Hadoop HDFS NameNode Metadata Service Port Should Not Be Open
More Info:
Determines if TCP port 8020 for HDFS NameNode metadata service is open to the public.Risk Level
MediumAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Hadoop HDFS NameNode Metadata Service Port Should Not Be Open” for GCP using GCP console, please follow the below steps:
- Open the GCP console and navigate to the Compute Engine section.
- Click on the VM instances tab and select the instance where the Hadoop HDFS NameNode Metadata Service Port is open.
- Click on the Edit button to edit the instance settings.
- Scroll down to the “Firewall” section and click on the “Network tags” drop-down menu.
- Add a new network tag and give it a name, for example, “no-namenode-port”.
- Click on the “Save” button to save the changes.
- Navigate to the “VPC network” section and click on the “Firewall rules” tab.
- Click on the “Create Firewall Rule” button to create a new firewall rule.
- Give the firewall rule a name, for example, “no-namenode-port”.
- In the “Targets” section, select “Specified target tags” and enter the tag name “no-namenode-port”.
- In the “Source filter” section, select “IP ranges” and enter the IP address range of the network that should not have access to the Hadoop HDFS NameNode Metadata Service Port.
- In the “Protocols and ports” section, select “Specified protocols and ports” and enter the protocol and port number of the Hadoop HDFS NameNode Metadata Service Port (default is TCP port 8020).
- Click on the “Create” button to create the firewall rule.
- Verify that the firewall rule is applied to the instance by checking the “Firewall rules” section on the instance details page.
- Test the configuration by attempting to access the Hadoop HDFS NameNode Metadata Service Port from a network that is not allowed. The connection should be refused.
Using CLI
Using CLI
To remediate the misconfiguration “Hadoop HDFS NameNode Metadata Service Port Should Not Be Open” for GCP using GCP CLI, please follow the below steps:This will bind the Hadoop HDFS NameNode to the loopback IP address and prevent it from being accessible from the network.This should not return any output.By following these steps, you can remediate the misconfiguration “Hadoop HDFS NameNode Metadata Service Port Should Not Be Open” for GCP using GCP CLI.
- Open the Cloud Shell from the GCP console.
- Run the following command to get the list of all the Compute Engine instances in your project:
- Identify the instance where the Hadoop HDFS NameNode Metadata Service Port is open.
- SSH into the instance using the following command:
- Edit the Hadoop configuration file
hdfs-site.xmlusing the following command:
- Add the following property to the file:
- Save and exit the file.
- Restart the Hadoop HDFS NameNode service using the following command:
- Verify that the Hadoop HDFS NameNode Metadata Service Port is no longer open by running the following command:
- Exit the SSH session using the following command:
Using Python
Using Python
To remediate the misconfiguration “Hadoop HDFS NameNode Metadata Service Port Should Not Be Open” on GCP, you can follow the below steps using Python:By following these steps, you can remediate the misconfiguration “Hadoop HDFS NameNode Metadata Service Port Should Not Be Open” on GCP using Python.
-
First, you need to authenticate with GCP using the Python SDK. You can do this by installing the
google-cloud-sdkand running the commandgcloud auth application-default login. This will authenticate you with your GCP account. -
Next, you need to get a list of all the instances in your GCP project. You can do this by using the
google-cloud-sdkcommandgcloud compute instances listor by using the Python SDK. Here’s the Python code to get a list of all the instances:
- Once you have a list of all the instances, you need to check if the Hadoop HDFS NameNode Metadata Service Port is open on any of them. You can do this by using the
socketlibrary in Python. Here’s the Python code to check if the port is open:
- If the Hadoop HDFS NameNode Metadata Service Port is open on any instance, you need to close it. You can do this by creating a firewall rule to block traffic on that port. Here’s the Python code to create a firewall rule:
- Finally, you need to apply the
hadooptag to all the instances running Hadoop. You can do this by using the Python SDK. Here’s the Python code to apply the tag: