This article provides a comprehensive analysis of MSSQL attack vectors—including stored procedures, COM components, CLR, sandbox bypass, triggers, proxy jobs, Kerberoasting, and linked servers—detailing prerequisites, exploitation steps with code examples, and practical mitigation recommendations to harden database security.
Apache Kudu 1.15.0 adds experimental multi‑row transaction support (currently INSERT and INSERT_IGNORE), Raft‑based master configuration tools, table comment synchronization with Hive Metastore, per‑table size and row‑count limits configurable via flags or the kudu table set_limit tool, a customizable Kerberos principal flag, and TLS v1.3 with optional cipher‑suite selection, collectively enhancing low‑latency random access and analytical capabilities in the Hadoop ecosystem.
This article explains why Kerberos is needed for Hadoop clusters, details the Kerberos authentication workflow, and provides step‑by‑step instructions for configuring Flink to run on a Kerberos‑protected YARN environment using delegation tokens or keytab files, along with proxy‑user settings.
This guide explains how to prepare a CDH‑based Spark environment for Kerberos authentication, covering prerequisite knowledge, classpath adjustments, HBase configuration files, Spark‑Env settings, user permission grants, Spark‑Submit execution, and common troubleshooting steps.
This article explains the principles, architecture, features, and step‑by‑step deployment of Apache Sentry with Kerberos to provide role‑based access control across Hadoop components such as Hive, Impala, and HDFS, including command‑line examples and visual diagrams.
This guide walks through setting up a Maven project, adding Hadoop dependencies, configuring Kerberos (krb5.conf and keytab), loading core‑site.xml, and providing Java utility classes to initialize the HDFS client and list files in an HA‑enabled Hadoop cluster.
This guide demonstrates how to configure a Spark Streaming application running on YARN in cluster mode to securely consume Kerberos‑protected Kafka topics and write the processed data into Kudu tables, including necessary Java code, Kerberos keytab setup, Kafka client configuration, and spark‑submit commands.
This article explains the background, principles, key concepts, workflow, and step‑by‑step deployment of Kerberos authentication on a Cloudera CDH big‑data cluster to protect sensitive medical data, and discusses its reliability and best‑practice configurations.
Learn how to set up a Python environment on an Ubuntu ECS, install the presto‑python‑client and PyHive libraries, configure Kerberos and SSL credentials, run sample queries against a Presto coordinator, and avoid typical errors such as NTP, SSL and authentication issues.
This article provides a comprehensive tutorial on Kerberos fundamentals, its authentication workflow, and detailed procedures for installing, configuring, and enabling Kerberos security on a Cloudera (Hadoop) cluster running on CentOS, including code snippets, configuration files, and post‑deployment testing steps.
The article describes how to troubleshoot and fix Oozie shell‑action failures when submitting Flink jobs on a CDH 6.3 cluster with Kerberos, detailing environment‑variable conflicts, error messages, and the final solution using a clean environment and custom FLINK_CONF_DIR settings.
This article examines the evolution of a data‑sharing exchange platform—moving from slow JDBC‑based transfers to storage‑level copying, introducing a two‑stage DistCp workflow, and securing cross‑cluster access with Kerberos‑based trust managed by the Guardian component.
The article evaluates Kerberos, Apache Sentry, and Apache Ranger for securing Meitu’s large‑scale Hadoop ecosystem, highlighting Ranger’s comprehensive, fine‑grained, policy‑based authorization across HDFS, HBase, Hive, YARN, Storm, and Kafka, and describing its configuration, LDAP integration, and custom SDK implementation.
This article details Ctrip's experience with the Presto distributed SQL engine, outlining the initial performance and stability issues, the comprehensive enhancements made in security, resource control, compatibility, and monitoring, and the multi‑stage upgrade plan that guides its future evolution.
The article examines Kerberos KDC performance issues on Meituan‑Dianping’s data platform, showing that PREAUTH halves throughput while RAID10 has little effect, and that a single‑CPU core limits QPS; deploying 40 processes and disabling PREAUTH raises throughput over tenfold, and a lock‑free shared‑memory monitoring module with the kstat tool provides real‑time metrics for troubleshooting.
Guardian 5.1 introduces comprehensive security upgrades for Transwarp Data Hub, including Kerberos‑based cross‑realm trust management, detailed service audit logging, automatic data backup, and unified permission frameworks, thereby enhancing both usability and protection of big‑data clusters.
After Meituan merged with Dianping, engineers unified two massive Hadoop ecosystems across Beijing and Shanghai by breaking the project into four phases—unify, copy, switch, fuse—standardizing versions, implementing zone‑aware transfers, cross‑realm Kerberos, and federated metadata to achieve a single, reliable multi‑data‑center platform.
This article describes the design, implementation, and deployment of a custom Hadoop security solution that introduces username‑password authentication via RPC, integrates a new protobuf protocol, modifies NameNode behavior, and provides rollout tools to secure a large‑scale shared Hadoop cluster without service interruption.
This article explains Kafka's architecture, identifies its security vulnerabilities, and presents Transwarp's Kerberos authentication and ACL-based authorization solutions, including configuration steps, code examples, and best practices for building a secure Kafka service.
This article explains the security risks facing Hadoop clusters, outlines common attack methods, introduces Kerberos authentication, and describes Transwarp Data Hub's multi‑layer security architecture—including Guardian, KRB5LDAP, and authorization controls—to help administrators secure their big‑data environments.
