{"record":{"id":"6efa9253568373d8","repo":"apache/hadoop","slug":"hadoop-security-dns-nameserver-requires-hadoop-sec","errorCode":null,"errorMessage":"hadoop.security.dns.nameserver requires hadoop.security.dns.interface. Check yourconfiguration.","messagePattern":"hadoop\\.security\\.dns\\.nameserver requires hadoop\\.security\\.dns\\.interface\\. Check yourconfiguration\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java","lineNumber":272,"sourceCode":"   * Retrieve the name of the current host. Multihomed hosts may restrict the\n   * hostname lookup to a specific interface and nameserver with {@link\n   * org.apache.hadoop.fs.CommonConfigurationKeysPublic#HADOOP_SECURITY_DNS_INTERFACE_KEY}\n   * and {@link org.apache.hadoop.fs.CommonConfigurationKeysPublic#HADOOP_SECURITY_DNS_NAMESERVER_KEY}\n   *\n   * @param conf Configuration object. May be null.\n   * @return\n   * @throws UnknownHostException\n   */\n  static String getLocalHostName(@Nullable Configuration conf)\n      throws UnknownHostException {\n    if (conf != null) {\n      String dnsInterface = conf.get(HADOOP_SECURITY_DNS_INTERFACE_KEY);\n      String nameServer = conf.get(HADOOP_SECURITY_DNS_NAMESERVER_KEY);\n\n      if (dnsInterface != null) {\n        return DNS.getDefaultHost(dnsInterface, nameServer, true);\n      } else if (nameServer != null) {\n        throw new IllegalArgumentException(HADOOP_SECURITY_DNS_NAMESERVER_KEY +\n            \" requires \" + HADOOP_SECURITY_DNS_INTERFACE_KEY + \". Check your\" +\n            \"configuration.\");\n      }\n    }\n\n    // Fallback to querying the default hostname as we did before.\n    return InetAddress.getLocalHost().getCanonicalHostName();\n  }\n\n  /**\n   * Login as a principal specified in config. Substitute $host in\n   * user's Kerberos principal name with a dynamically looked-up fully-qualified\n   * domain name of the current host.\n   * \n   * @param conf\n   *          conf to use\n   * @param keytabFileKey\n   *          the key to look for keytab file in conf","sourceCodeStart":254,"sourceCodeEnd":290,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java#L254-L290","documentation":"SecurityUtil.getLocalHostName resolves the local hostname used for Kerberos login. DNS-based resolution is driven by hadoop.security.dns.interface, optionally paired with hadoop.security.dns.nameserver. Setting the nameserver without the interface is rejected with IllegalArgumentException because the resolver has no interface to bind the nameserver to. (The literal message contains the known typo 'yourconfiguration' with a missing space.)","triggerScenarios":"core-site.xml defines hadoop.security.dns.nameserver (e.g. 10.0.0.53) but omits hadoop.security.dns.interface; the first SecurityUtil.login or getLocalHostName call during daemon startup then throws.","commonSituations":"Operators copy only one of the two keys between clusters, or set the nameserver expecting it to work standalone; the failure surfaces at daemon startup after enabling Kerberos.","solutions":["Add hadoop.security.dns.interface (e.g. eth0 or bond0) alongside the nameserver","Or remove hadoop.security.dns.nameserver to fall back to default host resolution","Verify the interface name exists on every node with 'ip addr' or 'ifconfig'","Add a config-pairing check to deployment automation so the two keys always ship together"],"exampleFix":"<!-- before -->\n<property><name>hadoop.security.dns.nameserver</name><value>10.0.0.53</value></property>\n\n<!-- after -->\n<property><name>hadoop.security.dns.interface</name><value>eth0</value></property>\n<property><name>hadoop.security.dns.nameserver</name><value>10.0.0.53</value></property>","handlingStrategy":"validation","validationCode":"String iface = conf.get(\"hadoop.security.dns.interface\");\nString ns = conf.get(\"hadoop.security.dns.nameserver\");\nif (ns != null && iface == null) {\n  throw new IllegalArgumentException(\n      \"Set hadoop.security.dns.interface when configuring hadoop.security.dns.nameserver\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat dns.interface/dns.nameserver as a pair in config templates","Run a config linter that flags orphaned keys before deploy","Remember the message contains the 'yourconfiguration' typo when grepping logs"],"tags":["configuration","dns","kerberos","startup"],"backgroundTag":"incomplete-configuration","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}