_file=/opt/cloudera/security/pki/rootca.cert.pem
- Apply this change to each Cloudera Manager Agent host's configuration file. You can do this in one of two ways:
- Modify each host's configuration file;
- Modify one host's configuration file and then copy that file to all other hosts in the cluster. Take this approach only if none of the hosts has customizations already in the configuration file, such as changes from the default listening_hostname or listening_ip address. By default, config.ini has no host-specific details.
Step 2: Restart the Cloudera Manager Server
On the Cloudera Manager Server host:
Launch a terminal session and use the command line to restart the server and activate the TLS configuration, as shown below:
$ sudo service cloudera-scm-server restart
Step 3: Restart the Cloudera Manager Agents
On each Cloudera Manager Agent host:
Restart the Cloudera Manager Agent daemon as shown below:
$ sudo service cloudera-scm-agent restart
Step 4: Check Cloudera Manager Server-Agent Communications
- Open the Cloudera Manager Admin Console.
- Select .
- Open the Last Heartbeat filter to see its status. This status should be Good, meaning that the server and agent hosts are communicating successfully.
$ sudo su # cd /var/log/cloudera-scm-agent
- Select .
- Open the Select Sources drop-down selector, and deselect all sources except for .