--- title: "Set up access control with the Ranger plugin" slug: "hadoop-vpc-11" tags: ["VPC", "Cloud Hadoop"] updated: 2026-09-17T09:17:45Z published: 2026-09-17T09:17:45Z canonical: "guide.ncloud-docs.com/hadoop-vpc-11" stale: true --- > ## Documentation Index > Fetch the complete documentation index at: https://guide.ncloud-docs.com/llms.txt > Use this file to discover all available pages before exploring further. # Set up access control with the Ranger plugin Available in VPC Implementing security rules for the big data ecosystem with [Apache Ranger](https://ranger.apache.org/) is possible. The Ranger project enables security guidelines to be defined and enforced in a uniform way across all Hadoop applications. ## Enabling the Ranger plugin Note The plugins you can enable depend on the services installed in your cluster. (Default: Plugins disabled; enabled when Kerberos authentication is configured in version 2.3 or higher) To manage the security policy with Ranger, you must change the plugin status to `ON`. You can enable plugins for HDFS, Hive, YARN, and other services. 1. After accessing the Ambari UI, enable the plugin in the **Services > Ranger > [CONFIGS] > RANGER PLUGIN** tab to manage permissions using Ranger. Set **HDFS Ranger Plugin** to the `ON` state and save the configuration. ![chadoop-3-8-01-ranger_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/chadoop-3-8-01-ranger_en.png?sv=2026-02-06&spr=https&st=2026-11-03T20%3A17%3A31Z&se=2026-11-03T21%3A17%3A31Z&sr=c&sp=r&sig=vCsiyRE11%2B4oXDIxGvSGXACl5txFJFZVC9xzj4gmwMQ%3D) 2. When the HDFS Ranger Plugin is enabled, the **Enable Ranger for HDFS** checkbox is automatically checked in **Services > HDFS > [CONFIGS] > ADVANCED > Advanced ranger-hdfs-plugin-properties**. ![chadoop-3-8-01_1_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/chadoop-3-8-01_1_en.png?sv=2026-02-06&spr=https&st=2026-11-03T20%3A17%3A31Z&se=2026-11-03T21%3A17%3A31Z&sr=c&sp=r&sig=vCsiyRE11%2B4oXDIxGvSGXACl5txFJFZVC9xzj4gmwMQ%3D) 3. In **Advanced hdfs-site**, set **dfs.permissions.enabled** to **true**. This setting is required for Ranger Audit logging. ![chadoop-3-8-01-hdfs_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/chadoop-3-8-01-hdfs_en.png?sv=2026-02-06&spr=https&st=2026-11-03T20%3A17%3A31Z&se=2026-11-03T21%3A17%3A31Z&sr=c&sp=r&sig=vCsiyRE11%2B4oXDIxGvSGXACl5txFJFZVC9xzj4gmwMQ%3D) 4. HDFS, HIVE, YARN, and PRESTO services require a restart. Click **[ACTIONS]** > **Restart All** in the top right corner and click **[CONFIRM RESTART ALL]** in the popup window to apply the changed settings. ![chadoop-3-8-02_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/chadoop-3-8-02_en.png?sv=2026-02-06&spr=https&st=2026-11-03T20%3A17%3A31Z&se=2026-11-03T21%3A17%3A31Z&sr=c&sp=r&sig=vCsiyRE11%2B4oXDIxGvSGXACl5txFJFZVC9xzj4gmwMQ%3D) Note On the left sidebar click **[...] > Restart All Required** to restart all components that need to be restarted. 1. When the **Dependent Configurations** prompt appears, click **[OK]**. ![chadoop-3-8-04_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/chadoop-3-8-04_en.png?sv=2026-02-06&spr=https&st=2026-11-03T20%3A17%3A31Z&se=2026-11-03T21%3A17%3A31Z&sr=c&sp=r&sig=vCsiyRE11%2B4oXDIxGvSGXACl5txFJFZVC9xzj4gmwMQ%3D) ## Ranger Admin UI 1. Access SSL VPN. - For SSL VPN information, see [Access a cluster node with SSH](/docs/en/hadoop-vpc-5#%EC%82%AC%EC%A0%84-%EC%9E%91%EC%97%85). 2. Select a Cloud Hadoop cluster to access the Ranger Admin UI and click **[View by Application] > Ranger Web UI**. - For more information about accessing the Ranger UI, see [View by application](/docs/en/hadoop-chadoop-3-1#application-%EB%B3%84-%EB%B3%B4%EA%B8%B0). Alternatively, check the domain address in the [Cluster details](/docs/en/hadoop-vpc-4#%ED%81%B4%EB%9F%AC%EC%8A%A4%ED%84%B0-%EC%83%81%EC%84%B8-%EC%A0%95%EB%B3%B4-%ED%99%95%EC%9D%B8) in the console. You can also access the Ranger Admin UI directly using the URL below: ``` https://{Domain address}:8443/ranger ``` ![chadoop-3-8-05_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/chadoop-3-8-05_en.png?sv=2026-02-06&spr=https&st=2026-11-03T20%3A17%3A31Z&se=2026-11-03T21%3A17%3A31Z&sr=c&sp=r&sig=vCsiyRE11%2B4oXDIxGvSGXACl5txFJFZVC9xzj4gmwMQ%3D) Note - The Ranger UI account (ID/Password) for Cloud Hadoop version 1.3 is set to admin/admin. - The Ranger UI account (ID/Password) for Cloud Hadoop version 1.4 or higher is set to admin/{password entered by the user}. 1. Access the Ranger Admin UI to see which services the policy is applied to. - When you access the Ranger Admin UI, you'll see that the HDFS, HIVE, and YARN Policy exist with the plugin enabled as a preliminary task. ![chadoop-3-8-06_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/chadoop-3-8-06_en.png?sv=2026-02-06&spr=https&st=2026-11-03T20%3A17%3A31Z&se=2026-11-03T21%3A17%3A31Z&sr=c&sp=r&sig=vCsiyRE11%2B4oXDIxGvSGXACl5txFJFZVC9xzj4gmwMQ%3D) 2. After clicking plugins in **HDFS**, check the **List of Policies** interface to see the rules in the Policy created by default. ![chadoop-3-8-07_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/chadoop-3-8-07_en.png?sv=2026-02-06&spr=https&st=2026-11-03T20%3A17%3A31Z&se=2026-11-03T21%3A17%3A31Z&sr=c&sp=r&sig=vCsiyRE11%2B4oXDIxGvSGXACl5txFJFZVC9xzj4gmwMQ%3D) - Click **Action > ![chadoop-3-8-icon-vpc_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/chadoop-3-8-icon-vpc_en.png?sv=2026-02-06&spr=https&st=2026-11-03T20%3A17%3A31Z&se=2026-11-03T21%3A17%3A31Z&sr=c&sp=r&sig=vCsiyRE11%2B4oXDIxGvSGXACl5txFJFZVC9xzj4gmwMQ%3D)**. You can verify that the **Select User** has Read, Write, and Execute permissions for all paths. ![chadoop-3-8-08_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/chadoop-3-8-08_en.png?sv=2026-02-06&spr=https&st=2026-11-03T20%3A17%3A31Z&se=2026-11-03T21%3A17%3A31Z&sr=c&sp=r&sig=vCsiyRE11%2B4oXDIxGvSGXACl5txFJFZVC9xzj4gmwMQ%3D) ## Create a Ranger Policy 1. On the first interface of the Ranger Admin UI, click **[{Cluster name}_hadoop]** Policy, which is exposed by default in the HDFS plugin. ![chadoop-3-8-10-2_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/chadoop-3-8-10-2_en.png?sv=2026-02-06&spr=https&st=2026-11-03T20%3A17%3A31Z&se=2026-11-03T21%3A17%3A31Z&sr=c&sp=r&sig=vCsiyRE11%2B4oXDIxGvSGXACl5txFJFZVC9xzj4gmwMQ%3D) 2. Select **[Add New Policy]** and add a policy as shown below. ![chadoop-3-8-10_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/chadoop-3-8-10_en.png?sv=2026-02-06&spr=https&st=2026-11-03T20%3A17%3A31Z&se=2026-11-03T21%3A17%3A31Z&sr=c&sp=r&sig=vCsiyRE11%2B4oXDIxGvSGXACl5txFJFZVC9xzj4gmwMQ%3D) ![chadoop-3-8-10-1_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/chadoop-3-8-10-1_en.png?sv=2026-02-06&spr=https&st=2026-11-03T20%3A17%3A31Z&se=2026-11-03T21%3A17%3A31Z&sr=c&sp=r&sig=vCsiyRE11%2B4oXDIxGvSGXACl5txFJFZVC9xzj4gmwMQ%3D) - You can enter a different path for **Resource Path**. Here, we used the HDFS home directory of the administrator account. Set the **[Recursive]** button status to active to apply the permissions to all files or subdirectories under a specific directory. - Select `sshuser` for **Select User** so that the SSH connection account, `sshuser`, can access this path. - Here, we granted full Read, Write, and Execute permissions. Note Cloud Hadoop creates an HDFS home directory by default for the cluster administrator account (such as `df-test17`) that you set up during installation. 1. Verify that the rule created with the `ls` command is applied. - You can access any node in the cluster. - Access SSH into the node and use the `mkdir` command to create a new directory in the `/user/{클러스터 계정명}` directory of your `sshuser` account, as shown below. - Test that the directory was appropriately created with the `ls` command. ``` $ hadoop fs -mkdir /user/{Cluster account name}/tmp $ hadoop fs -ls /user/{Cluster account name} ``` ![chadoop-3-8-11_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/chadoop-3-8-11_en.png?sv=2026-02-06&spr=https&st=2026-11-03T20%3A17%3A31Z&se=2026-11-03T21%3A17%3A31Z&sr=c&sp=r&sig=vCsiyRE11%2B4oXDIxGvSGXACl5txFJFZVC9xzj4gmwMQ%3D) 1. You can view access attempt logs through the Ranger Audit UI. ![chadoop-3-8-11-audit_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/chadoop-3-8-11-audit_en.png?sv=2026-02-06&spr=https&st=2026-11-03T20%3A17%3A31Z&se=2026-11-03T21%3A17%3A31Z&sr=c&sp=r&sig=vCsiyRE11%2B4oXDIxGvSGXACl5txFJFZVC9xzj4gmwMQ%3D) Note Cloud Hadoop version 1.8 or later additionally provides the Trino Ranger plugin. Cloud Hadoop version 1.8 or later additionally provides the TRINO plugin. (Check Ambari Web UI > Trino > [CONFIGS] > ADVANCED > Advanced ranger-trino-plugin-properties > Enable Ranger for TRINO) ### Trino access permissions management You must configure Trino access control in the order of catalog, schema, and table levels. To control permissions at the schema level, you need to first establish access control at the catalog level. Create a policy at the catalog level before creating a separate policy for the schema level. To control permissions at the catalog level: ![chadoop-3-8-11-trino](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/chadoop-3-8-11-trino.png?sv=2026-02-06&spr=https&st=2026-11-03T20%3A17%3A31Z&se=2026-11-03T21%3A17%3A31Z&sr=c&sp=r&sig=vCsiyRE11%2B4oXDIxGvSGXACl5txFJFZVC9xzj4gmwMQ%3D) 1. Select **Ranger Web UI > Trino > Add New Policy**. 2. Enter `hive` in **catalog**. 3. Enter a new user to grant permission in **Allow Conditions > Select User**.