Default Hadoop UI and HDFS Permissions May Enable Accidental Public Data Exposure

The primary objective is to prevent Hadoop components from being reachable without authentication, thereby avoiding accidental public exposure of data.

Currently, the Namenode and ResourceManager web UIs accept unauthenticated requests, and HDFS permissions rely on Unix ACLs that may grant world‑read rights, while encryption at rest remains optional and disabled by default.

What authentication mechanism should be enforced for the Namenode UI by default? How can HDFS permission defaults be adjusted to block world‑read access without disrupting legitimate workflows? Is there a design commitment to enable encryption at rest as the default security setting?