Product SiteDocumentation Site

2.2.2. Create Account & Set Permissions

Good security practice dictates that server processes should be run under separate, limited accounts. WebMapReduce is no exception. In fact, because it allows users to submit and run programs on your server, keeping its privileges limited is especially important. For this reason, we highly recommend setting up a special account for WMRServer.
Security Goals
Whatever you choose to do, keep two considerations in mind:
  • Some information used to configure WMRServer should be kept confidential (SSL keys and passwords, for instance). Files containing this information should only be readable by WMRServer.
  • Normal jobs submitted through WebMapReduce are processed and run by Hadoop. If the Hadoop daemons have the same privileges as WMRServer, users will be able to write jobs that read this confidential information. Do not run Hadoop and WebMapReduce under the same account.

    Note

    Test jobs are a special exception: they are run directly by the WMRServer daemon. Securing these jobs is more complicated (they are disabled by default for this reason), but a good approach is explained later.

    Warning

    Never run the Hadoop (or WMRServer) daemons as root or any other administrator account. If you do, jobs will run with administrator privileges, potentially granting unlimited access to anyone.
The details for setting up an account and setting permissions vary from system to system. Aim for the following:
  1. Create an account named wmr, granting it as few permissions as possible. On systems where this is applicable, make it a "system" account.
    On many Unix systems, the appropriate command would be this: 
    $ useradd -r wmr
  2. Set the permissions on the $WMR_HOME/conf directory to be readable only by the wmr account and optionally any appropriate administrator accounts.
    The standard Unix commands to do this are the following: 
    $ chown -R wmr $WMR_HOME/conf
$ chmod 500 $WMR_HOME/conf
    To additionally allow read/write access to an administrator group: 
    $ chgrp -R groupname $WMR_HOME/conf
$ chmod 570 $WMR_HOME/conf