Port 8042 – YARN NodeManager

TCP

Port 8042 is the Hadoop YARN NodeManager web UI port showing container status, resource usage, and application logs on each cluster node. The web UI exposes container logs that may contain sensitive application data. Restrict to management networks in production Hadoop clusters.

Port Number

8042

Protocol

TCP

Service

Hadoop YARN NodeManager Web UI

Range

IANA Registered (1024–49151)

Description

YARN NodeManager on port 8042 serves a web interface showing the containers running on that specific Hadoop cluster node. Operators use it to view container resource allocation, check application logs, and diagnose task failures. Each node in the cluster runs its own NodeManager on port 8042. The NodeManager web UI exposes container logs which may contain application output, stack traces with database credentials, or business data processed by MapReduce/Spark jobs. In production Hadoop deployments, restrict port 8042 access to the management VLAN. Enable Kerberos authentication (hadoop.http.authentication.type=kerberos) and HTTPS (yarn.nodemanager.webapp.https.address) for secure access.

Security risks

1No authentication by default: non-kerberized Hadoop clusters serve port 8042 without any authentication. Any network-adjacent user can browse container logs, view running applications, and access resource allocation details
2Container log exposure: application logs accessible via /node/containerlogs/ often contain sensitive data – database queries with parameters, API keys in environment variables, PII in application output, and stack traces revealing internal architecture
3YARN container escape: CVE-2021-25642 (Apache Hadoop, CVSS 9.8) allowed code execution via crafted serialized objects in YARN. NodeManager web UI on 8042 provides reconnaissance (container IDs, application attempts) that aids exploitation
4Resource exhaustion visibility: the web UI shows memory/CPU allocation per container. Attackers use this information to determine how much capacity remains for cryptomining containers submitted via an unsecured ResourceManager
5Log aggregation bypass: even when centralized logging sanitizes sensitive data, raw container logs on port 8042 may retain unfiltered content (pre-aggregation) including credentials passed as command-line arguments

Firewall guidance

Restrict port 8042 to the Hadoop management VLAN and jump hosts. Never expose to the internet. In production: enable Kerberos (hadoop.http.authentication.type=kerberos in core-site.xml), enable HTTPS (yarn.nodemanager.webapp.https.address), and configure hadoop.http.filter.initializers with AuthenticationFilter. On EMR/Dataproc, use the managed web proxy or SSH tunneling instead of opening security group ports.

Diagnosis commands

Check NodeManager health and resource capacity

shell

curl -s http://nodemanager:8042/ws/v1/node/info | jq '{nodeHealthy, totalVmemAllocatedContainersMB, nodeManagerVersion}'

List running containers (should require auth in production)

shell

curl -s http://nodemanager:8042/ws/v1/node/containers | jq '.containers.container[].id'

Test Kerberos SPNEGO authentication (requires valid ticket)

shell

curl -s --negotiate -u : http://nodemanager:8042/ws/v1/node/info

Verify NodeManager is listening and check bind address

shell

ss -tlnp sport = :8042

Usage examples

Port 8042 – YARN NodeManager

shell

curl http://nodemanager:8042/ws/v1/node/info
yarn node -list shows all NodeManagers
http://nm-host:8042/node/containerlogs/container_id/user

Common services on this port

Apache Hadoop YARNCloudera CDH/CDPHortonworks HDPAmazon EMRAzure HDInsightGoogle Dataproc

Related ports

8088

YARN ResourceManager Web UI

8090

YARN ResourceManager HTTPS

8040

NodeManager localizer port

8188

Timeline Server (application history)

50070

HDFS NameNode Web UI

History

YARN (Yet Another Resource Negotiator) was introduced in Hadoop 2.0 (2012) to separate resource management from MapReduce job scheduling. Port 8042 was assigned to the NodeManager web UI. Each node in a Hadoop cluster runs one NodeManager process exposing its web UI on 8042. The port provides per-node visibility into container execution, complementing the cluster-wide ResourceManager UI on port 8088. Kerberos support was added to Hadoop early but remains disabled by default in most quick-start configurations.

FAQ

How do I enable Kerberos authentication for YARN web UIs?

In core-site.xml: set hadoop.http.authentication.type=kerberos, hadoop.http.authentication.kerberos.principal=HTTP/_HOST@REALM, hadoop.http.authentication.kerberos.keytab=/etc/security/keytabs/spnego.keytab. In yarn-site.xml: set yarn.nodemanager.webapp.https.address=0.0.0.0:8044 and yarn.http.policy=HTTPS_ONLY. Restart all NodeManagers. Test with curl --negotiate -u : https://nm:8044/ws/v1/node/info.

Is it safe to expose port 8042 on Amazon EMR?

No. EMR clusters should not have port 8042 open in security groups. Use the EMR web connection proxy (SSH tunnel with dynamic port forwarding: ssh -D 8157 -i key.pem hadoop@master) and configure your browser SOCKS proxy to access all Hadoop web UIs securely. EMR 6.x+ supports Apache Knox gateway as an alternative authenticated proxy.