Guardian實(shí)驗(yàn)1.界面安裝guardian2.Enable安全模式3.添加主要用戶4.配置inceptorserver2啟用權(quán)限修改inceptor參數(shù)：hive.server2.authentication設(shè)置為L(zhǎng)DAPhive.server2.authentication.ldap.baseDN設(shè)置為ou=people,dc=tdh（TDH4.5以上版本不需要手動(dòng)更改）hive.server2.authentication.ldap.url設(shè)置為ldap://tdh-101:389ldap://tdh-102:389點(diǎn)擊保存，配置服務(wù)，重新啟動(dòng)inceptor5.配置用戶表權(quán)限6.命令行操作進(jìn)入inceptor驗(yàn)證操作（此處用戶名密碼為步驟3中添加的用戶）#beeline-ujdbc:hive2://tdh-101:10000/default-nhive-phive1237.Inceptor中對(duì)權(quán)限的基礎(chǔ)命令I(lǐng)nceptor中的權(quán)限:CREATE,SELECT,INSERT,UPDATE,DELETE,ALL賦予權(quán)限GRANT權(quán)限[ONdatabase_name/table_name]TOUSER|ROLEuser_name/role_name例：GRANTSELECTONtable_testTOUSERhbase;賦予用戶hbase查詢表table_test的權(quán)限；收回權(quán)限REVOKE權(quán)限[ONdatabase_name/table_name]FROMUSER|ROLEuser_name/role_name例：REVOKESELECTONtable_testFROMUSERhbase;收回用戶hbase查詢表table_test的權(quán)限；查看權(quán)限SHOWGRANTuser_name/role_nameONALL例：SHOWGRANTUSERhbaseONALL 顯示用戶hbase的所有權(quán)限；進(jìn)行權(quán)限操作時(shí)，必須以hive超級(jí)用戶登錄，并且執(zhí)行以下命令setroleadmin;8.安全模式下用戶對(duì)HDFS操作查看當(dāng)前kerberos用戶klist更改當(dāng)前kerberos用戶kinithdfs使用命令查看登錄已經(jīng)生效klist對(duì)HDFS根目錄/進(jìn)行操作hadoopfs-mkdir/KRBhadoopfs-put/etc/hosts/KRB/在Guardian中新建一個(gè)test用戶切換為test用戶嘗試對(duì)之前的目錄進(jìn)行訪問(wèn)kinittestklisthadoopfs-put/etc/passwd/KRB/退出kerberos當(dāng)前用戶kdestroyklist9.Hyperbase權(quán)限命令hyperbase中的權(quán)限:R:讀權(quán)限，用來(lái)進(jìn)行g(shù)et,scan操作W:寫權(quán)限，用來(lái)進(jìn)行put,delete等操作C:建表權(quán)限，用來(lái)進(jìn)行create，alter等操作X:為執(zhí)行權(quán)限A:ADMIN權(quán)限進(jìn)行權(quán)限操作時(shí)，必須以hbase超級(jí)用戶進(jìn)行登錄分配權(quán)限命令為grant'user_name','RWXCA'grant'user_name','RW','table_name','cloumnfamily_name','column_name'以hbase用戶登錄，建表kinithbaseklisthbaseshellcreate'test_krb','cf'put'test_krb','row1','cf:a','value1'g