I might have screwed up how to recover?

classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

I might have screwed up how to recover?

Geoffry Roberts
How can I fix this?

I have managed to get the passwords out of synch on my root account.  IOTW The login password for root no longer matches accumulo-site.xml.  The tracer is complaining like this:

org.apache.accumulo.core.client.AccumuloSecurityException: Error BAD_CREDENTIALS for user root - Username or Password is Invalid


I tried manually synching them up by changing accumulo-site.xml.  Now the tserver is unhappy:

org.apache.zookeeper.KeeperException$NoAuthException: KeeperErrorCode = NoAuth for /accumulo/1f58627f-ba20-4e68-bd4c-927f99230de4/tservers/localhost:9997


Either way I am getting connection reset by peer when I try to connect from a remote.  


Thanks for any help

-- 
There are ways and there are ways, 

Geoffry Roberts
Reply | Threaded
Open this post in threaded view
|

Re: I might have screwed up how to recover?

Mike Walch-2
Hi Geoffry,

You cannot change the root password by changing accumulo-site.xml.  This can only be done using 'accumulo init --reset-security'.

What property did you change in accumulo-site.xml? 'trace.password' or 'instance.secret'? 

The property 'trace.password' sets the password for the user used by the tracer.  This user used by the tracer is typically 'root' which is the default for the property 'trace.user'.

The property 'instance.secret' sets a secret unique to the Accumulo instance that all servers must know in order to communicate with one another.  This is typically different than the root password.

If you changed 'trace.password', just change it back to your original root password.  If you changed 'instance.secret', try set it back to its original value. The default value for 'instance.secret' is 'DEFAULT'. If you don't know the original value,
the manual has information on how to change the secret:


I hope that helps.

-Mike

On Mon, May 21, 2018 at 1:52 PM, Geoffry Roberts <[hidden email]> wrote:
How can I fix this?

I have managed to get the passwords out of synch on my root account.  IOTW The login password for root no longer matches accumulo-site.xml.  The tracer is complaining like this:

org.apache.accumulo.core.client.AccumuloSecurityException: Error BAD_CREDENTIALS for user root - Username or Password is Invalid


I tried manually synching them up by changing accumulo-site.xml.  Now the tserver is unhappy:

org.apache.zookeeper.KeeperException$NoAuthException: KeeperErrorCode = NoAuth for /accumulo/1f58627f-ba20-4e68-bd4c-927f99230de4/tservers/localhost:9997


Either way I am getting connection reset by peer when I try to connect from a remote.  


Thanks for any help

-- 
There are ways and there are ways, 

Geoffry Roberts

Reply | Threaded
Open this post in threaded view
|

Re: I might have screwed up how to recover?

Geoffry Roberts
I wound up doing a fresh init.  

Thanks for telling me about the --reset-security flag for init.  I hadn't seen that before.  It didn't work, however, Accumulo just threw an error.   I also tried resetting the instance secret back to default using the CLI but I got another error. 

The fresh init did resolve some of the errors I was seeing in the logs.

Thanks for you help


On Mon, May 21, 2018 at 3:05 PM, Mike Walch <[hidden email]> wrote:
Hi Geoffry,

You cannot change the root password by changing accumulo-site.xml.  This can only be done using 'accumulo init --reset-security'.

What property did you change in accumulo-site.xml? 'trace.password' or 'instance.secret'? 

The property 'trace.password' sets the password for the user used by the tracer.  This user used by the tracer is typically 'root' which is the default for the property 'trace.user'.

The property 'instance.secret' sets a secret unique to the Accumulo instance that all servers must know in order to communicate with one another.  This is typically different than the root password.

If you changed 'trace.password', just change it back to your original root password.  If you changed 'instance.secret', try set it back to its original value. The default value for 'instance.secret' is 'DEFAULT'. If you don't know the original value,
the manual has information on how to change the secret:


I hope that helps.

-Mike

On Mon, May 21, 2018 at 1:52 PM, Geoffry Roberts <[hidden email]> wrote:
How can I fix this?

I have managed to get the passwords out of synch on my root account.  IOTW The login password for root no longer matches accumulo-site.xml.  The tracer is complaining like this:

org.apache.accumulo.core.client.AccumuloSecurityException: Error BAD_CREDENTIALS for user root - Username or Password is Invalid


I tried manually synching them up by changing accumulo-site.xml.  Now the tserver is unhappy:

org.apache.zookeeper.KeeperException$NoAuthException: KeeperErrorCode = NoAuth for /accumulo/1f58627f-ba20-4e68-bd4c-927f99230de4/tservers/localhost:9997


Either way I am getting connection reset by peer when I try to connect from a remote.  


Thanks for any help

-- 
There are ways and there are ways, 

Geoffry Roberts




--
There are ways and there are ways, 

Geoffry Roberts
Reply | Threaded
Open this post in threaded view
|

Re: I might have screwed up how to recover?

Mike Walch-2
> I also tried resetting the instance secret back to default using the CLI but I got another error.

The 'instance.secret' property is not ZooKeeper mutable. Therefore, it cannot be set in the shell. It must be set in accumulo-site.xml on all nodes.

On Thu, May 24, 2018 at 9:52 AM, Geoffry Roberts <[hidden email]> wrote:
I wound up doing a fresh init.  

Thanks for telling me about the --reset-security flag for init.  I hadn't seen that before.  It didn't work, however, Accumulo just threw an error.   I also tried resetting the instance secret back to default using the CLI but I got another error. 

The fresh init did resolve some of the errors I was seeing in the logs.

Thanks for you help


On Mon, May 21, 2018 at 3:05 PM, Mike Walch <[hidden email]> wrote:
Hi Geoffry,

You cannot change the root password by changing accumulo-site.xml.  This can only be done using 'accumulo init --reset-security'.

What property did you change in accumulo-site.xml? 'trace.password' or 'instance.secret'? 

The property 'trace.password' sets the password for the user used by the tracer.  This user used by the tracer is typically 'root' which is the default for the property 'trace.user'.

The property 'instance.secret' sets a secret unique to the Accumulo instance that all servers must know in order to communicate with one another.  This is typically different than the root password.

If you changed 'trace.password', just change it back to your original root password.  If you changed 'instance.secret', try set it back to its original value. The default value for 'instance.secret' is 'DEFAULT'. If you don't know the original value,
the manual has information on how to change the secret:


I hope that helps.

-Mike

On Mon, May 21, 2018 at 1:52 PM, Geoffry Roberts <[hidden email]> wrote:
How can I fix this?

I have managed to get the passwords out of synch on my root account.  IOTW The login password for root no longer matches accumulo-site.xml.  The tracer is complaining like this:

org.apache.accumulo.core.client.AccumuloSecurityException: Error BAD_CREDENTIALS for user root - Username or Password is Invalid


I tried manually synching them up by changing accumulo-site.xml.  Now the tserver is unhappy:

org.apache.zookeeper.KeeperException$NoAuthException: KeeperErrorCode = NoAuth for /accumulo/1f58627f-ba20-4e68-bd4c-927f99230de4/tservers/localhost:9997


Either way I am getting connection reset by peer when I try to connect from a remote.  


Thanks for any help

-- 
There are ways and there are ways, 

Geoffry Roberts




--
There are ways and there are ways, 

Geoffry Roberts