如何在CDH5.12集群中启用Kerberos认证
参考链接:
https://www.cloudera.com/documentation/enterprise/5-8-x/topics/security.html
一、前置准备
1、基础环境说明
操作系统：CentOS 6.8 minimal
CDM版本: 5.12.1
CDH版本：5.12.1
MySQL版本: 5.1.73
JDK: 1.8.0_131
浏览器版本: ChromeStandalone_56以上、IE10
内存:32G以上
CPU :8core
网络:千兆以上
集群未启用Kerberos
2、CDH安装
参考《CDH5.12.0集群安装》
二、KDC服务安装及配置
1、安装KDC服务
# yum install krb5-server krb5-libs krb5-auth-dialog krb5-workstation
2、配置KDC服务
1). 修改/etc/krb5.conf
# vi /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = BOE01.COM
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
[realms]
BOE01.COM = {
kdc = boe01.localdomain
admin_server = boe01.localdomain
}
[domain_realm]
.boe01.localdomain = BOE01.COM
boe01.localdomain = BOE01.COM
2). 修改/var/kerberos/krb5kdc/kadm5.acl
# vi /var/kerberos/krb5kdc/kadm5.acl
*/admin\@BOE01.COM *
3). 修改/var/kerberos/krb5kdc/kdc.conf
# vi /var/kerberos/krb5kdc/kdc.conf
[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88
[realms]
BOE01.COM = {
#master_key_type = aes256-cts
max_renewable_life= 7d 0h 0m 0s
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal
arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
}
4). 创建Kerberos数据库
# kdb5_util create –r BOE01.COM -s
Loading random data
Initializing database ‘/var/kerberos/krb5kdc/principal’ for realm ‘BOE01.COM’,
master key name ‘K/M\@BOE01.COM’
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key:设置密码
Re-enter KDC database master key to verify:确认密码
5). 创建Kerberos的管理账号
# kadmin.local
Authenticating as principal root/admin\@BOE01.COM with password.
kadmin.local: add （可以按tab补全命令）
add_policy add_principal addpol addprinc
kadmin.local: addprinc admin/admin\@BOE01.COM
WARNING: no policy specified for admin/admin\@BOE01.COM; defaulting to no policy
Enter password for principal “admin/admin\@BOE01.COM”: 设置密码
Re-enter password for principal “admin/admin\@BOE01.COM”: 确认密码
Principal “admin/admin\@BOE01.COM” created.
kadmin.local: exit
6). 添加自启动服务并启动服务
# chkconfig –level 35 krb5kdc on
# chkconfig –level 35 kadmin on
# /etc/init.d/krb5kdc start
# /etc/init.d/kadmin start
7). 测试Kerberos管理员账号
# kinit admin/admin\@BOE01.COM
Password for admin/admin\@BOE01.COM:
# klist
# klist -e
3、集群所有节点安装Kerberos客户端(包括CM)
# yum -y install krb5-libs krb5-workstation
CM节点安装额外组件
# yum -y install openldap-clients
4、拷贝配置文件
将KDC Server上的krb5.conf文件拷贝到所有Kerberos客户端(即集群所有节点)
# scp /etc/krb5.conf boe02:/etc/
# scp /etc/krb5.conf boe03:/etc/
三、CDH集群启用Kerberos
1、配置集群JDK(如未安装JDK参考install_java.sh)
下载jce_policy-8.zip
链接: http://www.oracle.com/technetwork/java/javase/downloads/index.html
# 7za x jce_policy-8.zip
# cp UnlimitedJCEPolicyJDK8/*.jar /usr/jdk64/jdk1.8.0_131/jre/lib/security/
登陆CM：
主页搜索java_home：
设置java_home：
2、KDC添加Cloudera Manager管理员账号
# kadmin.local
Authenticating as principal admin/admin\@BOE01.COM with password.
kadmin.local: addprinc cloudera-scm/admin\@BOE01.COM
WARNING: no policy specified for cloudera-scm/admin\@BOE01.COM; defaulting to no
policy
Enter password for principal “cloudera-scm/admin\@BOE01.COM”:
Re-enter password for principal “cloudera-scm/admin\@BOE01.COM”:
Principal “cloudera-scm/admin\@BOE01.COM” created.
kadmin.local: exit
3、配置启用kerberos
1). 启用Kerberos
进入Cloudera Manager的“管理”-> “安全”界面->启用Kerberos
2).检查信息
确保如下列出的所有检查项都已完成
3).配置KDC信息
配置KDC类型、KDC服务器、KDC Realm、加密类型以及待创建的Service
Principal（hdfs，yarn,，hbase，hive等）的更新生命期等，点击“继续”
4).KRB5配置
不建议让Cloudera Manager来管理krb5.conf，点击“继续”
5).输入CM的Kerbers管理员账号
必须和之前创建的账号一致，点击“继续”，等待启用Kerberos完成，点击“继续”
6).Kerberos主体
7).重启集群
重启成功：
至此已成功启用Kerberos。