301 lines
6.9 KiB
Markdown
301 lines
6.9 KiB
Markdown
# CDH部署
|
||
|
||
## Kerberos部署
|
||
|
||
### 系统环境
|
||
|
||
- Centos7.7
|
||
|
||
### CDH版本
|
||
|
||
- 6.3.2
|
||
|
||
### 部署用户权限
|
||
|
||
- root权限
|
||
|
||
### KDC服务安装及配置
|
||
|
||
#### 在Cloudera Manager服务器上安装KDC服务
|
||
|
||
```bash
|
||
yum install krb5-server krb5-libs krb5-auth-dialog krb5-workstation openldap-clients -y
|
||
```
|
||
|
||
- 会生成/etc/krb5.conf、/var/kerberos/krb5kdc/kadm5.acl、/var/kerberos/krb5kdc/kdc.conf三个文件。
|
||
|
||
#### 修改/etc/krb5.conf配置
|
||
|
||
```bash\
|
||
vi /etc/krb5.conf
|
||
```
|
||
|
||
- 配置文件内容
|
||
|
||
```bash
|
||
# Configuration snippets may be placed in this directory as well
|
||
includedir /etc/krb5.conf.d/
|
||
|
||
[logging]
|
||
default = FILE:/var/log/krb5libs.log
|
||
kdc = FILE:/var/log/krb5kdc.log
|
||
admin_server = FILE:/var/log/kadmind.log
|
||
|
||
[libdefaults]
|
||
dns_lookup_realm = false
|
||
ticket_lifetime = 24h
|
||
renew_lifetime = 7d
|
||
forwardable = true
|
||
rdns = false
|
||
pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
|
||
default_realm = A.COM
|
||
#default_ccache_name = KEYRING:persistent:%{uid}
|
||
|
||
[realms]
|
||
A.COM = {
|
||
kdc = node-1
|
||
admin_server = noe-1
|
||
}
|
||
|
||
[domain_realm]
|
||
.a.com = A.COM
|
||
a.com = A.COM
|
||
```
|
||
|
||
##### 配置参数
|
||
|
||
- default_realm: 默认realm，例如当我们使用kinit而不指定principal时使用的就是这里配置的默认realm
|
||
|
||
- dns_lookup_realm：是否可以通过DNS查找使用什么样的realm
|
||
|
||
- ticket_lifetime： 设定ticket的有效期
|
||
|
||
- forwardable： 用于指定ticket是否可以被转发，转发的含义是：如果一个用户已经有了一个TGT，当他登入到另一个远程系统，KDC会为他自动重新创建一个TGT，而不需要让用户重新进行身份认证。
|
||
|
||
- 然后是[realms]部分，这一部分会列出所有的realm，kdc和admin_server两个配置是在告诉客户端哪台服务器在运行KDC以及kadmin进程。这两项配置可以在服务器上追加端口，如果不指定，则使用默认端口，KDC是88，admin server是749.
|
||
|
||
- 最后一部分[domain_realm]是配置DNS名称和Kerberos Realm映射的。 .http://a.com = A.COM是在说：所有在a.com域下的主机都会被映射到A.COM这个realm下，而a.com = A.COM是说a.com它自己也会映射到A.COM这个realm。
|
||
|
||
|
||
|
||
#### 修改/var/kerberos/krb5kdc/kadm5.acl配置
|
||
|
||
```bash
|
||
vi /var/kerberos/krb5kdc/kadm5.acl
|
||
```
|
||
|
||
```bash
|
||
*/admin@A.COM *
|
||
```
|
||
|
||
#### 修改/var/kerberos/krb5kdc/kdc.conf配置
|
||
|
||
```bash
|
||
vi /var/kerberos/krb5kdc/kdc.conf
|
||
```
|
||
|
||
```bash
|
||
[kdcdefaults]
|
||
kdc_ports = 88
|
||
kdc_tcp_ports = 88
|
||
|
||
[realms]
|
||
A.COM = {
|
||
#master_key_type = aes256-cts
|
||
max_renewable_life= 7d 0h 0m 0s
|
||
acl_file = /var/kerberos/krb5kdc/kadm5.acl
|
||
dict_file = /usr/share/dict/words
|
||
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
|
||
supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
|
||
}
|
||
|
||
```
|
||
|
||
#### 创建Kerberos数据库
|
||
|
||
```bash
|
||
kdb5_util create –r http://A.COM -s
|
||
```
|
||
|
||
- 密码 hadoop
|
||
|
||
#### 创建Kerberos的管理账号
|
||
|
||
admin/admin@A.COM
|
||
|
||
```bash
|
||
kadmin.local
|
||
addprinc admin/admin@A.COM
|
||
```
|
||
|
||
- 密码/账号 admin/admin@A.COM
|
||
|
||
#### 将Kerberos服务添加到自启动服务，并启动krb5kdc和kadmin服务
|
||
|
||
```bash
|
||
systemctl enable krb5kdc
|
||
systemctl enable kadmin
|
||
systemctl start krb5kdc
|
||
systemctl start kadmin
|
||
```
|
||
|
||
#### 测试Kerberos的管理员账号
|
||
|
||
```bash
|
||
kinit admin/admin@A.COM
|
||
```
|
||
|
||
### 为集群安装所有Kerberos客户端，包括Cloudera Manager
|
||
|
||
```bash
|
||
yum -y install krb5-libs krb5-workstation
|
||
|
||
```
|
||
|
||
### 将KDC Server上的krb5.conf文件拷贝到所有Kerberos客户端
|
||
|
||
```bash
|
||
scp /etc/krb5.conf root@node-2:/etc/
|
||
scp /etc/krb5.conf root@node-3:/etc/
|
||
```
|
||
|
||
## CDH集群启用Kerberos
|
||
|
||
### 在KDC中给Cloudera Manager添加管理员账号
|
||
|
||
cloudera-scm/admin@A.COM
|
||
|
||
执行命令
|
||
|
||
```bash
|
||
kadmin.local
|
||
# 添加cloudera-scm 密码admin
|
||
addprinc cloudera-scm/admin
|
||
# 查询已有的用户
|
||
list_principals
|
||
```
|
||
|
||
### 进入Cloudera Manager的“管理”->“安全”界面
|
||
|
||
-
|
||
|
||
|
||
# Kerberos 相关命令
|
||
|
||
## 生成kerberos密钥
|
||
|
||
- hdfs 账号生成秘钥
|
||
|
||
```bash
|
||
kadmin.local -q "xst -k /tmp/hdfs.keytab hdfs@A.COM -norandkey"
|
||
kadmin.local -q "xst -k /tmp/hdfs.keytab hdfs@A.COM"
|
||
#生成密钥文件之后，密码失效，不想密码失效，加 '-norandkey’参数
|
||
ktadd -k /tmp/hdfs.keytab -norandkey hdfs@A.COM
|
||
# 或者执行上面的上面命令
|
||
```
|
||
|
||
## 更新Kerberos票据credentials信息
|
||
|
||
```bash
|
||
# 票据过期，无法正常登录，执行命令
|
||
kinit -R
|
||
```
|
||
|
||
## 测试Keytable是否可用
|
||
|
||
```bash
|
||
kinit -k -t /root/admin.keytab admin/admin@A.COM
|
||
kinit -k -t /tmp/admin.keytab admin/admin@A.COM
|
||
```
|
||
|
||
## 修改用户的密码
|
||
|
||
```bash
|
||
# 修改用户hdfs的密码为‘admin’
|
||
kadmin.local -q "cpw -pw admin hdfs "
|
||
```
|
||
|
||
## 查询证书状态
|
||
|
||
```bash
|
||
# 获取hdfs@A.COM账号的信息
|
||
getprinc hdfs@A.COM
|
||
|
||
modprinc -maxlife 720days -maxrenewlife 1000days +allow_renewable krbtgt/A.COM
|
||
```
|
||
|
||
## 修改过期参数
|
||
|
||
### ticket lifetime
|
||
|
||
```bash
|
||
ticket lifetime取决于以下5项设置中的最小值：
|
||
Kerberos server上/var/kerberos/krb5kdc/kdc.conf中max_life
|
||
内置principal krbtgt的maximum ticket life，可在kadmin命令行下用getprinc命令查看
|
||
principal的maximum ticket life，可在kadmin命令行下用getprinc命令查看
|
||
Kerberos client上/etc/krb5.conf的ticket_lifetime
|
||
kinit -l 参数后面指定的时间
|
||
```
|
||
|
||
|
||
|
||
### ticket renew lifetime
|
||
|
||
```bash
|
||
ticket renew lifetime取决于以下5项设置中的最小值：
|
||
Kerberos server上/var/kerberos/krb5kdc/kdc.conf中max_renewable_life
|
||
内置principal krbtgt的maximum renewable life，可在kadmin命令行下用getprinc命令查看
|
||
你的principal的maximum renewable life，可在kadmin命令行下用getprinc命令查看
|
||
Kerberos client上/etc/krb5.conf的renew_lifetime
|
||
kinit -r 参数后面指定的时间
|
||
```
|
||
|
||
|
||
|
||
# hive的Ldap配置
|
||
|
||
## 无LDAP配置
|
||
|
||
```bash
|
||
<property>
|
||
<name>hive.server2.authentication</name>
|
||
<value>NONE</value>
|
||
<description>客户端身份认证方式</description>
|
||
</property>
|
||
```
|
||
|
||
## LDAP配置
|
||
|
||
``` xml
|
||
<property>
|
||
<name>hive.server2.authentication</name>
|
||
<value>LDAP</value>
|
||
<description>客户端身份认证方式</description>
|
||
</property>
|
||
<property>
|
||
<name>hive.server2.authentication.ldap.url</name>
|
||
<value>ldaps://ldap.yldev.net:636</value>
|
||
<description>LDAP Url</description>
|
||
</property>
|
||
<property>
|
||
<name>hive.server2.authentication.ldap.baseDN</name>
|
||
<value>ou=project,dc=yldev,dc=net</value>
|
||
<description>LDAP搜索的baseDN</description>
|
||
</property>
|
||
|
||
```
|
||
|
||
- hive的权限认证的方式 hive.server2.authentication
|
||
- **NONE**:不做认证;
|
||
- **LDAP**: 使用基于 LDAP/AD 的用户身份校验；
|
||
- **KERBEROS**: 使用 Kerberos/GSSAPI 做身份校验；
|
||
- LDAP认证的服务器URL：hive.server2.authentication.ldap.url
|
||
- 协议
|
||
- 未做ssl的ldap协议
|
||
- **ldap**://ldap.yldev.net
|
||
- ssl的ldaps协议
|
||
- **ldaps**://ldap.yldev.net:636
|
||
- baseDN 登录用户组
|
||
- project用户组可以登录hive
|
||
- **ou=project**,dc=yldev,dc=net
|