Installing the Apache Ranger Key Management Server (KMS)

The previous couple of blog entries have looked at how to install the Apache Ranger Admin Service as well as the Usersync Service. In this post we will look at how to install the Apache Ranger Key Management Server (KMS). KMS is a component of Apache Hadoop to manage cryptographic keys. Apache Ranger ships with its own KMS implementation, which allows you to store the (encrypted) keys in a database. The Apache Ranger KMS is also secured via policies defined in the Apache Ranger Admin Service.

1) Build the source code

The first step is to download the source code, as well as the signature file and associated message digests (all available on the download page). Verify that the signature is valid and that the message digests match. Now extract and build the source, and copy the resulting KMS archive to a location where you wish to install it:

• tar zxvf apache-ranger-incubating-0.6.0.tar.gz
• cd apache-ranger-incubating-0.6.0
• mvn clean package assembly:assembly 
• tar zxvf target/ranger-0.6.0-kms.tar.gz
• mv ranger-0.6.0-kms ${rangerkms.home}

2) Install the Apache Ranger KMS Service

As the Apache Ranger KMS Service stores the cryptographic keys in a database, we will need to setup and configure a database. We will also configure the KMS Service to store audit logs in the database. Follow the steps given in section 2 of the tutorial on the Apache Ranger Admin Service to set up MySQL. We will also need to create a new user 'rangerkms':

• CREATE USER 'rangerkms'@'localhost' IDENTIFIED BY 'password';
• FLUSH PRIVILEGES; 

You will need to install the Apache Ranger KMS Service using "sudo". If the root user does not have a JAVA_HOME property defined, then edit ${rangerkms.home}/setup.sh + add in, e.g.:

• export JAVA_HOME=/opt/jdk1.8.0_91

Next edit ${rangerkms.home}/install.properties and make the following changes:

• Change SQL_CONNECTOR_JAR to point to the MySQL JDBC driver jar (see previous tutorial).
• Set (db_root_user/db_root_password) to (admin/password)
• Set (db_user/db_password) to (rangerkms/password)
• Change KMS_MASTER_KEY_PASSWD to a secure password value.
• Set POLICY_MGR_URL=http://localhost:6080
• Set XAAUDIT.DB.IS_ENABLED=true
• Set XAAUDIT.DB.FLAVOUR=MYSQL 
• Set XAAUDIT.DB.HOSTNAME=localhost 
• Set XAAUDIT.DB.DATABASE_NAME=ranger_audit 
• Set XAAUDIT.DB.USER_NAME=rangerlogger
• Set XAAUDIT.DB.PASSWORD=password

Now you can run the setup script via "sudo ./setup.sh".

3) Starting the Apache Ranger KMS service

After a successful installation, first start the Apache Ranger admin service with "sudo ranger-admin start". Then start the Apache Ranger KMS Service via "sudo ranger-kms start". Now open a browser and go to "http://localhost:6080/". Log on with "keyadmin/keyadmin". Note that these are different credentials to those used to log onto the Apache Ranger Admin UI in the previous tutorial. Click on the "+" button on the "KMS" tab to create a new KMS Service. Specify the following values:

• Service Name: kmsdev
• KMS URL: kms://http@localhost:9292/kms
• Username: keyadmin
• Password: keyadmin

Click on "Test Connection" to make sure that the KMS Service is up and running. If it is showing a connection failure, log out and log into the Admin UI using credentials "admin/admin". Go to the "Audit" section and click on "Plugins". You should see a successful message indicating that the KMS plugin can successfully download policies from the Admin Service:

After logging back in to the UI as "keyadmin" you can start to create keys. Click on the "Encryption/Key Manager" tab. Select the "kmsdev" service in the dropdown list and click on "Add New Key". You can create, delete and rollover keys in the UI: