All Products
Search

This Product

    E-MapReduce:Knox

    Document Center

    E-MapReduce:Knox

    Last Updated:Jun 20, 2026

    This topic describes how to configure Knox on E-MapReduce to access the web UIs of services such as HDFS, YARN, Spark, and Ganglia over the public network.

    Prerequisites

    You have created an E-MapReduce cluster with the Knox service selected. For more information, see Create a cluster.

    Note

    If you did not select the Knox service when you created the cluster, you can add it. For more information, see Add services. 

    Preparations

    Configure security group access

    1. Obtain the public IP address of your current device.

      To securely access cluster components, allow access only from your current public IP address when you configure security group rules. Visit IP Address to view your current public IP address.

    2. Add a port:

      This topic uses port 8443 as an example.

      1. In the E-MapReduce console, on the Basic Information page of your cluster, go to the Security section and click the link next to Cluster Security Group.

      2. On the Security Group page, on the Inbound tab, click Add Rule.

      3. Set Authorization Object to the public IP address that you obtained in the previous step and set Port Range to 8443/8443 .

      4. Click Save.

    Important

    • To prevent security risks, do not set Authorization Object to 0.0.0.0/0.

    • If you did not assign a public IP address when you created the cluster, you can assign one to the master node's ECS instance in the ECS console.

    Set up a Knox user

    Accessing Knox requires authentication with a username and password. Knox uses LDAP for user authentication, provided by the Apache Directory Server service in the cluster.

    • Method 1 (Recommended)

      On the EMR on ECS page, click the name of your cluster. Click the Users tab to add a Knox user account. For more information, see User Management.

    • Method 2:

      1. Connect to the cluster over SSH. For more information, see Log on to a cluster.

      2. Prepare your user data. The following example uses a user named Tom.

        Edit the users.ldif file.

        su knox
vim /opt/apps/KNOX/knox-current/templates/users.ldif

        In the file, replace all instances of emr-guest with Tom, replace all instances of EMR GUEST with Tom, and set the value of userPassword to your desired password.

      3. Run the following commands to import the user data into LDAP. 

        cd /opt/apps/KNOX/knox-current/templates
sh ldap-sample-users.sh

    Access web UIs

    For more information about how to access web UIs, see Access the web UIs of open-source components from the console.

    FAQ

    • Q: The Knox component stops unexpectedly. When I try to start Knox, the process fails with the error Failed to start gateway: org.apache.knox.gateway.services.ServiceLifecycleException: Gateway SSL Certificate is Expired.

      s/ecm/sxxx.0.3/bin/.. as GATEWAY_HOME via system property.
2021-08-03 16:37:35,794 INFO  knox.gateway (GatewayConfigImpl.java:init(346)) - Cookie scoping feature enabled: false
2021-08-03 16:37:36,091 WARN  knox.gateway (RemoteAliasService.java:init(448)) - There is no registry client defined for remote configuration monitoring.
2021-08-03 16:37:36,091 INFO  knox.gateway (RemoteAliasService.java:start(485)) - Remote Alias Service enabled
2021-08-03 16:37:36,102 INFO  knox.gateway (JettySSLService.java:init(96)) - Credential store for the gateway instance found - no need to create one.
2021-08-03 16:37:36,120 INFO  knox.gateway (JettySSLService.java:init(118)) - Keystore for the gateway instance found - no need to create one.
2021-08-03 16:37:36,124 INFO  knox.gateway (JettySSLService.java:logAndValidateCertificate(148)) - The Gateway SSL certificate is issued to hostname: localhost.
2021-08-03 16:37:36,125 INFO  knox.gateway (JettySSLService.java:logAndValidateCertificate(151)) - The Gateway SSL certificate is valid between: 3/9/20 4:12 PM and 3/9/21 4:12 PM.
2021-08-03 16:37:36,136 FATAL knox.gateway (GatewayServer.java:main(162)) - Failed to start gateway: org.apache.knox.gateway.services.ServiceLifecycleException: Gateway SSL Certificate is Expired. Server will not start.

    • A: Follow these steps to resolve this issue:

      1. Log on to the cluster over SSH. For more information, see Log on to a cluster.

      2. Run the following command to rename the expired certificate.

        sudo mv /opt/apps/KNOX/knox-current/data/security/keystores/gateway.jks /opt/apps/KNOX/knox-current/data/security/keystores/bak_gateway.jks
        Note

        You can also move the expired certificate to another directory.

      3. Start the Knox service.

        1. In the EMR console, on the Services page, find the Knox service and choose more > START.

        2. In the dialog box that appears, enter an execution reason and click OK.

        3. In the Confirm dialog box, click OK.