安装前准备

1.1. 创建用户和用户组

groupadd ranger

useradd -g ranger ranger

1.2. 数据库配置

mysql -uroot -p -hxxx.xxx.xxx.13

创建数据库

create database ranger;

grant all privileges on ranger.* to ranger@'%' identified by '1qaz!QAZ';

安装ranger

1.3. 安装Ranger-admin

1.3.1. 解压安装包

tar -zxf ranger-2.4.0-admin.tar.gz -C /opt/

ln -s /opt/ranger-2.4.0-admin /opt/ranger-admin

1.3.2. 修改配置文件

vi /opt/ranger-admin/install.properties

PYTHON_COMMAND_INVOKER=python3

DB_FLAVOR=MYSQL

SQL_CONNECTOR_JAR=/opt/ranger-admin/mysql-connector-java.jar

db_root_user=root

db_root_password=1qaz!QAZ

db_host=xxx.xxx.xxx.13:3306

db_ssl_enabled=false

db_ssl_required=false

db_ssl_verifyServerCertificate=false

db_ssl_auth_type=2-way

javax_net_ssl_keyStore=

javax_net_ssl_keyStorePassword=

javax_net_ssl_trustStore=

javax_net_ssl_trustStorePassword=

javax_net_ssl_trustStore_type=jks

javax_net_ssl_keyStore_type=jks

db_ssl_certificate_file=

db_name=ranger

db_user=ranger

db_password=1qaz!QAZ

is_override_db_connection_string=false

db_override_connection_string=

rangerAdmin_password=Admin@123

rangerTagsync_password=Admin@123

rangerUsersync_password=Admin@123

keyadmin_password=Admin@123

audit_store=solr

audit_elasticsearch_urls=

audit_elasticsearch_port=

audit_elasticsearch_protocol=

audit_elasticsearch_user=

audit_elasticsearch_password=

audit_elasticsearch_index=

audit_elasticsearch_bootstrap_enabled=true

audit_solr_urls=https://xxx.xxx.xxx.222:8983/solr/ranger_audits

audit_solr_user=

audit_solr_password=

audit_solr_zookeepers=DPS2-DA-qas3:2181,DPS2-DA-qas4:2181,DPS2-DA-qas5:2181/ranger_audits

audit_solr_collection_name=ranger_audits

audit_solr_config_name=ranger_audits

audit_solr_configset_location=

audit_solr_no_shards=1

audit_solr_no_replica=1

audit_solr_max_shards_per_node=1

audit_solr_acl_user_list_sasl=solr,infra-solr

audit_solr_bootstrap_enabled=true

audit_cloudwatch_region=

audit_cloudwatch_log_group=

audit_cloudwatch_log_stream_prefix=

policymgr_external_url=http://localhost:6080

policymgr_http_enabled=true

policymgr_https_keystore_file=

policymgr_https_keystore_keyalias=rangeradmin

policymgr_https_keystore_password=

policymgr_supportedcomponents=

unix_user=ranger

unix_user_pwd=ranger

unix_group=ranger

authentication_method=NONE

remoteLoginEnabled=true

authServiceHostName=localhost

authServicePort=5151

ranger_unixauth_keystore=keystore.jks

ranger_unixauth_keystore_password=password

ranger_unixauth_truststore=cacerts

ranger_unixauth_truststore_password=changeit

xa_ldap_url=

xa_ldap_userDNpattern=

xa_ldap_groupSearchBase=

xa_ldap_groupSearchFilter=

xa_ldap_groupRoleAttribute=

xa_ldap_base_dn=

xa_ldap_bind_dn=

xa_ldap_bind_password=

xa_ldap_referral=

xa_ldap_userSearchFilter=

xa_ldap_ad_domain=

xa_ldap_ad_url=

xa_ldap_ad_base_dn=

xa_ldap_ad_bind_dn=

xa_ldap_ad_bind_password=

xa_ldap_ad_referral=

xa_ldap_ad_userSearchFilter=

spnego_principal=

spnego_keytab=

token_valid=30

cookie_domain=

cookie_path=/

admin_principal=

admin_keytab=

lookup_principal=

lookup_keytab=

hadoop_conf=/opt/hadoop/etc/hadoop

sso_enabled=false

sso_providerurl=https://127.0.0.1:8443/gateway/knoxsso/api/v1/websso

sso_publickey=

RANGER_ADMIN_LOG_DIR=$PWD

RANGER_ADMIN_LOGBACK_CONF_FILE=

RANGER_PID_DIR_PATH=/var/run/ranger

XAPOLICYMGR_DIR=$PWD

app_home=$PWD/ews/webapp

TMPFILE=$PWD/.fi_tmp

LOGFILE=$PWD/logfile

LOGFILES="$LOGFILE"

JAVA_BIN='java'

JAVA_VERSION_REQUIRED='1.8'

JAVA_ORACLE='Java(TM) SE Runtime Environment'

ranger_admin_max_heap_size=1g

PATCH_RETRY_INTERVAL=120

STALE_PATCH_ENTRY_HOLD_TIME=10

mysql_core_file=db/mysql/optimized/current/ranger_core_db_mysql.sql

mysql_audit_file=db/mysql/xa_audit_db.sql

oracle_core_file=db/oracle/optimized/current/ranger_core_db_oracle.sql

oracle_audit_file=db/oracle/xa_audit_db_oracle.sql

postgres_core_file=db/postgres/optimized/current/ranger_core_db_postgres.sql

postgres_audit_file=db/postgres/xa_audit_db_postgres.sql

sqlserver_core_file=db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql

sqlserver_audit_file=db/sqlserver/xa_audit_db_sqlserver.sql

sqlanywhere_core_file=db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql

sqlanywhere_audit_file=db/sqlanywhere/xa_audit_db_sqlanywhere.sql

cred_keystore_filename=$app_home/WEB-INF/classes/conf/.jceks/rangeradmin.jceks

1.3.3. 创建文件并修改权限

chown ranger:ranger /opt/ranger-admin

1.3.4. 初始化

sh /opt/ranger-admin/setup.sh

sh /opt/ranger-admin/set_globals.sh

cp /opt/hadoop/etc/hadoop/core-site.xml /opt/ranger-admin/conf

1.3.5. 启动服务

su - ranger

ranger-admin start

1.4. Ranger-usersync部署

1.4.1. 解压安装包

tar -zxf ranger-2.4.0-usersync.tar.gz -C /opt/

ln -s /opt/ranger-2.4.0-usersync /opt/ranger-usersync

1.4.2. 修改配置文件

vim /opt/ranger-usersync/install.properties

内容如下：

ranger_base_dir = /etc/ranger

POLICY_MGR_URL = http://xxx.xxx.xxx.222:6080

SYNC_SOURCE = unix

MIN_UNIX_USER_ID_TO_SYNC = 500

MIN_UNIX_GROUP_ID_TO_SYNC = 500

SYNC_INTERVAL =

unix_user=ranger

unix_group=ranger

rangerUsersync_password=Admin@123

usersync_principal=

usersync_keytab=

hadoop_conf=/etc/hadoop/conf

CRED_KEYSTORE_FILENAME=/etc/ranger/usersync/conf/rangerusersync.jceks

AUTH_SSL_ENABLED=false

AUTH_SSL_KEYSTORE_FILE=/etc/ranger/usersync/conf/cert/unixauthservice.jks

AUTH_SSL_KEYSTORE_PASSWORD=UnIx529p

AUTH_SSL_TRUSTSTORE_FILE=

AUTH_SSL_TRUSTSTORE_PASSWORD=

ROLE_ASSIGNMENT_LIST_DELIMITER = &

USERS_GROUPS_ASSIGNMENT_LIST_DELIMITER = :

USERNAME_GROUPNAME_ASSIGNMENT_LIST_DELIMITER = ,

GROUP_BASED_ROLE_ASSIGNMENT_RULES =

SYNC_LDAP_URL =

SYNC_LDAP_BIND_DN =

SYNC_LDAP_BIND_PASSWORD =

SYNC_LDAP_DELTASYNC =

SYNC_LDAP_SEARCH_BASE =

SYNC_LDAP_USER_SEARCH_BASE =

SYNC_LDAP_USER_SEARCH_SCOPE = sub

SYNC_LDAP_USER_OBJECT_CLASS = person

SYNC_LDAP_USER_SEARCH_FILTER =

SYNC_LDAP_USER_NAME_ATTRIBUTE = cn

SYNC_LDAP_USER_GROUP_NAME_ATTRIBUTE = memberof,ismemberof

SYNC_LDAP_USERNAME_CASE_CONVERSION=lower

SYNC_LDAP_GROUPNAME_CASE_CONVERSION=lower

logdir=logs

USERSYNC_PID_DIR_PATH=/var/run/ranger

SYNC_GROUP_SEARCH_ENABLED=

SYNC_GROUP_USER_MAP_SYNC_ENABLED=

SYNC_GROUP_SEARCH_BASE=

SYNC_GROUP_SEARCH_SCOPE=

SYNC_GROUP_OBJECT_CLASS=

SYNC_LDAP_GROUP_SEARCH_FILTER=

SYNC_GROUP_NAME_ATTRIBUTE=

SYNC_GROUP_MEMBER_ATTRIBUTE_NAME=

SYNC_PAGED_RESULTS_ENABLED=

SYNC_PAGED_RESULTS_SIZE=

SYNC_LDAP_REFERRAL =ignore

JVM_METRICS_ENABLED=

JVM_METRICS_FILENAME=

JVM_METRICS_FILEPATH=

JVM_METRICS_FREQUENCY_TIME_IN_MILLIS=

1.4.3. 修改权限

chown ranger:ranger /opt/ranger-usersync/

1.4.4. 初始化

sh /opt/ranger-usersync/setup.sh

1.4.5. 启动服务

 ranger-usersync start