jsjw18

hadoop使用kerberos增加权限验证功能

更改network中的hostname

vim /etc/sysconfig/network

NETWORKING=yes

HOSTNAME=nn21021

更改hosts

vim /etc/hosts

127.0.0.1 localhost

#::1 localhost localhost.localdomain localhost6 localhost6.localdomain6

172.17.210.21 nn21021

172.17.210.22 snn21022

172.17.210.23 dn21023

172.17.210.24 dn21024

172.17.210.25 dn21025

关闭防火墙(建议：关闭自启动项设置)

service iptables status

service iptables stop

chkconfig iptables off

安装免密码登陆功能
- 略

增加用户组、用户

groupadd hadoop

useradd -g hadoop hdfs

useradd -g hadoop yarn

useradd -g hadoop mapred

对应用户增加密码

passwd hdfs

passwd yarn

passwd mapred

安装KDC SERVER

yum install krb5-server krb5-libs krb5-auth-dialog krb5-workstation

安装 krb5-devel、krb5-workstation
- yum install krb5-devel krb5-workstation

修改/etc/krb5.conf

vim /etc/krb5.conf

[logging]

default = FILE:/data/logs/krb5/krb5libs.log

kdc = FILE:/data/logs/krb5/krb5kdc.log

admin_server = FILE:/data/logs/krb5/kadmind.log

[libdefaults]

default_realm = WONHIGH.CN

dns_lookup_realm = false

dns_lookup_kdc = false

ticket_lifetime = 24h

renew_lifetime = 7d

forwardable = true

[realms]

WONHIGH.CN = {

kdc = nn21021:88

admin_server = nn21021:749

}

[domain_realm]

.wonhigh.cn = WONHIGH.CN

wonhigh.cn = WONHIGH.CN

[kdc]

profile=/var/kerberos/krb5kdc/kdc.conf

修改/var/kerberos/krb5kdc/kdc.conf

vim /var/kerberos/krb5kdc/kdc.conf

[kdcdefaults]

kdc_ports = 88

kdc_tcp_ports = 88

[realms]

WONHIGH.CN = {

#master_key_type = aes256-cts

acl_file = /var/kerberos/krb5kdc/kadm5.acl

dict_file = /usr/share/dict/words

admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab

supported_enctypes = aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal

}

修改/var/kerberos/krb5kdc/kadmin.acl

vim /var/kerberos/krb5kdc/kadm5.acl

*/ [email protected] *

增加目录

mkdir -p /data/logs/krb5

mkdir -p /data/hadoop/hdfs/name

mkdir -p /data/hadoop/hdfs/data

mkdir -p /data/hadoop/hdfs/tmp

mkdir -p /etc/hadoop/conf

创建数据库
- kdb5_util create -r WONHIGH.CN -s

启动服务

chkconfig --level 35 krb5kdc on
chkconfig --level 35 kadmin on
service krb5kdc start

service kadmin start

创建kerberos管理员账户

echo -e "wonhigh@014\nwonhigh@014" | kadmin.local -q "addprinc root/admin"

抽取秘钥保存至kadm5.keytab中

kadmin.local -q "ktadd -k /var/kerberos/krb5kdc/kadm5.keytab kadmin/[email protected]"

kadmin.local -q "ktadd -k /var/kerberos/krb5kdc/kadm5.keytab kadmin/[email protected]"

kadmin.local -q "ktadd -k /var/kerberos/krb5kdc/kadm5.keytab kadmin/[email protected]"

查看秘钥

klist -k /var/kerberos/krb5kdc/kadm5.keytab

在kerberos数据库中增加hdfs、http、yarn、mapred用户

kadmin.local -q "addprinc -randkey hdfs/nn21021@WONHIGH.CN"

kadmin.local -q "addprinc -randkey hdfs/dn21024@WONHIGH.CN"

kadmin.local -q "addprinc -randkey HTTP/nn21021@WONHIGH.CN"

kadmin.local -q "addprinc -randkey HTTP/dn21024@WONHIGH.CN"

kadmin.local -q "addprinc -randkey yarn/nn21021@WONHIGH.CN"

kadmin.local -q "addprinc -randkey yarn/dn21024@WONHIGH.CN"

kadmin.local -q "addprinc -randkey mapred/nn21021@WONHIGH.CN"

kadmin.local -q "addprinc -randkey mapred/dn21024@WONHIGH.CN"

查看创建的用户
- kadmin.local -q "listprincs"

创建hdfs.keytab文件

cd /var/kerberos/krb5kdc/

kadmin.local -q "xst -k hdfs.keytab hdfs/[email protected]"

kadmin.local -q "xst -k hdfs.keytab hdfs/[email protected]"

kadmin.local -q "xst -k hdfs.keytab HTTP/[email protected]"

kadmin.local -q "xst -k hdfs.keytab HTTP/[email protected]"

创建yarn.keytab文件

cd /var/kerberos/krb5kdc/

kadmin.local -q "xst -k yarn.keytab yarn/[email protected]"

kadmin.local -q "xst -k yarn.keytab yarn/[email protected]"

创建mapred.keytab

cd /var/kerberos/krb5kdc/

kadmin.local -q "xst -k mapred.keytab mapred/[email protected]"

kadmin.local -q "xst -k mapred.keytab mapred/[email protected]"

复制生成的keytab到指定目录并赋予权限

cd /var/kerberos/krb5kdc/

scp hdfs.keytab yarn.keytab mapred.keytab nn21021:/etc/hadoop/conf

chown -R hdfs:hadoop /etc/hadoop/conf/hdfs.keytab

chown -R yarn:hadoop /etc/hadoop/conf/yarn.keytab

chown -R mapred:hadoop /etc/hadoop/conf/mapred.keytab

scp hdfs.keytab yarn.keytab mapred.keytab dn21024:/etc/hadoop/conf

chown -R hdfs:hadoop /etc/hadoop/conf/hdfs.keytab

chown -R yarn:hadoop /etc/hadoop/conf/yarn.keytab

chown -R mapred:hadoop /etc/hadoop/conf/mapred.keytab

验证keytab是否有效

kinit root/admin

kinit -k -t /etc/hadoop/conf/hdfs.keytab hdfs/ [email protected]

klist

修改hadoop-env.sh

vim $HADOOP_HOME/etc/hadoop/hadoop-env.sh

export JAVA_HOME=/usr/java/java-1.7.0_67

修改core-site.xml

vim $HADOOP_HOME/etc/hadoop/core-site.xml

<name>fs.default.name</name>

</property>

<name>hadoop.tmp.dir</name>

<value>/data/hadoop/hdfs/tmp</value>

</property>

<name>hadoop.proxyuser.root.hosts</name>

<description>The superuser can connect only from anywhere(here we also can set comma separated host names,such as: 'host1,host2') to impersonate a user</description>

</property>

<name>hadoop.proxyuser.root.groups</name>

<description>Allow the superuser root to impersonate any members of the any groups</description>

</property>

<name>hadoop.security.authentication</name>

<value>kerberos</value>

</property>

<name>hadoop.security.authorization</name>

</property>

</configuration>

修改hdfs-site.xml

vim $HADOOP_HOME/etc/hadoop/hdfs-site.xml

<name>dfs.namenode.secondary.http-address</name>

</property>

<name>dfs.namenode.name.dir</name>

<value>/data/hadoop/hdfs/name</value>

</property>

<name>dfs.datanode.data.dir</name>

<value>/data/hadoop/hdfs/data</value>

</property>

<name>dfs.replication</name>

</property>

<name>dfs.webhdfs.enabled</name>

</property>

<name>dfs.block.access.token.enable</name>

</property>

<name>dfs.datanode.data.dir.perm</name>

</property>

<name>dfs.namenode.keytab.file</name>

<value>/etc/hadoop/conf/hdfs.keytab</value>

</property>

<name>dfs.namenode.kerberos.principal</name>

<value>hdfs/[email protected]</value>
</property>
<property>
<name>dfs.namenode.kerberos.https.principal</name>
<value>HTTP/[email protected]</value>
</property>
<property>
<name>dfs.datanode.address</name>
<value>0.0.0.0:50070</value>
</property>
<property>
<name>dfs.datanode.http.address</name>
<value>0.0.0.0:50010</value>
</property>
<property>
<name>dfs.datanode.keytab.file</name>
<value>/etc/hadoop/conf/hdfs.keytab</value>
</property>
<property>
<name>dfs.datanode.kerberos.principal</name>
<value>hdfs/[email protected]</value>
</property>
<property>
<name>dfs.datanode.kerberos.https.principal</name>
<value>HTTP/[email protected]</value>
</property>
<property>
<name>dfs.webhdfs.enabled</name>
<value>true</value>
</property>

<property>
<name>dfs.web.authentication.kerberos.principal</name>
<value>HTTP/[email protected]</value>
</property>

<property>
<name>dfs.web.authentication.kerberos.keytab</name>
<value>/etc/hadoop/conf/hdfs.keytab</value>
</property>

<name>ignore.secure.ports.for.testing</name>

</property>

</configuration>

复制文件(nn21021)

scp core-site.xml hdfs-site.xml dn21024:/usr/local/hadoop-2.5.0/etc/hadoop/

更改文件权限(nn21021和dn21024)

chown -R hdfs:hadoop $HADOOP_HOME/logs/

chown -R hdfs:hadoop /data/hadoop/hdfs/

启动hdfs测试验证(nn21021)
- ./start-dfs.sh
  
  jps

修改yarn-site.xml

<name>yarn.nodemanager.aux-services</name>

<value>mapreduce_shuffle</value>

</property>

<name>yarn.nodemanager.aux-services.mapreduce.shuffle.class</name>

<value>org.apache.hadoop.mapred.ShuffleHandler</value>

</property>

<name>yarn.resourcemanager.hostname</name>

</property>

<name>yarn.resourcemanager.address</name>

</property>

<name>yarn.resourcemanager.scheduler.address</name>

</property>

<name>yarn.resourcemanager.resource-tracker.address</name>

</property>

<name>yarn.resourcemanager.admin.address</name>

</property>

<name>yarn.resourcemanager.webapp.address</name>

</property>

<name>mapreduce.app-submission.cross-platform</name>

</property>

<description>who will execute(launch) the containers.</description>

<name>yarn.nodemanager.container-executor.class</name>

<value>org.apache.hadoop.yarn.server.nodemanager.LinuxContainerExecutor</value>

<!--

<value>org.apache.hadoop.yarn.server.nodemanager.DefaultContainerExecutor</value>

-->

</property>

<description>The class which should help the LCE handle resources.</description>

<name>yarn.nodemanager.linux-container-executor.resources-handler.class</name>

<value>org.apache.hadoop.yarn.server.nodemanager.util.CgroupsLCEResourcesHandler</value>

</property>

<description>The cgroups hierarchy under which to place YARN proccesses (cannot contain commas).

If yarn.nodemanager.linux-container-executor.cgroups.mount is false (that is, if cgroups have

been pre-configured), then this cgroups hierarchy must already exist and be writable by the

NodeManager user, otherwise the NodeManager may fail.

Only used when the LCE resources handler is set to the CgroupsLCEResourcesHandler.

</description>

<name>yarn.nodemanager.linux-container-executor.cgroups.hierarchy</name>

<value>/hadoop-yarn</value>

</property>

<description>Whether the LCE should attempt to mount cgroups if not found.

Only used when the LCE resources handler is set to the CgroupsLCEResourcesHandler.

</description>

<name>yarn.nodemanager.linux-container-executor.cgroups.mount</name>

</property>

<property>
<description>
Where the LCE should attempt to mount cgroups if not found. Common locations
include /sys/fs/cgroup and /cgroup; the default location can vary depending on the Linux distribution in
use. This path must exist before the NodeManager is launched.
Only used when the LCE resources handler is set to the CgroupsLCEResourcesHandler, and yarn.nodemanager.linux-container-executor.cgroups.mount is true.
</description>
<name>yarn.nodemanager.linux-container-executor.cgroups.mount-path</name>
<value>/cgroup</value>
</property>
<property>
<name>yarn.nodemanager.linux-container-executor.group</name>
<value>hadoop</value>
<description>
your user group here. should match container-executor.cfg
</description>
</property>
<property>
<name>yarn.scheduler.capacity.root.default.acl_submit_applications</name>
<value>*</value>
<description> users who can submit the job </description>
</property>
<property>
<name>hadoop.security.authentication</name>
<value>kerberos</value>
</property>
<property>
<name>yarn.resourcemanager.keytab</name>
<value>/etc/hadoop/conf/yarn.keytab</value>
</property>
<property>
<name>yarn.resourcemanager.principal</name>
<value>yarn/[email protected]</value>
</property>
<property>
<name>yarn.nodemanager.keytab</name>
<value>/etc/hadoop/conf/yarn.keytab</value>
</property>
<property>
<name>yarn.nodemanager.principal</name>
<value>yarn/[email protected]</value>
</property>
</configuration>

修改mapred-site.xml

<configuration>
<property>
<name>mapreduce.framework.name</name>
<value>yarn</value>
</property>
<property>
<name>mapreduce.jobhistory.address</name>
<value>nn21021:10020</value>
</property>
<property>
<name>mapreduce.jobhistory.webapp.address</name>
<value>nn21021:19888</value>
</property>
<property>
<name>mapreduce.app-submission.cross-platform</name>
<value>true</value>
</property>
<property>
<name>mapreduce.jobtracker.staging.root.dir</name>
<value>/user</value>
</property>
<property>
<name>mapreduce.jobhistory.keytab</name>
<value>/etc/hadoop/conf/mapred.keytab</value>
</property>
<property>
<name>mapreduce.jobhistory.principal</name>
<value>mapred/[email protected]</value>
</property>
</configuration>

修改文件权限

chmod 771 $HADOOP_HOME/logs

chown root:hadoop $HADOOP_HOME/bin/ container-executor

chmod 6050 $HADOOP_HOME/bin/container-executor

安装cgroup

yum install libcgroup

mkdir /cgroup

service cgconfig start

mkdir /cgroup/cpu/hadoop-yarn

chown -R root:hadoop /cgroup/cpu/hadoop-yarn

chmod 771 cpu

chown -R yarn:hadoop hadoop-yarn/

cgroup相关命令

查看状态：service cgconfig status

即时开启：service cgconfig start

即时停止：service cgconfig stop

创建hdfs目录并赋予权限

hadoop dfs -chown hdfs:hadoop /
hadoop dfs -mkdir /user
hadoop dfs -chmod 771 /user

验证yarn

$HADOOP_HOME/bin/yarn jar $HADOOP_HOME/share/hadoop/mapreduce/hadoop-mapreduce-examples-2.5.0.jar pi 1 10

完结

问题列表

java.io.FileNotFoundException: /data/hadoop/hdfs/name/current/VERSION (Permission denied)

at java.io.RandomAccessFile.open(Native Method)

at java.io.RandomAccessFile.<init>(RandomAccessFile.java:241)

at org.apache.hadoop.hdfs.server.common.StorageInfo.readPropertiesFile(StorageInfo.java:241)

at org.apache.hadoop.hdfs.server.namenode.NNStorage.readProperties(NNStorage.java:627)

at org.apache.hadoop.hdfs.server.namenode.FSImage.recoverStorageDirs(FSImage.java:325)

at org.apache.hadoop.hdfs.server.namenode.FSImage.recoverTransitionRead(FSImage.java:202)

at org.apache.hadoop.hdfs.server.namenode.FSNamesystem.loadFSImage(FSNamesystem.java:1020)

at org.apache.hadoop.hdfs.server.namenode.FSNamesystem.loadFromDisk(FSNamesystem.java:739)

at org.apache.hadoop.hdfs.server.namenode.NameNode.loadNamesystem(NameNode.java:536)

at org.apache.hadoop.hdfs.server.namenode.NameNode.initialize(NameNode.java:595)

at org.apache.hadoop.hdfs.server.namenode.NameNode.<init>(NameNode.java:762)

at org.apache.hadoop.hdfs.server.namenode.NameNode.<init>(NameNode.java:746)

at org.apache.hadoop.hdfs.server.namenode.NameNode.createNameNode(NameNode.java:1438)

at org.apache.hadoop.hdfs.server.namenode.NameNode.main(NameNode.java:1504)

2015-01-04 20:00:43,242 INFO org.apache.hadoop.util.ExitUtil: Exiting with status 1

2015-01-04 20:00:43,244 INFO org.apache.hadoop.hdfs.server.namenode.NameNode: SHUTDOWN_MSG:

解决方案：

rm -rf /data/hadoop/hdfs/name/*

java.io.IOException: NameNode is not formatted.

at org.apache.hadoop.hdfs.server.namenode.FSImage.recoverTransitionRead(FSImage.java:212)