anchor.diff:      root@kdc-server$ ssh host3.example.com chmod 400 /usr/local/greenplum-pxf/keytabs/pxf.service.keytab
       ```
   
  -**Perform the following steps on each Greenplum Database segment host**:
  +**Perform the following steps on the Greenplum Database master host**:
   
  -1. Log in to the segment host. For example:
  +1. Log in to the master host. For example:
   
       ``` shell
  -    $ ssh gpadmin@<seghost>
  +    $ ssh gpadmin@<gpmaster>
       ```
       
  -2. Install the Kerberos client packages on **each** Greenplum Database segment host if they are not already installed. You must have superuser permissions to install operating system packages. For example:
  -
  -    ``` shell
  -    root@seghost$ rpm -qa | grep krb
  -    root@seghost$ yum install krb5-libs krb5-workstation
  -    ```
  -
  -4. Open the PXF `pxf-env.sh` user configuration file in the editor of your choice. For example, to open the file with `vi` when `PXF_CONF=/usr/local/greenplum-pxf`:
  +2. Open the PXF `pxf-env.sh` user configuration file in the editor of your choice. For example, to open the file with `vi` when `PXF_CONF=/usr/local/greenplum-pxf`:
   
       ``` shell
       gpadmin@seghost$ vi /usr/local/greenplum-pxf/conf/pxf-env.sh
       ```
       
  -5. Update the `PXF_KEYTAB` and `PXF_PRINCIPAL` settings, if required. Specify the location of the keytab file and the Kerberos principal, substituting your realm. *The default values for these settings are identified below*:
  +3. Update the `PXF_KEYTAB` and `PXF_PRINCIPAL` settings, if required. Specify the location of the keytab file and the Kerberos principal, substituting your realm. *The default values for these settings are identified below*:
   
       ``` shell
       export PXF_KEYTAB="${PXF_CONF}/keytabs/pxf.service.keytab"
  
positive.code: 
  - Noted the name of the Kerberos \<realm\> in which your cluster resides.
  
  
  ## <a id="procedure"></a>Procedure
  
  Perform the following steps to configure PXF for a secure HDFS. You will perform operations on the Kerberos KDC server and Greenplum Database segment hosts.
  
  **Perform the following steps on Kerberos KDC server host**:
  
  1.  Log in to the Kerberos KDC server as the `root` user.
  
  
negative.code:     
      PXF automatically replaces ` _HOST` with the FQDN of the segment host.
  
  4. Save the file and exit the editor.
  
  5. Synchronize the PXF configuration to your Greenplum Database cluster and restart PXF. For example:
  
      ``` shell
      gpadmin@seghost$ $GPHOME/pxf/bin/pxf cluster sync
      gpadmin@master$ $GPHOME/pxf/bin/pxf cluster stop
      gpadmin@master$ $GPHOME/pxf/bin/pxf cluster start
      ```
  
  