Getting started Cassandra Access control list

Transcription

1 Getting started Cassandra Access control list Introduction: This document aims to provide a few easy to follow steps for the first-time user. We will cover the following subjects regarding our access control list implementation among Cassandra database: Build Cassandra code. Installation and configuration of Cassandra on Windows. Installation and configuration of Cassandra on Linux. Running a single Cassandra node. Examples of access control list usage. Extend Cassandra to multiple nodes. Build Cassandra code: Tool chain requirements: Java SDK, Ant, Git, Eclipse. 1. Install Java SDK on your machine. Version 1.6 or Latest, you can download from here: 2. Install Ant on your machine. Version 1.8 or Latest, you can download from here: 3. Install Git on your machine. You can download from here: 4. Install Eclipse on your machine. You can download from here: 5. Follow the Cassandra wiki and build Cassandra code. This guide will take you from the setup phase to running Cassandra: You can see it here: 6. If Cassandra is already running on eclipse stop it from the console. Download Cassandra Acl from here: Open the zip file containing the Cassandra ACL. Copy and replace the src and conf folders from the Cassandra ACL to the Cassandra trunk location. 7. Refresh the project files on eclipse and build it again with the new src and conf folders. 8. Stop Cassandra from the eclipse console. Open terminal or command prompt and enter the following command: "Ant" use this command from the cassandra-trunk location:

2 Installation and configuration of Cassandra on windows: 1. Cassandra is java based application, so first of all you need to install java on your machine. Latest JRE you can download from here: 2. Download Cassandra Acl from here: 3. Extract Cassandra source files. e.g. to c:\cassandra-trunk 4. Set environment variables: Go to System properties. Click on the advanced tab -> then click on Environment Variables button. Add the following new Variables and values: JAVA_HOME=c:\Program Files\Java\jre6\ This value should be path to jre directory. CASSANDRA_HOME=c:\cassandra-trunk This value should be set to the path of where you extract Cassandra-trunk.

3 5. Go to the conf folder inside Cassandra trunk: Edit the passwd.properties file and add yourself a username and password in the following way: <username>=<password> Edit the log4j-server.properties file. Change the log4j.appender.r.file line to point at the system log file to be created in the cassandra-trunk folder: log4j.appender.r.file=c:\cassandra-trunk\log\cassandra\system.log

4 6. Go to the bin folder inside Cassandra trunk: Edit the Cassandra.bat file and add the following lines at the end of the java options: -Dpasswd.properties=c:/cassandra-trunk/conf/passwd.properties^ -Daccess.properties=c:/cassandra-trunk/conf/access.properties You should set the path of the above files according to the cassandra-trunk folder. 7. Since we added new values and variables to the system environment we need to restart the computer so the changes will take place. If you want to restart your computer later you may skip to the next clause. After that it should work properly without restart. 8. Open the command prompt from the startup menu and enter the following commands: set CASSANDRA_HOME=c:\cassandra-trunk This should be the path to the Cassandra-trunk folder. set JAVA_HOME=c:\Program Files\Java\jre6\ This should be the path to the java folder.

5 Installation and configuration of Cassandra on Linux: 1. Cassandra is java based application, so first of all you need to install java on your machine. Latest JRE you can download from here: 2. Download Cassandra Acl from here: 3. Extract Cassandra source files. e.g. to c:\cassandra-trunk 4. Set environment variables: Add the following new Variables and values to the system: setenv CASSANDRA_HOME "/specific/disk1/temp/cassandra-trunk:." This should be the path to the Cassandra-trunk folder. setenv JAVA_HOME "/usr/local/lib/jdk-6u25-ea-bin-b03:." This should be the path to the java folder. 5. Go to the conf folder inside Cassandra trunk: Edit the passwd.properties file and add yourself a username and password in the following way: <username>=<password> Edit the log4j-server.properties file. Change the log4j.appender.r.file line to point at the system log file to be created in the cassandra-trunk folder: log4j.appender.r.file= /specific/disk1/temp/cassandra-trunk/log/cassandra/system.log

6 Running a single Cassandra node: 1. Now we are ready to run Cassandra ACL: Enter the following command at the command prompt (or terminal) from Cassandra-trunk folder location: bin/cassandra -f -Dpasswd.properties=conf/passwd.properties -Daccess.properties=conf/access.properties 2. Cassandra ACL should go up and listen to clients: 3. If you want to stop Cassandra ACL press Control+c and the server will shut down.

7 Examples of access control list usage: 1. Once cassandra server is up we may bring the client shell up by: bin/cassandra-cli -host <ip address> -p u <username> -pw <password> for example: bin/cassandra-cli -host p u yosi -pw At any time you may check the help menu by enter the command: help; 3. First we'll create a new keyspace called usertable: create keyspace usertable; 4. Next we'll use the keyspace and create a new column family called data: use usertable; create column family data; 5. lets insert a new column with and set and ACL to it: set data[utf8('yosi')][utf8(' ')] = utf8('secret @yahoo.com:yosi,odelia rw:ainat ro'); this new column would be available to yosi and odelia as they have read and write permission they may see and change the column However Ainat have only reading permissions so she will be able only to see the value but not to change it. Finally ilia that doesn't have any permission at all. Won't be able to see, change or delete the column. Let's check that scenario: Ainat is logging in and retrieve the value: She can retrieve the value:

8 But she can't change it since she got only read permissions: Now ilia logs on and tries to retrieve the value: But since he doesn t have permission at all an invalid request is prompted. Finally ilia try to delete the column completely: But like the last action since he doesn t have permission at all an invalid request is prompted to him. Our cassandra ACL implementation is using the ACL we have set to the value and confirms that only yosi and odelia might see, change and delete the column:

9 Extend Cassandra to multiple nodes: To add a node to a Cassandra cluster one have to make a series of recurring operations on each node he would like to add to the cluster. First make sure that Cassandra is installed properly on the new node you would like to add. Perform all the steps described in the Installation and configuration section in this document. In addition you must perform the configuration steps described below before starting the edited cluster. To expand a single node to a two-node cluster as we will do in our examples in this page, you must edit the configuration file cassandra.yaml which is located in the conf folder under Cassandra directory. The following values must be specified on both the existing and new nodes: seeds the list of seeds for the cluster. rpc_address and listen_address network addresses for the nodes to listen. initial_token defining the node s token range for the load balance in the cluster. 1. Seed List: You must specify at least one node to act as the seeds for other nodes joining the ring. When additional nodes are added, the seed nodes provide information required to join the ring such as what other nodes are included in it, what are their locations, and so on. After a node joins the ring, it shares ring information through the gossip protocol, and does not make any further special contact with the seed node. There is no strict rule to determine which hosts need to be listed as seeds, but all nodes in a cluster should have the same seed list. To configure the seed list: Edit cassandra.yaml for each node and add the first node ( in this example) as the seed in each. seeds: " " If more than one seed node should be defined use the following pattern: seeds: "<ip-1>,<ip-2>,,<ip-n>" 2. Listen Address and RPC Address: In order for nodes to communicate via the Gossip protocol, you need to specify the interfaces on which your nodes will listen for client traffic via Thrift and inter-cluster traffic. Set the rpc_address value to an interface accessible by clients, and the listen_address value to interfaces routable from other servers in the cluster. To configure listen_adress and rpc_address settings: Edit cassandra.yaml on all nodes in the cluster and replace the default localhost entries to specify the interfaces which will listen for traffic. For the first node in this example: listen_address: rpc_address:

10 And for the second node ( for this example): listen_address: rpc_address: Initial Token Values: Whenever you expand the node capacity of a Cassandra cluster, you need to set explicitly each node s initial token in the cassandra.yaml. This is required for all nodes in order to balance the load evenly. The very first node in the cluster, is set properly to zero, and we will never need its initial_token value to be edited, but all other tokens must be recalculated every time you expand the cluster. To determine the correct initial token values for each node in the cluster you may see the following token configurations: One Node: Two Nodes: node 1: Three Nodes: node 1: node 2: Four Nodes: node 1: node 2: node 3: Five Nodes: node 1: node 2: node 3: node 4: Six Nodes: node 1: node 2: node 3: node 4: node 5:

11 Seven Nodes: node 1: node 2: node 3: node 4: node 5: node 6: Eight Nodes: node 1: node 2: node 3: node 4: node 5: node 6: node 7: Nine Nodes: node 1: node 2: node 3: node 4: node 5: node 6: node 7: node 8: Ten Nodes: node 1: node 2: node 3: node 4: node 5: node 6: node 7: node 8: node 9: If you would like to set up a larger cluster you may check the token calculator on: Finally we'll start the nodes in the cluster.

12 Starting a Cassandra Cluster: Start the seed node, and verify connectivity with nodetool ring as in the single node example above. Then start the remaining node. After a few minutes of pauses to exchange data all of the nodes should be up you can nodetool ring command again and it should give you something like the following: This implies the nodes are running correctly.