title: "Administration" date: 2019-03-13T18:28:09-07:00 draft: false
A recommended setup consists in:
Performing a GET /desktop/debug/is_alive will return a 200 response if running.
Hue is often run with:
The task server is currently a work in progress to outsource all the blocking or resource intensive operations outside of the API server. Follow (HUE-8738)[https://issues.cloudera.org/browse/HUE-8738) for more information on when first usable task will be released.
Until then, here is how to try the task server service.
Make sure you have Rabbit MQ installed and running.
sudo apt-get install rabbitmq-server -y
In hue.ini, telling the API server that the Task Server is available:
[desktop]
[[task_server]]
enabled=true
Starting the Task server:
./build/env/bin/celery worker -l info -A desktop
Running a test tasks:
./build/env/bin/hue shell
from desktop.celery import debug_task
debug_task.delay()
debug_task.delay().get() # Works if result backend is setup and task_server is true in the hue.ini
Starting the Task Scheduler server:
./build/env/bin/celery -A core beat -l info
or when Django Celery Beat is enabled:
./build/env/bin/celery -A core beat -l info --scheduler django_celery_beat.schedulers:DatabaseScheduler
A Web proxy lets you centralize all the access to a certain URL and prettify the address (e.g. ec2-54-247-321-151.compute-1.amazonaws.com --> demo.gethue.com).
Here is one way to do it with Apache.
The Quick Start wizard allows you to perform the following Hue setup operations by clicking the tab of each step or sequentially by clicking Next in each screen:
Displays a list of the installed Hue applications and their configuration. The location of the folder containing the Hue configuration files is shown at the top of the page. Hue configuration settings are in the hue.ini configuration file.
Click the tabs under Configuration Sections and Variables to see the settings configured for each application. For information on configuring these settings, see Hue Configuration in the Hue installation manual.
Hue ships with a default configuration that will work for
pseudo-distributed clusters. If you are running on a real cluster, you must
make a few changes to the hue.ini configuration file (/etc/hue/hue.ini when installed from the
package version) or pseudo-distributed.ini in desktop/conf when in development mode).
The following sections describe the key configuration options you must make to configure Hue.
These configuration variables are under the [desktop] section in
the hue.ini configuration file.
Hue uses CherryPy web server. You can use the following options to change the IP address and port that the web server listens on. The default setting is port 8888 on all configured IP addresses.
# Webserver listens on this address and port
http_host=0.0.0.0
http_port=8888
Gunicorn support is planned to come in via HUE-8739.
For security, you should also specify the secret key that is used for secure hashing in the session store. Enter a long series of random characters (30 to 60 characters is recommended).
secret_key=jFE93j;2[290-eiw.KEiwN2s3['d;/.q[eIW^y#e=+Iei*@Mn<qW5o
NOTE: If you don't specify a secret key, your session cookies will not be secure. Hue will run but it will also display error messages telling you to set the secret key.
In the Hue ini configuration file, in the [desktop] section, you can enter the names of the app to hide:
[desktop] # Comma separated list of apps to not load at server startup. app_blacklist=beeswax,impala,security,filebrowser,jobbrowser,rdbms,jobsub,pig,hbase,sqoop,zookeeper,metastore,spark,oozie,indexer
By default, the first user who logs in to Hue can choose any username and password and becomes an administrator automatically. This user can create other user and administrator accounts. User information is stored in the Django database in the Django backend.
The authentication system is pluggable. For more information, see the SDK Documentation.
List of some of the possible authentications:
For example, to enable Hue to first attempt LDAP directory lookup before falling back to the database-backed user model, we can update the hue.ini configuration file or Hue safety valve in Cloudera Manager with a list containing first the LdapBackend followed by either the ModelBackend or custom AllowFirstUserDjangoBackend (permits first login and relies on user model for all subsequent authentication):
[desktop] [[auth]] backend=desktop.auth.backend.LdapBackend,desktop.auth.backend.AllowFirstUserDjangoBackend
This tells Hue to first check against the configured LDAP directory service, and if the username is not found in the directory, then attempt to authenticate the user with the Django user manager.
Programmatically
When a Hue administrator loses their password, a more programmatic approach is required to secure the administrator again. Hue comes with a wrapper around the python interpreter called the “shell” command. It loads all the libraries required to work with Hue at a programmatic level. To start the Hue shell, type the following command from the Hue installation root.
Then:
cd /usr/lib/hue (or /opt/cloudera/parcels/CDH-XXXXX/share/hue if using parcels and CM)
build/env/bin/hue shell
The following is a small script, that can be executed within the Hue shell, to change the password for a user named “example”:
from django.contrib.auth.models import User
user = User.objects.get(username='example')
user.set_password('some password')
user.save()
The script can also be invoked in the shell by using input redirection (assuming the script is in a file named script.py):
build/env/bin/hue shell < script.py
How to make a certain user a Hue admin
build/env/bin/hue shell
Then set these properties to true:
from django.contrib.auth.models import User
a = User.objects.get(username='hdfs')
a.is_staff = True
a.is_superuser = True
a.set_password('my_secret')
a.save()
** Via a command**
Go on the Hue machine, then in the Hue home directory and either type:
To change the password of the currently logged in Unix user:
build/env/bin/hue changepassword
If you don't remember the admin username, create a new Hue admin (you will then also be able to login and could change the password of another user in Hue):
build/env/bin/hue createsuperuser
The properties we need to tweak are leaflet_tile_layer and leaflet_tile_layer_attribution, that can be configured in the hue.ini file:
[desktop]
leaflet_tile_layer=https://server.arcgisonline.com/ArcGIS/rest/services/World_Imagery/MapServer/tile/{z}/{y}/{x}
leaflet_tile_layer_attribution='Tiles © Esri — Source: Esri, i-cubed, USDA, USGS, AEX, GeoEye, Getmapping, Aerogrid, IGN, IGP, UPR-EGP, and the GIS User Community'
We explained how to run Hue with NGINX serving the static files or under Apache. If you use another proxy, you might need to set these options:
[desktop] # Enable X-Forwarded-Host header if the load balancer requires it. use_x_forwarded_host=false # Support for HTTPS termination at the load-balancer level with SECURE_PROXY_SSL_HEADER. secure_proxy_ssl_header=false
You can configure Hue to serve over HTTPS.
Configure Hue to use your private key by adding the following
options to the hue.ini configuration file:
ssl_certificate=/path/to/certificate ssl_private_key=/path/to/key
Ideally, you would have an appropriate key signed by a Certificate Authority.
If you're just testing, you can create a self-signed key using the openssl
command that may be installed on your system:
Create a key:
openssl genrsa 1024 > host.key
Create a self-signed certificate:
openssl req -new -x509 -nodes -sha1 -key host.key > host.cert
Note: The security vulnerability SWEET32 is also called Birthday attacks against TLS ciphers with 64bit block size and it is assigned CVE-2016-2183. This is due to legacy block ciphers having block size of 64 bits are vulnerable to a practical collision attack when used in CBC mode.
DES/3DES are the only ciphers has block size of 64-bit. One way to config Hue not to use them:
[desktop] ssl_cipher_list=DEFAULT:!DES:!3DES
When getting a bigger result set from Hive/Impala or bigger files like images from HBase, the response requires to increase the buffer size of SASL lib for thrift sasl communication.
[desktop] # This property specifies the maximum size of the receive buffer in bytes in thrift sasl communication, # default value is 2097152 (2 MB), which equals to (2 * 1024 * 1024) sasl_max_buffer=2097152
In the [useradmin] section of the configuration file, you can
optionally specify the following:
default_user_group:: The name of a default group that is suggested when creating a user manually. If the LdapBackend or PamBackend are configured for doing user authentication, new users will automatically be members of the default group.
You can add a custom banner to the Hue Web UI by applying HTML directly to the property, banner_top_html. For example:
banner_top_html=<H4>My company's custom Hue Web UI banner</H4>
You can customize a splash screen on the login page by applying HTML directly to the property, login_splash_html. For example:
[desktop]
[[custom]]
login_splash_html=WARNING: You are required to have authorization before you proceed.
There is also the possibility to change the logo for further personalization.
[desktop]
[[custom]]
# SVG code to replace the default Hue logo in the top bar and sign in screen
# e.g. <image xlink:href="/static/desktop/art/hue-logo-mini-white.png" x="0" y="0" height="40" width="160" />
logo_svg=
You can go crazy and write there any SVG code you want. Please keep in mind your SVG should be designed to fit in a 160×40 pixels space. To have the same ‘hearts logo' you can see above, you can type this code
[desktop]
[[custom]]
logo_svg='<g><path stroke="null" id="svg_1" d="m44.41215,11.43463c-4.05017,-10.71473 -17.19753,-5.90773 -18.41353,-0.5567c-1.672,-5.70253 -14.497,-9.95663 -18.411,0.5643c-4.35797,11.71793 16.891,22.23443 18.41163,23.95773c1.5181,-1.36927 22.7696,-12.43803 18.4129,-23.96533z" fill="#ffffff"/> <path stroke="null" id="svg_2" d="m98.41246,10.43463c-4.05016,-10.71473 -17.19753,-5.90773 -18.41353,-0.5567c-1.672,-5.70253 -14.497,-9.95663 -18.411,0.5643c-4.35796,11.71793 16.891,22.23443 18.41164,23.95773c1.5181,-1.36927 22.76959,-12.43803 18.41289,-23.96533z" fill="#FF5A79"/> <path stroke="null" id="svg_3" d="m154.41215,11.43463c-4.05016,-10.71473 -17.19753,-5.90773 -18.41353,-0.5567c-1.672,-5.70253 -14.497,-9.95663 -18.411,0.5643c-4.35796,11.71793 16.891,22.23443 18.41164,23.95773c1.5181,-1.36927 22.76959,-12.43803 18.41289,-23.96533z" fill="#ffffff"/> </g>'
Read more about it in Hue with a custom logo post.
This article details how to store passwords in a script launched from the OS rather than have clear text passwords in the hue*.ini files.
Some passwords go in Hue ini configuration file making them easily visible to Hue admin user or by users of cluster management software. You can use the password_script feature to prevent passwords from being visible.
Hue now offers a new property, idle_session_timeout, that can be configured in the hue.ini file:
[desktop] [[auth]] idle_session_timeout=600
When idle_session_timeout is set, users will automatically be logged out after N (e.g. – 600) seconds of inactivity and be prompted to login again:
Read more about Auditing User Administration Operations with Hue and Cloudera Navigator.
Now that you've installed and started Hue, you can feel free to skip ahead to the <> section. Administrators may want to refer to this section for more details about managing and operating a Hue installation.
Hue can detect certain invalid configuration.
To view the configuration of a running Hue instance, navigate to
http://myserver:8888/hue/dump_config, also accessible through the About
application.
Displays the Hue Server log and allows you to download the log to your local system in a zip file.
Read more on the Threads and Metrics pages blog post
Threads page can be very helpful in debugging purposes. It includes a daemonic thread and the thread objects serving concurrent requests. The host name, thread name identifier and current stack frame of each are displayed. Those are useful when Hue “hangs”, sometimes in case of a request too CPU intensive. There is also a REST API to get the dump of Threads using 'desktop/debug/threads'
Read more on the Threads and Metrics pages blog post
Hue uses the PyFormance Python library to collect the metrics. These metrics are represented as gauge, counters, meter, rate of events over time, histogram, statistical distribution of values. A REST API endpoint '/desktop/metrics/' to get all the metrics dump as json is also exposed
The below metrics of most concern to us are displayed on the page:
One of the most useful ones are the percentiles of response time of requests and the count of active users. Admins can either filter a particular property in all the metrics or select a particular metric for all properties
The User Admin application lets a superuser add, delete, and manage Hue users and groups, and configure group permissions. Superusers can add users and groups individually, or import them from an LDAP directory. Group permissions define the Hue applications visible to group members when they log into Hue and the application features available to them.
Click the User Admin icon in the top right navigation bar under your username.
LDAP or PAM pass-through authentication with Hive or Impala and Impersonation .
The User Admin application provides two levels of user privileges: superusers and users.
Superusers — The first user who logs into Hue after its initial installation becomes the first superuser. Superusers have permissions to perform administrative functions:
Users can change their name, e-mail address, and password and log in to Hue and run Hue applications, subject to the permissions provided by the Hue groups to which they belong.
| Username | A user name that contains only letters, numbers, and underscores; | ||||||||||||||||||||||||||||||||
| Password and Password confirmation | A password for the user. This is a required field. | ||||||||||||||||||||||||||||||||
| Create home directory | Indicate whether to create a directory named /user/username in HDFS. |
| First name and Last name | The user's first and last name. |
| E-mail address | The user's e-mail address. The e-mail address is used by the Job Designer and Beeswax applications to send users an e-mail message after certain actions have occurred. The Job Designer sends an e-mail message after a job has completed. Beeswax sends a message after a query has completed. If an e-mail address is not specified, the application will not attempt to email the user. |
| Groups | The groups to which the user belongs. By default, a user is assigned to the **default** group, which allows access to all applications. See [Permissions](#permissions). |
| Active | Indicate that the user is enabled and allowed to log in. Default: checked. |
| Superuser status | Assign superuser privileges to the user. |
Note:
Importing users from an LDAP directory does not import any password information. You must add passwords manually in order for a user to log in.
To add a user from an external LDAP directory:
| Username | The user name. |
| Distinguished name | Indicate that Hue should use a full distinguished name for the user. This imports the user's first and last name, username, and email, but does not store the user password. |
| Create home directory | Indicate that Hue should create a home directory for the user in HDFS. |
Click Add/sync user.
If the user already exists in the User Admin, the user information in User Admin is synced with what is currently in the LDAP directory.
You can sync the Hue user database with the current state of the LDAP directory using the Sync LDAP users/groups function. This updates the user and group information for the already imported users and groups. It does not import any new users or groups.
Superusers can add and delete groups, configure group permissions, and assign users to group memberships.
You can add groups, and delete the groups you've added. You can also import groups from an LDAP directory.
| Name | The name of the group. Group names can only be letters, numbers, and underscores; blank spaces are not allowed. |
| Members | The users in the group. Check user names or check Select all. |
| Permissions | The applications the users in the group can access. Check application names or check Select all. |
[desktop]
[[ldap]]
login_groups=ldap_grp1,ldap_grp2,ldap_grp3
| Name | The name of the group. |
| Distinguished name | Indicate that Hue should use a full distinguished name for the group. |
| Import new members | Indicate that Hue should import the members of the group. |
| Import new members from all subgroups | Indicate that Hue should import the members of the subgroups. |
| Create home directories | Indicate that Hue should create home directories in HDFS for the imported members. |
Permissions for Hue applications are granted to groups, with users gaining permissions based on their group membership. Group permissions define the Hue applications visible to group members when they log into Hue and the application features available to them.
A script called supervisor manages all Hue processes. The supervisor is a
watchdog process -- its only purpose is to spawn and monitor other processes.
A standard Hue installation starts and monitors the following processes:
runcpserver - a web server based on CherryPy that provides the core web
functionality of HueIf you have installed other applications into your Hue instance, you may see other daemons running under the supervisor as well.
You can see the supervised processes running in the output of ps -f -u hue:
UID PID PPID C STIME TTY TIME CMD
hue 8685 8679 0 Aug05 ? 00:01:39 /usr/share/hue/build/env/bin/python /usr/share/hue/build/env/bin/desktop runcpserver
Note that the supervisor automatically restarts these processes if they fail for any reason. If the processes fail repeatedly within a short time, the supervisor itself shuts down.
The Hue logs are found in /var/log/hue, or in a logs directory under your
Hue installation root. Inside the log directory you can find:
access.log file, which contains a log for all requests against the Hue
web server.supervisor.log file, which contains log information for the supervisor
process.supervisor.out file, which contains the stdout and stderr for the
supervisor process..log file for each supervised process described above, which contains
the logs for that process..out file for each supervised process described above, which contains
the stdout and stderr for that process.If users on your cluster have problems running Hue, you can often find error
messages in these log files. If you are unable to start Hue from the init
script, the supervisor.log log file can often contain clues.
In addition to logging INFO level messages to the logs directory, the Hue
web server keeps a small buffer of log messages at all levels in memory. You can
view these logs by visiting http://myserver:8888/hue/logs. The DEBUG level
messages shown can sometimes be helpful in troubleshooting issues.
To troubleshoot why Hue is slow or consuming high memory, admin can enable instrumentation by setting the instrumentation flag to True.
[desktop] instrumentation=trueIf
django_debug_mode is enabled, instrumentation is automatically enabled. This flag appends the response time and the total peak memory used since Hue started for every logged request.
[17/Apr/2018 15:18:43 -0700] access INFO 127.0.0.1 admin - "POST /jobbrowser/jobs/ HTTP/1.1" `returned in 97ms (mem: 135mb)`
[23/Apr/2018 10:59:01 -0700] INFO 127.0.0.1 admin - "POST /jobbrowser/jobs/ HTTP/1.1" returned in 88ms
Hue requires a SQL database to store small amounts of data, including user account information as well as history of job submissions and Hive queries. By default, Hue is configured to use the embedded database SQLite for this purpose, and should require no configuration or management by the administrator. However, MySQL is the recommended database to use. This section contains instructions for configuring Hue to access MySQL and other databases.
The default SQLite database used by Hue is located in: /usr/share/hue/desktop/desktop.db.
You can inspect this database from the command line using the sqlite3
program or typing `/usr/share/hue/build/env/bin/hue dbshell'. For example:
sqlite3 /usr/share/hue/desktop/desktop.db
SQLite version 3.6.22
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite> select username from auth_user;
admin
test
sample
sqlite>
It is strongly recommended that you avoid making any modifications to the database directly using SQLite, though this trick can be useful for management or troubleshooting.
If you use the default SQLite database, then copy the desktop.db file to
another node for backup. It is recommended that you back it up on a regular
schedule, and also that you back it up before any upgrade to a new version of
Hue.
Although SQLite is the default database type, some advanced users may prefer to have Hue access an alternate database type. Note that if you elect to configure Hue to use an external database, upgrades may require more manual steps in the future.
The following instructions are for MySQL, though you can also configure Hue to work with other common databases such as PostgreSQL and Oracle.
To configure Hue to store data in MySQL:
Create a new database in MySQL and grant privileges to a Hue user to manage this database.
mysql> create database hue; Query OK, 1 row affected (0.01 sec) mysql> grant all on hue.* to 'hue'@'localhost' identified by 'secretpassword'; Query OK, 0 rows affected (0.00 sec)
Shut down Hue if it is running.
To migrate your existing data to MySQL, use the following command to dump the existing database data to a text file. Note that using the ".json" extension is required.
/usr/share/hue/build/env/bin/hue dumpdata > $some-temporary-file.json
Open the hue.ini file in a text editor. Directly below the
[[database]] line, add the following options (and modify accordingly for
your MySQL setup):
host=localhost port=3306 engine=mysql user=hue password=secretpassword name=hue
As the Hue user, configure Hue to load the existing data and create the necessary database tables:
/usr/share/hue/build/env/bin/hue syncdb --noinput mysql -uhue -psecretpassword -e "DELETE FROM hue.django_content_type;" /usr/share/hue/build/env/bin/hue loaddata $temporary-file-containing-dumped-data.json
Your system is now configured and you can start the Hue server as normal.