How to secure client connections to an HBase Thrift Server?

Question

Anyone who knows the port and host of a HBase Thrift server, and who has access to the network, can access HBase. This is a security risk. How can the client access to the HBase Thrift server be made secure?

Answer 1

You could secure HBase Thrift server setting up authentication via kerberos and then setting this property in hbase-site.xml

  <name>hbase.thrift.security.qop</name>
  <value>auth</value>

http://www.cloudera.com/documentation/enterprise/latest/topics/cdh_sg_hbase_authentication.html

Answer 2

My sysadmin told me that in theory he could install an HBase Thrift Server on one of the Hadoop edge nodes that are blocked off, and only open the port to my server via ACLs. He however has no intention of doing this (and I do not either). As this is not a suitable answer I'll leave the question open.