update cdh Kerberos
This commit is contained in:
@@ -27,7 +27,7 @@ yum install krb5-server krb5-libs krb5-auth-dialog krb5-workstation openldap-cli
|
||||
#### 修改/etc/krb5.conf配置
|
||||
|
||||
```bash\
|
||||
vi /etc/krb5.conf
|
||||
vim /etc/krb5.conf
|
||||
```
|
||||
|
||||
- 配置文件内容
|
||||
@@ -48,18 +48,20 @@ renew_lifetime = 7d
|
||||
forwardable = true
|
||||
rdns = false
|
||||
pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
|
||||
default_realm = A.COM
|
||||
default_realm = YLDEV.NET
|
||||
#default_ccache_name = KEYRING:persistent:%{uid}
|
||||
|
||||
[realms]
|
||||
A.COM = {
|
||||
kdc = node-1
|
||||
admin_server = noe-1
|
||||
}
|
||||
YLDEV.NET = {
|
||||
kdc = cdh-node-1
|
||||
admin_server = cdh-node-1
|
||||
default_domain = YLDEV.NET
|
||||
}
|
||||
|
||||
|
||||
[domain_realm]
|
||||
.a.com = A.COM
|
||||
a.com = A.COM
|
||||
.example.com = YLDEV.NET
|
||||
example.com = YLDEV.NET
|
||||
```
|
||||
|
||||
##### 配置参数
|
||||
@@ -74,61 +76,66 @@ a.com = A.COM
|
||||
|
||||
- 然后是[realms]部分，这一部分会列出所有的realm，kdc和admin_server两个配置是在告诉客户端哪台服务器在运行KDC以及kadmin进程。这两项配置可以在服务器上追加端口，如果不指定，则使用默认端口，KDC是88，admin server是749.
|
||||
|
||||
- 最后一部分[domain_realm]是配置DNS名称和Kerberos Realm映射的。 .http://a.com = A.COM是在说：所有在a.com域下的主机都会被映射到A.COM这个realm下，而a.com = A.COM是说a.com它自己也会映射到A.COM这个realm。
|
||||
- 最后一部分[domain_realm]是配置DNS名称和Kerberos Realm映射的。
|
||||
|
||||
|
||||
|
||||
#### 修改/var/kerberos/krb5kdc/kadm5.acl配置
|
||||
|
||||
将 */admin@YLDEV.NET 后缀的设为管理员
|
||||
|
||||
```bash
|
||||
vi /var/kerberos/krb5kdc/kadm5.acl
|
||||
vim /var/kerberos/krb5kdc/kadm5.acl
|
||||
```
|
||||
|
||||
```bash
|
||||
*/admin@A.COM *
|
||||
*/admin@YLDEV.NET *
|
||||
```
|
||||
|
||||
#### 修改/var/kerberos/krb5kdc/kdc.conf配置
|
||||
|
||||
```bash
|
||||
vi /var/kerberos/krb5kdc/kdc.conf
|
||||
vim /var/kerberos/krb5kdc/kdc.conf
|
||||
```
|
||||
|
||||
```bash
|
||||
[kdcdefaults]
|
||||
kdc_ports = 88
|
||||
kdc_tcp_ports = 88
|
||||
kdc_ports = 88
|
||||
kdc_tcp_ports = 88
|
||||
|
||||
|
||||
[realms]
|
||||
A.COM = {
|
||||
#master_key_type = aes256-cts
|
||||
max_renewable_life= 7d 0h 0m 0s
|
||||
acl_file = /var/kerberos/krb5kdc/kadm5.acl
|
||||
dict_file = /usr/share/dict/words
|
||||
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
|
||||
supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
|
||||
}
|
||||
|
||||
YLDEV.NET = {
|
||||
max_life = 24h # 单个票据的最大有效期
|
||||
|
||||
max_renewable_life= 7d 0h 0m 0s
|
||||
renewable = true
|
||||
#master_key_type = aes256-cts
|
||||
acl_file = /var/kerberos/krb5kdc/kadm5.acl
|
||||
dict_file = /usr/share/dict/words
|
||||
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
|
||||
supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
|
||||
}
|
||||
```
|
||||
|
||||
#### 创建Kerberos数据库
|
||||
|
||||
```bash
|
||||
kdb5_util create –r http://A.COM -s
|
||||
kdb5_util create -r YLDEV.NET -s
|
||||
```
|
||||
|
||||
- 密码 hadoop
|
||||
|
||||
#### 创建Kerberos的管理账号
|
||||
|
||||
admin/admin@A.COM
|
||||
admin/admin@YLDEV.NET
|
||||
|
||||
```bash
|
||||
kadmin.local
|
||||
addprinc admin/admin@A.COM
|
||||
addprinc admin/admin@YLDEV.NET
|
||||
```
|
||||
|
||||
- 密码/账号 admin/admin@A.COM
|
||||
- 密码/账号 admin/admin@YLDEV.NET
|
||||
|
||||
#### 将Kerberos服务添加到自启动服务，并启动krb5kdc和kadmin服务
|
||||
|
||||
@@ -142,7 +149,7 @@ systemctl start kadmin
|
||||
#### 测试Kerberos的管理员账号
|
||||
|
||||
```bash
|
||||
kinit admin/admin@A.COM
|
||||
kinit admin/admin@YLDEV.NET
|
||||
```
|
||||
|
||||
### 为集群安装所有Kerberos客户端，包括Cloudera Manager
|
||||
@@ -163,7 +170,7 @@ scp /etc/krb5.conf root@node-3:/etc/
|
||||
|
||||
### 在KDC中给Cloudera Manager添加管理员账号
|
||||
|
||||
cloudera-scm/admin@A.COM
|
||||
cloudera-scm/admin@YLDEV.NET
|
||||
|
||||
执行命令
|
||||
|
||||
@@ -177,8 +184,6 @@ list_principals
|
||||
|
||||
### 进入Cloudera Manager的“管理”->“安全”界面
|
||||
|
||||
-
|
||||
|
||||
|
||||
# Kerberos 相关命令
|
||||
|
||||
@@ -187,10 +192,10 @@ list_principals
|
||||
- hdfs 账号生成秘钥
|
||||
|
||||
```bash
|
||||
kadmin.local -q "xst -k /tmp/hdfs.keytab hdfs@A.COM -norandkey"
|
||||
kadmin.local -q "xst -k /tmp/hdfs.keytab hdfs@A.COM"
|
||||
kadmin.local -q "xst -k /tmp/hdfs.keytab hdfs@YLDEV.NET -norandkey"
|
||||
kadmin.local -q "xst -k /tmp/hdfs.keytab hdfs@YLDEV.NET"
|
||||
#生成密钥文件之后，密码失效，不想密码失效，加 '-norandkey’参数
|
||||
ktadd -k /tmp/hdfs.keytab -norandkey hdfs@A.COM
|
||||
ktadd -k /tmp/hdfs.keytab -norandkey hdfs@YLDEV.NET
|
||||
# 或者执行上面的上面命令
|
||||
```
|
||||
|
||||
@@ -204,8 +209,8 @@ kinit -R
|
||||
## 测试Keytable是否可用
|
||||
|
||||
```bash
|
||||
kinit -k -t /root/admin.keytab admin/admin@A.COM
|
||||
kinit -k -t /tmp/admin.keytab admin/admin@A.COM
|
||||
kinit -k -t /root/admin.keytab admin/admin@YLDEV.NET
|
||||
kinit -k -t /tmp/admin.keytab admin/admin@YLDEV.NET
|
||||
```
|
||||
|
||||
## 修改用户的密码
|
||||
@@ -219,7 +224,7 @@ kadmin.local -q "cpw -pw admin hdfs "
|
||||
|
||||
```bash
|
||||
# 获取hdfs@A.COM账号的信息
|
||||
getprinc hdfs@A.COM
|
||||
getprinc hdfs@YLDEV.NET
|
||||
|
||||
modprinc -maxlife 720days -maxrenewlife 1000days +allow_renewable krbtgt/A.COM
|
||||
```
|
||||
@@ -306,5 +311,5 @@ kinit -r 参数后面指定的时间
|
||||
|
||||
## 获取特权keytab
|
||||
|
||||
创建 hdfs@A.COM
|
||||
创建 hdfs@YLDEV.NET
|
||||
获取密钥 然后认证 即可使用特权hdfs账号 操作 hdfs 文件系统
|
||||
|
||||
Reference in New Issue
Block a user