hadoop-sec-bench

hadoop-sec-bench is a security best practices assessment, auditing, hardening and forensics readiness tool for Hadoop clusters. The primary goal is to test security defenses and provide tips for further system hardening. It will also scan for general system information, vulnerable packages, and possible configuration issues.

Goals

The main goals are:

Automated security auditing
Compliance testing
Vulnerability detection
Configuration and asset management
Software patch management
System hardening
Penetration testing (privilege escalation)
Intrusion detection

Audience

System administrators
Auditors
Security officers
Penetration testers
Security professionals

Disclaimers

These benchs aren't approved by the Center For Internet Security

Platform

HortonWorks
Cloudera
Vanilla Apache
MapR

Features

It covers hardening and security best practices for Hadoop clusters related to:

Data Management
Identity & Access Management
Data Protection & Privacy
Network Security
Infrastructure Security & Integrity

Running

Run with:

./run.sh --file mapping.json --dry --reporter json -vvvvvv

You need a JSON file with:

{
 "host1": {"target": "ssh://root:password@host1", "components": ["hdfs-client", "hbase-client"]},
 "host2": {"target": "ssh://root:password@host2", "components": ["hdfs-namenode", "hdfs-http", "hbase-master"]},
 "host3": {"target": "ssh://root:password@host3", "components": ["hdfs-datanode", "hbase-regionserver"]},
 "host4": {"target": "ssh://root:password@host4", "components": ["hdfs-secondarynamenode", "hbase-rest"]}
}

./run.sh -h
run.sh [OPTION...]
-f, --file           The json mapping file with argument (default: ./mapping.json)
-d, --dry            Dry run (default: 0)
-r, --reporter       InSpec reporter to use (default: cli)
-v, --verbose        Enable verbose output (include multiple times for more
                     verbosity, e.g. -vvv)

Generating mapping file from Ambari

Generating mapping file from Cloudera Manager

Contribute

Do you have something to share? An idea? An issue?

Authors

Vincent Devillers

License

hadoop-sec-bench is proudly powered by open source softwares and is free (like a bird) to download and use (and will always be) ... Both source code and documentations are released under the GNU AGPLv3 license. For more details, please read the file LICENSE included in the repo, in the archive or directly on the GNU project website http://www.gnu.org/licenses/agpl-3.0.html

Treydone/hadoop-sec-bench