jsjw18

hadoop使用kerberos增加权限验证功能

更改network中的hostname

vim /etc/sysconfig/network

NETWORKING=yes

HOSTNAME=nn21021

更改hosts

vim /etc/hosts

127.0.0.1 localhost

#::1 localhost localhost.localdomain localhost6 localhost6.localdomain6

172.17.210.21 nn21021

172.17.210.22 snn21022

172.17.210.23 dn21023

172.17.210.24 dn21024

172.17.210.25 dn21025

关闭防火墙(建议：关闭自启动项设置)

service iptables status

service iptables stop

chkconfig iptables off

安装免密码登陆功能
- 略

增加用户组、用户

groupadd hadoop

useradd -g hadoop hdfs

useradd -g hadoop yarn

useradd -g hadoop mapred

对应用户增加密码

passwd hdfs

passwd yarn

passwd mapred

安装KDC SERVER

yum install krb5-server krb5-libs krb5-auth-dialog krb5-workstation

安装 krb5-devel、krb5-workstation
- yum install krb5-devel krb5-workstation

修改/etc/krb5.conf

vim /etc/krb5.conf

[logging]

default = FILE:/data/logs/krb5/krb5libs.log

kdc = FILE:/data/logs/krb5/krb5kdc.log

admin_server = FILE:/data/logs/krb5/kadmind.log

[libdefaults]

default_realm = WONHIGH.CN

dns_lookup_realm = false

dns_lookup_kdc = false

ticket_lifetime = 24h

renew_lifetime = 7d

forwardable = true

[realms]

WONHIGH.CN = {

kdc = nn21021:88

admin_server = nn21021:749

}

[domain_realm]

.wonhigh.cn = WONHIGH.CN

wonhigh.cn = WONHIGH.CN

[kdc]

profile=/var/kerberos/krb5kdc/kdc.conf

修改/var/kerberos/krb5kdc/kdc.conf

vim /var/kerberos/krb5kdc/kdc.conf

[kdcdefaults]

kdc_ports = 88

kdc_tcp_ports = 88

[realms]

WONHIGH.CN = {

#master_key_type = aes256-cts

acl_file = /var/kerberos/krb5kdc/kadm5.acl

dict_file = /usr/share/dict/words

admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab

supported_enctypes = aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal

}

修改/var/kerberos/krb5kdc/kadmin.acl

vim /var/kerberos/krb5kdc/kadm5.acl

*/ [email protected] *

增加目录

mkdir -p /data/logs/krb5

mkdir -p /data/hadoop/hdfs/name

mkdir -p /data/hadoop/hdfs/data

mkdir -p /data/hadoop/hdfs/tmp

mkdir -p /etc/hadoop/conf

创建数据库
- kdb5_util create -r WONHIGH.CN -s

启动服务

chkconfig --level 35 krb5kdc on
chkconfig --level 35 kadmin on
service krb5kdc start

service kadmin start

创建kerberos管理员账户

echo -e "wonhigh@014\nwonhigh@014" | kadmin.local -q "addprinc root/admin"

抽取秘钥保存至kadm5.keytab中

kadmin.local -q "ktadd -k /var/kerberos/krb5kdc/kadm5.keytab kadmin/[email protected]"

kadmin.local -q "ktadd -k /var/kerberos/krb5kdc/kadm5.keytab kadmin/[email protected]"

kadmin.local -q "ktadd -k /var/kerberos/krb5kdc/kadm5.keytab kadmin/[email protected]"

查看秘钥

klist -k /var/kerberos/krb5kdc/kadm5.keytab

在kerberos数据库中增加hdfs、http、yarn、mapred用户

kadmin.local -q "addprinc -randkey hdfs/nn21021@WONHIGH.CN"

kadmin.local -q "addprinc -randkey hdfs/dn21024@WONHIGH.CN"

kadmin.local -q "addprinc -randkey HTTP/nn21021@WONHIGH.CN"

kadmin.local -q "addprinc -randkey HTTP/dn21024@WONHIGH.CN"

kadmin.local -q "addprinc -randkey yarn/nn21021@WONHIGH.CN"

kadmin.local -q "addprinc -randkey yarn/dn21024@WONHIGH.CN"

kadmin.local -q "addprinc -randkey mapred/nn21021@WONHIGH.CN"

kadmin.local -q "addprinc -randkey mapred/dn21024@WONHIGH.CN"

查看创建的用户
- kadmin.local -q "listprincs"

创建hdfs.keytab文件

cd /var/kerberos/krb5kdc/

kadmin.local -q "xst  -k hdfs.keytab  hdfs/[email protected]"

kadmin.local -q "xst  -k hdfs.keytab  hdfs/[email protected]"

kadmin.local -q "xst  -k hdfs.keytab  HTTP/[email protected]"

kadmin.local -q "xst  -k hdfs.keytab  HTTP/[email protected]"

创建yarn.keytab文件

cd /var/kerberos/krb5kdc/

kadmin.local -q "xst  -k yarn.keytab  yarn/[email protected]"

kadmin.local -q "xst  -k yarn.keytab  yarn/[email protected]"

创建mapred.keytab

cd /var/kerberos/krb5kdc/

kadmin.local -q "xst  -k mapred.keytab  mapred/[email protected]"

kadmin.local -q "xst  -k mapred.keytab  mapred/[email protected]"

复制生成的keytab到指定目录并赋予权限

cd /var/kerberos/krb5kdc/

scp hdfs.keytab yarn.keytab mapred.keytab nn21021:/etc/hadoop/conf

chown -R hdfs:hadoop /etc/hadoop/conf/hdfs.keytab

chown -R yarn:hadoop /etc/hadoop/conf/yarn.keytab

chown -R mapred:hadoop /etc/hadoop/conf/mapred.keytab

scp hdfs.keytab yarn.keytab mapred.keytab dn21024:/etc/hadoop/conf

chown -R hdfs:hadoop /etc/hadoop/conf/hdfs.keytab

chown -R yarn:hadoop /etc/hadoop/conf/yarn.keytab

chown -R mapred:hadoop /etc/hadoop/conf/mapred.keytab

验证keytab是否有效

~~kinit root/admin~~

kinit -k -t /etc/hadoop/conf/hdfs.keytab hdfs/ [email protected]

klist

修改hadoop-env.sh

vim $HADOOP_HOME/etc/hadoop/hadoop-env.sh

export JAVA_HOME=/usr/java/java-1.7.0_67

修改core-site.xml

vim $HADOOP_HOME/etc/hadoop/core-site.xml

fs.default.name

hdfs://nn21021:9000

hadoop.tmp.dir

/data/hadoop/hdfs/tmp

hadoop.proxyuser.root.hosts

The superuser can connect only from anywhere(here we also can set comma separated host names,such as: 'host1,host2') to impersonate a user

hadoop.proxyuser.root.groups

Allow the superuser root to impersonate any members of the any groups

hadoop.security.authentication

kerberos

hadoop.security.authorization

true

修改hdfs-site.xml

vim $HADOOP_HOME/etc/hadoop/hdfs-site.xml

dfs.namenode.secondary.http-address

nn21021:9001

dfs.namenode.name.dir

/data/hadoop/hdfs/name

dfs.datanode.data.dir

/data/hadoop/hdfs/data

dfs.replication

dfs.webhdfs.enabled

true

dfs.block.access.token.enable

true

dfs.datanode.data.dir.perm

700

dfs.namenode.keytab.file

/etc/hadoop/conf/hdfs.keytab

dfs.namenode.kerberos.principal

hdfs/[email protected]

dfs.namenode.kerberos.https.principal
HTTP/[email protected]

dfs.datanode.address
0.0.0.0:50070

dfs.datanode.http.address
0.0.0.0:50010

dfs.datanode.keytab.file
/etc/hadoop/conf/hdfs.keytab

dfs.datanode.kerberos.principal
hdfs/[email protected]

dfs.datanode.kerberos.https.principal
HTTP/[email protected]

dfs.webhdfs.enabled
true

dfs.web.authentication.kerberos.principal
HTTP/[email protected]

dfs.web.authentication.kerberos.keytab
/etc/hadoop/conf/hdfs.keytab

ignore.secure.ports.for.testing

true

复制文件(nn21021)

scp core-site.xml hdfs-site.xml dn21024:/usr/local/hadoop-2.5.0/etc/hadoop/

更改文件权限(nn21021和dn21024)

chown -R hdfs:hadoop $HADOOP_HOME/logs/

chown -R hdfs:hadoop /data/hadoop/hdfs/

启动hdfs测试验证(nn21021)

./start-dfs.sh

jps

修改yarn-site.xml

yarn.nodemanager.aux-services

mapreduce_shuffle

yarn.nodemanager.aux-services.mapreduce.shuffle.class

org.apache.hadoop.mapred.ShuffleHandler

yarn.resourcemanager.hostname

nn21021

yarn.resourcemanager.address

nn21021:8032

yarn.resourcemanager.scheduler.address

nn21021:8030

yarn.resourcemanager.resource-tracker.address

nn21021:8031

yarn.resourcemanager.admin.address

nn21021:8033

yarn.resourcemanager.webapp.address

nn21021:8088

mapreduce.app-submission.cross-platform

true

who will execute(launch) the containers.

yarn.nodemanager.container-executor.class

org.apache.hadoop.yarn.server.nodemanager.LinuxContainerExecutor

The class which should help the LCE handle resources.

yarn.nodemanager.linux-container-executor.resources-handler.class

org.apache.hadoop.yarn.server.nodemanager.util.CgroupsLCEResourcesHandler

The cgroups hierarchy under which to place YARN proccesses (cannot contain commas).

If yarn.nodemanager.linux-container-executor.cgroups.mount is false (that is, if cgroups have

been pre-configured), then this cgroups hierarchy must already exist and be writable by the

NodeManager user, otherwise the NodeManager may fail.

Only used when the LCE resources handler is set to the CgroupsLCEResourcesHandler.

yarn.nodemanager.linux-container-executor.cgroups.hierarchy

/hadoop-yarn

Whether the LCE should attempt to mount cgroups if not found.

Only used when the LCE resources handler is set to the CgroupsLCEResourcesHandler.

yarn.nodemanager.linux-container-executor.cgroups.mount

true

Where the LCE should attempt to mount cgroups if not found. Common locations
include /sys/fs/cgroup and /cgroup; the default location can vary depending on the Linux distribution in
use. This path must exist before the NodeManager is launched.
Only used when the LCE resources handler is set to the CgroupsLCEResourcesHandler, and yarn.nodemanager.linux-container-executor.cgroups.mount is true.

yarn.nodemanager.linux-container-executor.cgroups.mount-path
/cgroup

yarn.nodemanager.linux-container-executor.group
hadoop

your user group here. should match container-executor.cfg

yarn.scheduler.capacity.root.default.acl_submit_applications
*
users who can submit the job

hadoop.security.authentication
kerberos

yarn.resourcemanager.keytab
/etc/hadoop/conf/yarn.keytab

yarn.resourcemanager.principal
yarn/[email protected]

yarn.nodemanager.keytab
/etc/hadoop/conf/yarn.keytab

yarn.nodemanager.principal
yarn/[email protected]

修改mapred-site.xml

mapreduce.framework.name
yarn

mapreduce.jobhistory.address
nn21021:10020

mapreduce.jobhistory.webapp.address
nn21021:19888

mapreduce.app-submission.cross-platform
true

mapreduce.jobtracker.staging.root.dir
/user

mapreduce.jobhistory.keytab
/etc/hadoop/conf/mapred.keytab

mapreduce.jobhistory.principal
mapred/[email protected]

修改文件权限

chmod 771 $HADOOP_HOME/logs

chown root:hadoop $HADOOP_HOME/bin/ container-executor

chmod 6050 $HADOOP_HOME/bin/container-executor

安装cgroup

yum install libcgroup

mkdir /cgroup

service cgconfig start

mkdir /cgroup/cpu/hadoop-yarn

chown -R root:hadoop /cgroup/cpu/hadoop-yarn

chmod 771 cpu

chown -R yarn:hadoop hadoop-yarn/

cgroup相关命令

查看状态：service cgconfig status

即时开启：service cgconfig start

即时停止：service cgconfig stop

创建hdfs目录并赋予权限

hadoop dfs -chown hdfs:hadoop /
hadoop dfs -mkdir /user
hadoop dfs -chmod 771 /user

验证yarn

$HADOOP_HOME/bin/yarn jar $HADOOP_HOME/share/hadoop/mapreduce/hadoop-mapreduce-examples-2.5.0.jar pi 1 10

完结

问题列表

java.io.FileNotFoundException: /data/hadoop/hdfs/name/current/VERSION (Permission denied)

at java.io.RandomAccessFile.open(Native Method)

at java.io.RandomAccessFile.(RandomAccessFile.java:241)

at org.apache.hadoop.hdfs.server.common.StorageInfo.readPropertiesFile(StorageInfo.java:241)

at org.apache.hadoop.hdfs.server.namenode.NNStorage.readProperties(NNStorage.java:627)

at org.apache.hadoop.hdfs.server.namenode.FSImage.recoverStorageDirs(FSImage.java:325)

at org.apache.hadoop.hdfs.server.namenode.FSImage.recoverTransitionRead(FSImage.java:202)

at org.apache.hadoop.hdfs.server.namenode.FSNamesystem.loadFSImage(FSNamesystem.java:1020)

at org.apache.hadoop.hdfs.server.namenode.FSNamesystem.loadFromDisk(FSNamesystem.java:739)

at org.apache.hadoop.hdfs.server.namenode.NameNode.loadNamesystem(NameNode.java:536)

at org.apache.hadoop.hdfs.server.namenode.NameNode.initialize(NameNode.java:595)

at org.apache.hadoop.hdfs.server.namenode.NameNode.(NameNode.java:762)

at org.apache.hadoop.hdfs.server.namenode.NameNode.(NameNode.java:746)

at org.apache.hadoop.hdfs.server.namenode.NameNode.createNameNode(NameNode.java:1438)

at org.apache.hadoop.hdfs.server.namenode.NameNode.main(NameNode.java:1504)

2015-01-04 20:00:43,242 INFO org.apache.hadoop.util.ExitUtil: Exiting with status 1

2015-01-04 20:00:43,244 INFO org.apache.hadoop.hdfs.server.namenode.NameNode: SHUTDOWN_MSG:

解决方案：

rm -rf /data/hadoop/hdfs/name/*

java.io.IOException: NameNode is not formatted.

at org.apache.hadoop.hdfs.server.namenode.FSImage.recoverTransitionRead(FSImage.java:212)