Cloudera-Mnanager启用Kerberos的流程

安全模块

集成kerberos/home/cloudera 安装kdc服务

点击kerberos安装 （centos 6.6的系统）

实际运行下面的脚本

1. 完成KDC安装
2. 创建acl文件echo "*/admin@${KERBEROS_REALM} *" > /var/kerberos/krb5kdc/kadm5.acl
3. 创建KERBEROS_PRINCIPAL管理KDC 默认cloudera-scm/admin@CLOUDERA 密码：cloudera
4. 启动服务

#! /usr/bin/env bash

set -e #脚本遇到错误，立即退出

function terminate() {
    if [ "${PAUSE}" == 'true' ]; then
        read -p "Press [Enter] to exit..."
    fi
    exit ${1}
}

function ensure_user_is_root() {
    if [[ "$EUID" -ne "0" ]]; then
        echo "You must run this script as root. Try 'sudo ${0} ${@}'."
        terminate 1
    fi
}

function parse_arguments() {
    for argument in ${@}; do
        if [ "${argument}" == '--force' ]; then
            export FORCE='true'
        elif [ "${argument}" == '--pause' ]; then
            export PAUSE='true'
        else
            echo "Unknown option: ${argument}"
            terminate 1
        fi
    done
}

function log() {
    echo "[QuickStart] ${1}"
}

parse_arguments ${@}

KERBEROS_REALM=${KERBEROS_REALM:-CLOUDERA}
KERBEROS_DOMAIN=${KERBEROS_DOMAIN:-cloudera}
KERBEROS_HOSTNAME=${KERBEROS_HOSTNAME:-quickstart.${KERBEROS_DOMAIN}}
KERBEROS_PRINCIPAL=${KERBEROS_PRINCIPAL:-cloudera-scm/admin}
KERBEROS_PASSWORD=${KERBEROS_PASSWORD:-cloudera}
JAVA_HOME=${JAVA_HOME:-/usr/java/jdk1.7.0_*-cloudera}

ensure_user_is_root

log 'Installing Kerberos...'
yum install -y krb5-server krb5-workstation openldap
#开机自启
chkconfig krb5kdc on
chkconfig kadmin on

touch /var/lib/cloudera-quickstart/.kerberos

log 'Configuring Kerberos...'

cat > /etc/krb5.conf < /var/kerberos/krb5kdc/kdc.conf < /var/kerberos/krb5kdc/kadm5.acl

log 'Setting root password for Kerberos...'
expect - <

建完后的KDC库

kadmin.local:  listprincs
K/M@CLOUDERA
cloudera-scm/admin@CLOUDERA
kadmin/admin@CLOUDERA
kadmin/changepw@CLOUDERA
kadmin/quickstart.cloudera@CLOUDERA
krbtgt/CLOUDERA@CLOUDERA

页面配置：

图片.png

管理其他账号的principal配置，也是第一个建的cloudera-scm/admin这个

图片.png