Kerberos 基本命令 - 持续更新

• 授权添加yarn账户 

[root@xxx ~]# kadmin.local 
Authenticating as principal cloudera-scm/[email protected] with password.
kadmin.local:  addprinc [email protected]
WARNING: no policy specified for [email protected]; defaulting to no policy
Enter password for principal "[email protected]": 
Re-enter password for principal "[email protected]": 
Principal "[email protected]" created.
kadmin.local:  exit

•  查看当前系统使用的Kerberos账户

#使用的 cloudera-scm
[root@xxx ~]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: cloudera-scm/[email protected]

Valid starting       Expires              Service principal
2019-08-06T14:45:54  2019-08-07T14:45:54  krbtgt/[email protected]
	renew until 2019-08-13T14:45:54

注意：这里 Expires 是过期时间，即我们使用kinit 授权时候是有有效期的 

有效期设置对应配置文件  /etc/krb5.conf 中的 ticket_lifetime = 24h 参数 （修改时服务端与客户端同时修改）

• 退出授权 - kdestroy

[root@ecs-dbtest-0003 kerberos]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admin/[email protected]

Valid starting       Expires              Service principal
10/17/2019 10:17:27  10/18/2019 10:17:27  krbtgt/[email protected]
        renew until 10/24/2019 10:17:27
[root@ecs-dbtest-0003 kerberos]# kdestroy
[root@ecs-dbtest-0003 kerberos]# klist
klist: No credentials cache found (filename: /tmp/krb5cc_0)

• 使用Kerberos账户

[root@xxx ~]# kinit yarn #这里yarn是通过 kadmin.local  addprinc [email protected] 创建的
Password for [email protected]:   #这里输入密码

然后使用root用户读/写/执行hdfs权限即为yarn用户

[root@xxx ~]# hdfs dfs -put index.html /tmp
[root@xxx ~]# hdfs dfs -ls /tmp
Found 6 items
drwxrwxrwx   - hdfs   supergroup          0 2019-08-06 15:56 /tmp/.cloudera_health_monitoring_canary_files
drwxr-xr-x   - yarn   supergroup          0 2019-07-17 09:37 /tmp/hadoop-yarn
drwx--x--x   - hbase  supergroup          0 2019-07-01 13:37 /tmp/hbase-staging
drwx-wx-wx   - hive   supergroup          0 2019-07-02 16:16 /tmp/hive
-rw-r--r--   2 yarn   supergroup       2381 2019-08-06 15:57 /tmp/index.html
drwxrwxrwt   - mapred hadoop              0 2019-07-18 21:38 /tmp/logs

• 创建keytab文件

[root@xxx jast]# kadmin.local -q "xst -norandkey -k hdfs.keytab [email protected]"
Authenticating as principal hdfs/[email protected] with password.
Entry for principal [email protected] with kvno 1, encryption type aes256-cts-hmac-sha1-96 added to keytab WRFILE:hdfs.keytab.
Entry for principal [email protected] with kvno 1, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:hdfs.keytab.
Entry for principal [email protected] with kvno 1, encryption type des3-cbc-sha1 added to keytab WRFILE:hdfs.keytab.
Entry for principal [email protected] with kvno 1, encryption type arcfour-hmac added to keytab WRFILE:hdfs.keytab.
Entry for principal [email protected] with kvno 1, encryption type camellia256-cts-cmac added to keytab WRFILE:hdfs.keytab.
Entry for principal [email protected] with kvno 1, encryption type camellia128-cts-cmac added to keytab WRFILE:hdfs.keytab.
Entry for principal [email protected] with kvno 1, encryption type des-hmac-sha1 added to keytab WRFILE:hdfs.keytab.
Entry for principal [email protected] with kvno 1, encryption type des-cbc-md5 added to keytab WRFILE:hdfs.keytab.

• 命令行使用keytab 

[root@xxx jast]# kinit -kt hdfs.keytab [email protected]
[root@xxx jast]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: [email protected]

Valid starting       Expires              Service principal
2019-08-07T13:35:19  2019-08-08T13:35:19  krbtgt/[email protected]
	renew until 2019-08-14T13:35:19

 

创建keytab不同用户，即便密码相同，也不可共用keytab

[root@xxx jast]# kinit -kt hdfs.keytab [email protected]
kinit: Keytab contains no suitable keys for [email protected] while getting initial credentials

 

• 合并多个 keytab 为一个 keytab

[root@xxx jast]# ktutil
ktutil:  rkt hdfs.keytab  #读取多个keytab
ktutil:  rkt yarn.keytab  
ktutil:  wkt hdfs-nb.keytab #合并为一个hdfs-nb.keytab ， 即这个文件可以使用 hdfs 和yarn 的keytab
ktutil:  exit

在当前目录可以看到生成的 hdfs-nb.keytab

验证：

[root@xxx jast]# kinit -kt hdfs.keytab [email protected]   #使用hdfs的keytab，登录yarn用户，报错
kinit: Keytab contains no suitable keys for [email protected] while getting initial credentials
[root@xxx jast]# kinit -kt hdfs-nb.keytab [email protected] #使用合并的keytab，登录yarn用户，成功
[root@xxx jast]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: [email protected]

Valid starting       Expires              Service principal
2019-08-07T13:43:06  2019-08-08T13:43:06  krbtgt/[email protected]
	renew until 2019-08-14T13:43:06
[root@xxx jast]# kinit -kt hdfs-nb.keytab [email protected]  #使用合并的keytab，登录hdfs用户，成功
[root@xxx jast]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: [email protected]

Valid starting       Expires              Service principal
2019-08-07T13:44:19  2019-08-08T13:44:19  krbtgt/[email protected]
	renew until 2019-08-14T13:44:19

• 查看keytab内容

[root@xxx jast]# klist -k -e hdfs.keytab 
Keytab name: FILE:hdfs.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   1 [email protected] (aes256-cts-hmac-sha1-96) 
   1 [email protected] (aes128-cts-hmac-sha1-96) 
   1 [email protected] (des3-cbc-sha1) 
   1 [email protected] (arcfour-hmac) 
   1 [email protected] (camellia256-cts-cmac) 
   1 [email protected] (camellia128-cts-cmac) 
   1 [email protected] (des-hmac-sha1) 
   1 [email protected] (des-cbc-md5) 
[root@fwqml006 jast]# klist -k -e hdfs-nb.keytab
Keytab name: FILE:hdfs-nb.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   1 [email protected] (aes256-cts-hmac-sha1-96) 
   1 [email protected] (aes128-cts-hmac-sha1-96) 
   1 [email protected] (des3-cbc-sha1) 
   1 [email protected] (arcfour-hmac) 
   1 [email protected] (camellia256-cts-cmac) 
   1 [email protected] (camellia128-cts-cmac) 
   1 [email protected] (des-hmac-sha1) 
   1 [email protected] (des-cbc-md5) 
   1 [email protected] (aes256-cts-hmac-sha1-96) 
   1 [email protected] (aes128-cts-hmac-sha1-96) 
   1 [email protected] (des3-cbc-sha1) 
   1 [email protected] (arcfour-hmac) 
   1 [email protected] (camellia256-cts-cmac) 
   1 [email protected] (camellia128-cts-cmac) 
   1 [email protected] (des-hmac-sha1) 
   1 [email protected] (des-cbc-md5) 

• spark授权 启动指定keytab

spark-submit --principal [email protected] --keytab hdfs-nb.keytab --jars $(echo lib/*.jar | tr ' ' ',') --class com.jast.test.Test data-filter-1.0-SNAPSHOT.jar