名詞解釋
Kerberos: Network Authentication protocol(網絡認證協議)
KDC: Key Distribution center(密鑰分配中心)
Kadmin: Kerberos Administrator(Kerberos管理)
前言
安裝Kerberos之前,需要有配置好的Ambari環境。
Ambari安裝參見上一篇文章:http://blog.51cto.com/784687488/2329891
配置/etc/hosts
[root@ambari-agent01 ~]$ cat /etc/hosts
10.0.2.20 ambari-server server.ambari.com
10.0.2.21 ambari-agent01 agent01.ambari.com kerberos-auth
10.0.2.22 ambari-agent02 agent02.ambari.com
安裝Kerberos
# 下載 aes256-cts 編碼支持組件 JCE(UnlimitedJCEPolicyJDK7.zip)
yum install krb5-server krb5-libs krb5-workstation -y
配置Kerberos Server配置文件
[root@ambari-agent01 ~]$ cat >/etc/krb5.conf<<EOF
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h # 認證憑證生命週期
renew_lifetime = 7d # 認證憑證最長延期時限
forwardable = true
rdns = false
pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
default_realm = TEST.COM
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
TEST.COM = {
kdc = kerberos-auth # TEST.COM 域中的 KDC 接口
admin_server = kerberos-auth # TEEEST.COM 域中的 Admin Server 接口
}
[domain_realm]
.TEST.com = TEST.COM
TEST.com = TEST.COM
EOF
配置KDC配置文件
# 解壓 JCE 支持組件至${JRE_HOME}/lib/security/
[root@ambari-agent01 ~]$ unzip UnlimitedJCEPolicyJDK7.zip
[root@ambari-agent01 ~]$ for n in 20 21 22;do scp local_policy.jar US_export_policy.jar 10.0.2.$n:/opt/jdk/jre/lib/security/;done
[root@ambari-agent01 ~]$ cat >/var/kerberos/krb5kdc/kdc.conf<<EOF
[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88
[realms]
TEST.COM = {
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
# aes256-cts這個校驗方式需要單獨下載 JCE-*.jar,並把 jar 包放到 ${JRE_HOME}/lib/security 路徑下
master_key_type = aes256-cts
supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
}
EOF
管理帳號 ACL 配置
[root@ambari-agent01 ~]$ cat >/var/kerberos/krb5kdc/kadm5.acl<<EOF
*/[email protected] *
EOF
初始化並創建 Kerberos 數據庫
[root@ambari-agent01 ~]$ kdb5_util create -r TEST.COM -s
Loading random data
Initializing database '/var/kerberos/krb5kdc/principal' for realm 'TEST.COM',
master key name 'K/[email protected]'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key: # 設置密碼
Re-enter KDC database master key to verify: # 確認密碼
創建管理帳號 Principal
[root@ambari-agent01 krb5kdc]$ kadmin.local -q "addprinc admin/admin"
Authenticating as principal root/[email protected] with password.
WARNING: no policy specified for admin/[email protected]; defaulting to no policy
Enter password for principal "admin/[email protected]": # 設置管理帳號密碼
Re-enter password for principal "admin/[email protected]": # 確認密碼
Principal "admin/[email protected]" created.
查看 Kerberos 數據庫帳號列表
# 個人感覺與 Mysql 查詢用戶SQL“select user, host from mysql.user;” 差不多
[root@ambari-agent01 krb5kdc]$ kadmin.local listprincs
K/[email protected]
admin/[email protected]
kadmin/[email protected]
kadmin/[email protected]
kadmin/[email protected]
kiprop/[email protected]
krbtgt/[email protected]
啓動 Kerberos-Server
systemctl start krb5kdc.service
啓動 Kadmin-Server
systemctl start kadmin.service
配置Ambari集成Kerberos,Ambari頁面配置
在管理項目中選中Kerberos
開啓Kerberos
這個警告不用管,選擇'Proceed Anyway'
# 警告:yarn的日誌和日誌目錄將被刪除,並將resourcemanager的狀態重新格式化爲開啓或關閉kerberos應用的狀態
開始配置Kerberos
配置並測試KDC連通性
配置測試kadmin連通性並繼續
# 在 Admin Principal 和 Admin Password 中填入手動創建的管理帳號與帳號密碼
# 創建的帳號爲 admin/[email protected],密碼爲123456
在Ambari集羣所有節點安裝Kerberos Client,並進行Client連接測試
# 測試過程可能會提示session過期,重新輸入用戶、密碼進行認證
# 客戶端連接命令: kadmin -r TEST.COM -s kerberos-auth:88 -padmin/[email protected]
安裝客戶端及測試連接成功
# 後面幾項配置使用默認就可以了。
# 如果有興趣的話,在 Confirm Configuration (確認配置)這步時可以下載CSV文件看一下,裏面有詳細的 Ambari 自動創建的各個應用組件連接 Kerberos 認證的 principal 和 keytabs