【Ranger】hortonworks ambari安装ranger错误解决

一、安装时依次解决的问题

1 /usr/hdp/current/ranger-usersync/conf doesn’t exist

Credential ranger.usersync.policymgr.password has NOT been created. Mkdirs failed to create file:/usr/hdp/current/ranger-usersync/conf (exists=false, cwd=file:/var/lib/ambari-agent)
详细报错：

resource_management.core.exceptions.Fail: Applying File['/usr/hdp/current/ranger-usersync/conf/ugsync.jceks'] failed, parent directory /usr/hdp/current/ranger-usersync/conf doesn't exist

Credential ranger.usersync.policymgr.password has NOT been created. Mkdirs failed to create file:/usr/hdp/current/ranger-usersync/conf (exists=false, cwd=file:/var/lib/ambari-agent)
create <alias> [-value alias-value] [-provider provider-path] [-strict]:

The create subcommand creates a new credential for the name
specified as the <alias> argument within the provider indicated
through the -provider argument. If -strict is supplied, fail
immediately if the provider requires a password and none is given.
If -value is provided, use that for the value of the credential
instead of prompting the user.
java.io.IOException: Mkdirs failed to create file:/usr/hdp/current/ranger-usersync/conf (exists=false, cwd=file:/var/lib/ambari-agent)
	at org.apache.hadoop.fs.ChecksumFileSystem.create(ChecksumFileSystem.java:458)
	at org.apache.hadoop.fs.ChecksumFileSystem.create(ChecksumFileSystem.java:443)
	at org.apache.hadoop.fs.FileSystem.create(FileSystem.java:1118)
	at org.apache.hadoop.fs.FileSystem.create(FileSystem.java:1098)
	at org.apache.hadoop.fs.FileSystem.create(FileSystem.java:987)
	at org.apache.hadoop.fs.FileSystem.create(FileSystem.java:975)
	at org.apache.hadoop.fs.FileSystem.create(FileSystem.java:652)
	at org.apache.hadoop.security.alias.JavaKeyStoreProvider.getOutputStreamForKeystore(JavaKeyStoreProvider.java:59)
	at org.apache.hadoop.security.alias.AbstractJavaKeyStoreProvider.flush(AbstractJavaKeyStoreProvider.java:288)
	at org.apache.hadoop.security.alias.CredentialShell$CreateCommand.execute(CredentialShell.java:355)
	at org.apache.hadoop.tools.CommandShell.run(CommandShell.java:72)
	at org.apache.ranger.credentialapi.buildks.createKeyStore(buildks.java:149)
	at org.apache.ranger.credentialapi.buildks.createCredential(buildks.java:86)
	at org.apache.ranger.credentialapi.buildks.main(buildks.java:40)
2020-02-26 15:38:03,047 - File['/usr/hdp/current/ranger-usersync/conf/ugsync.jceks'] {'owner': 'ranger', 'group': 'ranger', 'mode': 0640}
2020-02-26 15:38:03,052 - The repository with version 3.1.0.0-78 for this command has been marked as resolved. It will be used to report the version of the component which was installed

解决办法：

[root@host-10-211-55-60 ranger-usersync]# mv conf conf.bck
[root@host-10-211-55-60 ranger-usersync]# ln -s /etc/ranger-usersync/2.6.3.0-235/0 /usr/hdp/current/ranger-usersync/conf

#注：
#刚开始我不是这么改的，这样也过去了，后来解决ranger-admin,及ranger-tagsync都碰到这个问题了，
#发现大都是上面这种改法，所以把ranger-usersync也重新改成上面这种了
[root@host-10-211-55-60 ranger-usersync]# cd /usr/hdp/current/ranger-usersync
[root@host-10-211-55-60 ranger-usersync]# mv conf conf.bck
[root@host-10-211-55-60 ranger-usersync]# ln -s conf.dist conf

2. Access denied for user ‘root’@‘10.211.55.60’ to database ‘mysql’ ErrorCode: 1044

SQLException : SQL state: 42000 com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Access denied for user 'root'@'10.211.55.60' to database 'mysql' ErrorCode: 1044 2020-02-26 16:24:19,929 [E] Creating MySQL user root failed..
解决办法：

# 这里应该授权就行了
mysql > grant all privileges on ranger.* to 'root'@'10.211.55.60' identified by '123456' with grant option;
mysql > flush privileges;

#但是我开始，以为我ranger数据库管理员设为root不行，所以又改回了rangeradmin，给rangeradmin授权的
mysql > CREATE USER 'rangeradmin'@'%' IDENTIFIED BY '123456';
mysql > GRANT ALL PRIVILEGES ON *.* TO 'rangeradmin'@'%' WITH GRANT OPTION;
mysql > FLUSH PRIVILEGES;

3. cannot change directory to /home/ranger: Permission denied

resource_management.core.exceptions.ExecutionFailed: Execution of '/usr/hdp/current/ranger-admin/ews/ranger-admin-services.sh stop' returned 126. su: warning: cannot change directory to /home/ranger: Permission denied -bash: /home/ranger/.bash_profile: Permission denied
解决办法：

#切换用户，报错
su ranger
bash: /home/ranger/.bashrc: Permission denied
# 查看属主
id ranger
uid=1020(ranger) gid=1004(hadoop) groups=1004(hadoop),1007(ranger)
ls -ld /home/ranger
drwx------ 3 1016 hadoop 83 Nov 28  2017 /home/ranger

#解决办法,更改属主
chown -R ranger:hadoop /home/ranger

4. /usr/hdp/current/ranger-admin/ews/ranger-admin-services.sh: Permission denied

resource_management.core.exceptions.ExecutionFailed: Execution of ‘/usr/hdp/current/ranger-admin/ews/ranger-admin-services.sh stop’ returned 126. -bash: /usr/hdp/current/ranger-admin/ews/ranger-admin-services.sh: Permission denied
解决办法：

cd /usr/hdp/current/ranger-admin/ews/
chrow a+x /usr/hdp/current/ranger-admin/ews/ranger-admin-services.sh

5. Access denied for user ‘root’@‘10.211.55.60’ to database ‘mysql’ ErrorCode: 1044

SQLException : SQL state: 42000 com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Access denied for user ‘root’@‘10.211.55.60’ to database ‘mysql’ ErrorCode: 1044
2020-02-26 17:20:05,601 [E] Can’t establish db connection… Exiting…
详细报错：

2020-02-26 17:20:05,193  [I] Running DBA setup script. QuiteMode:True
2020-02-26 17:20:05,193  [I] Using Java:/usr/jdk64/jdk1.8.0_112/bin/java
2020-02-26 17:20:05,193  [I] DB FLAVOR:MYSQL
2020-02-26 17:20:05,193  [I] DB Host:10.211.55.60
2020-02-26 17:20:05,193  [I] ---------- Verifying DB root password ---------- 
2020-02-26 17:20:05,193  [I] DBA root user password validated
2020-02-26 17:20:05,193  [I] ---------- Verifying Ranger Admin db user password ---------- 
2020-02-26 17:20:05,194  [I] admin user password validated
2020-02-26 17:20:05,194  [I] ---------- Creating Ranger Admin db user ---------- 这里重点看一下
2020-02-26 17:20:05,194  [JISQL] /usr/jdk64/jdk1.8.0_112/bin/java  -cp /usr/hdp/current/ranger-admin/ews/lib/mysql-connector-java.jar:/usr/hdp/current/ranger-admin/jisql/lib/* org.apache.util.sql.Jisql -driver mysqlconj -cstring jdbc:mysql://10.211.55.60/mysql -u root -p '********' -noheader -trim -c \; -query "SELECT version();"
SQLException : SQL state: 42000 com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Access denied for user 'root'@'10.211.55.60' to database 'mysql' ErrorCode: 1044
2020-02-26 17:20:05,601  [E] Can't establish db connection.. Exiting..

解决办法：

mysql> select host,user,password,Create_routine_priv,Super_priv from user;
+-------------+-------------+-------------------------------------------+---------------------+------------+
| host        | user        | password                                  | Create_routine_priv | Super_priv |
+-------------+-------------+-------------------------------------------+---------------------+------------+
| %           | root        | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 | Y                   | Y          |
| 10.211.55.60 | root        | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 | N                   | N          |

# 想着有root@%,就把[email protected]删除了，发现删除还是报这个错
mysql> delete from user where host="10.211.55.60";
Query OK, 1 row affected (0.01 sec)

# 那就再重新添加[email protected],添加完又报root@host-10-211-55-60,所以还得再添加一个
#SQLException : SQL state: 28000 java.sql.SQLException: Access denied for user 'root'@'host-10-211-55-60' (using password: YES) ErrorCode: 1045
# grant 权限1,权限2,…权限n on 数据库名称.表名称 to 用户名@用户地址 identified by ‘连接口令’;
mysql> grant all privileges on *.* to 'root'@'10.211.55.60' identified by '123456';
mysql> FLUSH PRIVILEGES;
mysql> grant all privileges on *.* to 'root'@'host-10-211-55-60' identified by '123456';
mysql> FLUSH PRIVILEGES;

6. Access denied for user ‘root’@‘10.211.55.60’ to database ‘ranger’ ErrorCode: 1044

SQLException : SQL state: 42000 com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Access denied for user 'root'@'10.211.55.60' to database 'ranger' ErrorCode: 1044 2020-02-26 18:16:32,851 [E] Granting privileges to 'rangeradmin' failed on 'ranger'
详细报错：

2020-02-26 18:16:29,450  [I] ---------- Granting privileges TO user 'rangeradmin'@'%' on db 'ranger'----------
2020-02-26 18:16:29,450  [JISQL] /usr/jdk64/jdk1.8.0_112/bin/java  -cp /usr/hdp/current/ranger-admin/ews/lib/mysql-connector-java.jar:/usr/hdp/current/ranger-admin/jisql/lib/* org.apache.util.sql.Jisql -driver mysqlconj -cstring jdbc:mysql://10.211.55.60/mysql -u root -p '********' -noheader -trim -c \; -query "grant all privileges on ranger.* to 'rangeradmin'@'%' with grant option;"
SQLException : SQL state: 42000 com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Access denied for user 'root'@'10.211.55.60' to database 'ranger' ErrorCode: 1044
SQLException : SQL state: 42000 com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Access denied for user 'root'@'10.211.55.60' to database 'ranger' ErrorCode: 1044
2020-02-26 18:16:30,913  [I] SQL statement execution failed!! retrying attempt 2 of total 3
SQLException : SQL state: 42000 com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Access denied for user 'root'@'10.211.55.60' to database 'ranger' ErrorCode: 1044
SQLException : SQL state: 42000 com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Access denied for user 'root'@'10.211.55.60' to database 'ranger' ErrorCode: 1044
2020-02-26 18:16:32,364  [I] SQL statement execution failed!! retrying attempt 3 of total 3
SQLException : SQL state: 42000 com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Access denied for user 'root'@'10.211.55.60' to database 'ranger' ErrorCode: 1044
SQLException : SQL state: 42000 com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Access denied for user 'root'@'10.211.55.60' to database 'ranger' ErrorCode: 1044
2020-02-26 18:16:32,851  [E] Granting privileges to 'rangeradmin' failed on 'ranger'

解决办法： 还是授权问题

mysql> grant all privileges on *.* to 'rangeradmin'@'%' with grant option;
mysql> grant all privileges on *.* to 'rangeradmin'@'10.211.55.60' with grant option;
mysql> grant all privileges on *.* to 'rangeradmin'@'host-10-211-55-60' with grant option;
mysql> flush privileges;
#执行完还是报错，可看root可是*.*,所有数据库，所有表权限
mysql> show grants for root;
+--------------------------------------------------------------------------------------------------------------------------------+
| Grants for root@%                                                                                                              |
+--------------------------------------------------------------------------------------------------------------------------------+
| GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY PASSWORD '*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9' WITH GRANT OPTION |
+--------------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

mysql> show grants for rangeradmin;
+---------------------------------------------------------------------------------------------------------------------------------------+
| Grants for rangeradmin@%                                                                                                              |
+---------------------------------------------------------------------------------------------------------------------------------------+
| GRANT ALL PRIVILEGES ON *.* TO 'rangeradmin'@'%' IDENTIFIED BY PASSWORD '*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9' WITH GRANT OPTION |
| GRANT ALL PRIVILEGES ON `ranger`.* TO 'rangeradmin'@'%' WITH GRANT OPTION                                                             |
+---------------------------------------------------------------------------------------------------------------------------------------+
##看着rangeradmin也没问题，mysql -urangeradmin -p*****也可以登录成功,访问ranger数据库更是没问题
##这个问题出的实在是费解，权限应有尽有，还能是什么问题呢？
##到后台shell中执行如下命令,还是报Access denied for user 'root'@'10.211.55.60' to database 'ranger'
#/usr/jdk64/jdk1.8.0_112/bin/java  -cp /usr/hdp/current/ranger-admin/ews/lib/mysql-connector-java.jar:/usr/hdp/current/ranger-admin/jisql/lib/* org.apache.util.sql.Jisql -driver mysqlconj -cstring jdbc:mysql://10.211.55.60/mysql -u root -p '123456' -noheader -trim -c \; -query "grant all privileges on ranger.* to 'rangeradmin'@'%' with grant option;"
#SQLException : SQL state: 42000 com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Access denied for user 'root'@'10.211.55.60' to database 'ranger' ErrorCode: 1044
#那就再重新授权一次
mysql> grant all privileges on ranger.* to 'root'@'10.211.55.60' identified by '123456' with grant option;
mysql> flush privileges;
#这次再执行就成功了，之前上面已经grant all privileges on *.* to 'root'@'10.211.55.60' identified by '123456';授权过，但是没加with grant option，所以'root'@'10.211.55.60'就没有grant权限了。

7. /usr/hdp/current/ranger-admin/conf

resource_management.core.exceptions.Fail: Applying Directory['/usr/hdp/current/ranger-admin/conf'] failed, looped symbolic links found while resolving /usr/hdp/current/ranger-admin/conf
详细报错：

2020-02-27 08:54:37,298 - Directory['/usr/hdp/current/ranger-admin/conf'] {'owner': 'ranger', 'group': 'ranger', 'create_parents': True}
2020-02-27 08:54:37,298 - Creating directory Directory['/usr/hdp/current/ranger-admin/conf'] since it doesn't exist.

解决办法：

[root@host-10-211-55-60 ranger-admin]# pwd
/usr/hdp/current/ranger-admin
# 先备份这个软链，以防出现其它错误好恢复
[root@host-10-211-55-60 ranger-admin]# mv conf conf.back
# 重新创建软链接conf
[root@host-10-211-55-60 ranger-admin]# ln -s /etc/ranger-admin/2.6.3.0-235/0 /usr/hdp/current/ranger-admin/conf

8. /usr/hdp/current/ranger-tagsync/conf

resource_management.core.exceptions.Fail: Applying Directory['/usr/hdp/current/ranger-tagsync/conf'] failed, looped symbolic links found while resolving /usr/hdp/current/ranger-tagsync/conf
详细报错：

2020-02-27 09:22:35,065 - Directory['/usr/hdp/current/ranger-tagsync/conf'] {'owner': 'ranger', 'group': 'ranger', 'create_parents': True}
2020-02-27 09:22:35,066 - Creating directory Directory['/usr/hdp/current/ranger-tagsync/conf'] since it doesn't exist.

解决办法：

[root@host-10-211-55-60 ranger-tagsync]# pwd
/usr/hdp/current/ranger-tagsync
[root@host-10-211-55-60 ranger-tagsync]# mv conf conf.back
[root@host-10-211-55-60 ranger-tagsync]# ln -s /etc/ranger-tagsync/2.6.3.0-235/0 /usr/hdp/current/ranger-tagsync/conf

9. Pid file /var/run/ranger/tagsync.pid doesn’t exist after starting of the component

resource_management.core.exceptions.Fail: Pid file /var/run/ranger/tagsync.pid doesn't exist after starting of the component.
详细报错：

#注意命令ps -ef | grep proc_rangertagsync | grep -v grep
#没有这个进程
#没起动成功 /usr/hdp/current/ranger-tagsync/ranger-tagsync-services.sh start
2020-02-27 09:42:17,694 - Execute['/usr/hdp/current/ranger-tagsync/ranger-tagsync-services.sh start'] {'environment': {'JAVA_HOME': u'/usr/jdk64/jdk1.8.0_112'}, 'not_if': 'ps -ef | grep proc_rangertagsync | grep -v grep', 'user': 'ranger'}

解决办法：

#去后台手动起的时候，发现已经起来了，那这个问题就是搞笑的吧
[root@host-10-211-55-60 ranger-tagsync]# sh ranger-tagsync-services.sh start
Starting Apache Ranger Tagsync Service
Apache Ranger Tagsync Service with pid 22833 has started.

二、问题总结

总的来说问题就是5种：

1. 数据库授权问题，如上边儿问题2、5、6
2. 软链接问题，软链源不存在，需要自己手动改一下，如上边儿问题1、7、8
3. sh文件执行权限问题,如上边儿问题4
4. 不能切换家目录问题，上边儿问题3
5. 还有些搞笑的问题，哈哈

感觉有时候前一个问题，解决不到位，后边儿可能就还会有相关问题，这个估计就得靠经验了

三、安装完成验证（感觉错误层出不穷）

访问ranger admin webui http://10.211.55.60:6080
发现访问不了报404，到这一步已经快要疯了感觉
详细报错：
查看/var/log/ranger/admin/xa_portal.log

2020-02-27 02:32:04,443 [host-10-211-55-60-startStop-1] ERROR org.springframework.web.context.ContextLoader (ContextLoader.java:350) - Context initialization failed
org.springframework.beans.factory.parsing.BeanDefinitionParsingException: Configuration problem: You cannot use a spring-security-2.0.xsd or spring-security-3.0.xsd or spring-security-3.1.xsd schema or spring-security-3.2.xsd schema or spring-security-4.0.xsd schema with Spring Security 4.2. Please update your schema declarations to the 4.2 schema.
Offending resource: ServletContext resource [/WEB-INF/classes/conf/security-applicationContext.xml]

解决办法：
首先看到这个问题，我走入了一个误区
/usr/hdp/current/ranger-admin/conf/security-applicationContext.xml查看schema是这样的：
版本确实不对是3.2，荒谬的操作开始了，手动把里边儿的3.2改成4.2，然后还去spring-security官方文档粘了demo中的schema来替换这一段都不行的。

<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:util="http://www.springframework.org/schema/util"
xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.2.xsd
http://www.springframework.org/schema/util
http://www.springframework.org/schema/util/spring-util-3.2.xsd
http://www.springframework.org/schema/security/oauth2
http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd">

正确的做法，应该是直接去官网源代码github源码文档schema找到对应版本的配置文件里看一下，人家这个版本的是4.2，所以人家这个是对的，那么我的安装路径里为什么会出来3.2，我也不知道，可能是之前安装的没卸载干净，我只能想到这种可能

<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:util="http://www.springframework.org/schema/util"
xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-4.3.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-4.2.xsd
http://www.springframework.org/schema/util
http://www.springframework.org/schema/util/spring-util-4.3.xsd
http://www.springframework.org/schema/security/oauth2
http://www.springframework.org/schema/security/spring-security-oauth2-2.0.xsd">

那我还是想再确认一下安装包里配置文件，去这个目录搜一下/usr/hdp/current/ranger-admin

[root@host-10-211-55-60 ranger-admin]# pwd
/usr/hdp/current/ranger-admin
[root@host-10-211-55-60 ranger-admin]# find ./ -name 'conf.dist'
./ews/webapp/WEB-INF/classes/conf.dist
[root@host-10-211-55-60 ranger-admin]# cd ./ews/webapp/WEB-INF/classes/conf.dist
[root@host-10-211-55-60 conf.dist]# ls
ranger-admin-default-site.xml  ranger-admin-site.xml  security-applicationContext.xml
# 查看这个文档跟官方源码是一样的4.2
[root@host-10-211-55-60 conf.dist] vi security-applicationContext.xml 
# 拿这个配置文件替换/usr/hdp/current/ranger-admin/conf下的配置文件
[root@host-10-211-55-60 conf.dist] cp security-applicationContext.xml /usr/hdp/current/ranger-admin/conf/security-applicationContext.xml 

多么另人愉悦的画面呀，终于搞定了

PS: ranger使用链接
https://docs.cloudera.com/HDPDocuments/HDP2/HDP-2.3.0/bk_Ranger_Install_Guide/content/hdfs_plugin.html