title: Regarding Hadoop Security via Kerberos
body: <p>I am trying to learn how Kerberos can be implemented in Hadoop.<br>
  I have gone through this doc  <a href="https://issues.apache.org/jira/browse/HADOOP-4487" rel="nofollow">https://issues.apache.org/jira/browse/HADOOP-4487</a><br>
  I have also gone through Basic Kerberos stuff (<a href="https://www.youtube.com/watch?v=KD2Q-2ToloE" rel="nofollow">https://www.youtube.com/watch?v=KD2Q-2ToloE</a>)</p>
  
  <p>1) The Apache doc uses the word <strong>"Token"</strong> whereas the general doc over the internet uses the term <strong>"Ticket"</strong>.</p>
  
  <p>Are Token and Ticket same ?</p>
  
  <p>2) The Apache doc also    "DataNodes do not enforce any access control on accesses to its data blocks. </p>
  
  <p>This makes it possible for an unauthorized client to read a data block as
        long as she can supply its block ID. It’s also possible for anyone to write
        arbitrary data blocks to DataNodes."</p>
  
  <p>My thoughts on this:- </p>
  
  <p>I can fetch the block Id from file path using the command:-</p>
  
  <pre><code>hadoop@Studio-1555:/opt/hadoop/hadoop-1.0.2/bin$ ./hadoop fsck /hadoop/mapred/system/jobtracker.info -files -blocks
  </code></pre>
  
  <p>FSCK started by hadoop from /127.0.0.1 for path /hadoop/mapred/system/jobtracker.info at Mon Jul 09 06:57:14 EDT 2012
  /hadoop/mapred/system/jobtracker.info 4 bytes, 1 block(s):  OK
  0. blk_-9148080207111019586_1001 len=4 repl=1</p>
  
  <p>As I was authorized to access this file jobtracker.info, I was able to find its blockID using the above command.<br>
  I think that if I add some offset to this block ID and write to that datanode.</p>
  
  <p>How can I explicitly mention the blockID while writing a file to HDFS.(What is the command ?)<br>
  Any other way to  write arbitrary data blocks to DataNodes ?</p>
  
  <p>Please tell me if my approach is wrong ?</p>