clientaccess/disable-kerberos.html.md.erb

---
title: Disabling Kerberos Security
---

Follow these steps to disable Kerberos security for HAWQ and PXF for manual installations.

**Note:** If you install or manager your cluster using Ambari, then the HAWQ Ambari plug-in automatically disables security for HAWQ and PXF when you disable security for Hadoop. The following instructions are only necessary for manual installations, or when Hadoop security is disabled outside of Ambari.

1.  Disable Kerberos on the Hadoop cluster on which you use HAWQ.
2.  Disable security for HAWQ:
    1.  Login to the HAWQ database master server as the `gpadmin` user:

        ``` bash
        $ ssh hawq_master_fqdn
        ```

    2.  Run the following command to set up HAWQ environment variables:

        ``` bash
        $ source /usr/local/hawq/greenplum_path.sh
        ```

    3.  Start HAWQ if necessary:

        ``` bash
        $ hawq start -a
        ```

    4.  Run the following command to disable security:

        ``` bash
        $ hawq config --masteronly -c enable_secure_filesystem -v “off”
        ```

    5.  Change the permission of the HAWQ HDFS data directory:

        ``` bash
        $ sudo -u hdfs hdfs dfs -chown -R gpadmin:gpadmin /hawq_data
        ```

    6.  On the HAWQ master node and on all segment server nodes, edit the `/usr/local/hawq/etc/hdfs-client.xml` file to disable kerberos security. Comment or remove the following properties in each file:

        ``` xml
        <!--
        <property>
          <name>hadoop.security.authentication</name>
          <value>kerberos</value>
        </property>

        <property>
          <name>dfs.namenode.kerberos.principal</name>
          <value>nn/_HOST@LOCAL.DOMAIN</value>
        </property>
        -->
        ```

    7.  Restart HAWQ:

        ``` bash
        $ hawq restart -a -M fast
        ```

3.  Disable security for PXF:
    1.  On each PXF node, edit the `/etc/gphd/pxf/conf/pxf-site.xml` to comment or remove the properties:

        ``` xml
        <!--
        <property>
            <name>pxf.service.kerberos.keytab</name>
            <value>/etc/security/phd/keytabs/pxf.service.keytab</value>
            <description>path to keytab file owned by pxf service
            with permissions 0400</description>
        </property>

        <property>
            <name>pxf.service.kerberos.principal</name>
            <value>pxf/_HOST@PHD.LOCAL</value>
            <description>Kerberos principal pxf service should use.
            _HOST is replaced automatically with hostnames
            FQDN</description>
        </property>
        -->
        ```

    2.  Restart the PXF service.