1 安裝前準備
1.1 主機列表
本次實驗選擇2臺主機，1臺作爲KDC master主機，1臺作爲KDC slaver
| 節點ip | OS版本 | jdk版本 | hostname -f | 安裝軟件 |
|---|---|---|---|---|
| 192.168.0.1 | RHEL7.4 | openjdk-1.8.0.131 | ambari1 | KDC master |
| 192.168.0.2 | RHEL7.4 | openjdk-1.8.0.131 | ambari2 | KDC slaver |
注意：
- 關閉防火牆
- 開啓NTP服務
2 安裝Kerberos
2.1安裝krb5
yum -y install krb5-libs krb5-server krb5-workstation
2.2配置krb
vim /etc/krb5.conf
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
#default_realm = EXAMPLE.COM
#default_ccache_name = KEYRING:persistent:%{uid}
#ADD BY CC AT 20190408
default_realm = CCTEST.DEV
dns_lookup_realm = false
udp_preference_limit = 1
clockskew = 300
renewable = true[realms]
# EXAMPLE.COM = {
# kdc = kerberos.example.com
# admin_server = kerberos.example.com
# }
#ADD BY CC AT 20190408
CCTEST.DEV = {
admin_server = ambari1:749
kdc = ambari1:88
kdc = ambari2:88
}[domain_realm]
# .example.com = EXAMPLE.COM
# example.com = EXAMPLE.COM
#ADD BY CC AT 20190408
.cctest.dev = CCTEST.DEV
cctest.dev = CCTEST.DEV
配置項說明：
[logging]：日誌輸出設置 （可選）
[libdefaults]：連接的默認配置
default_realm：Kerberos應用程序的默認領域，所有的principal都將帶有這個領域標誌
ticket_lifetime： 表明憑證生效的時限，一般爲24小時
renew_lifetime： 表明憑證最長可以被延期的時限，一般爲一個禮拜。當憑證過期之後，對安全認證的服務的後續訪問則會失敗
clockskew：時鐘偏差是不完全符合主機系統時鐘的票據時戳的容差，超過此容差將不接受此票據。通常，將時鐘扭斜設置爲 300 秒（5 分鐘）。這意味着從服務器的角度看，票證的時間戳與它的偏差可以是在前後 5 分鐘內
udp_preference_limit= 1：禁止使用 udp 可以防止一個 Hadoop 中的錯誤
default_ccache_name：credential緩存名，默認值爲
[realms]：列舉使用的 realm
kdc：代表要 kdc 的位置。格式是 機器:端口
admin_server：代表 admin 的位置。格式是 機器:端口
default_domain：代表默認的域名
[domain_realm]：域名到realm的關係 （可選）
vim /var/kerberos/krb5kdc/kdc.conf
[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88[realms]
# EXAMPLE.COM = {
# #master_key_type = aes256-cts
# acl_file = /var/kerberos/krb5kdc/kadm5.acl
# dict_file = /usr/share/dict/words
# admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
# supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
# }
CCTEST.DEV = {
master_key_type = aes256-cts
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
max_life = 24h
max_renewable_life = 10d
default_principal_flags= +renewable,+forwardable
supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
}
配置項說明：
kdcdefaults：kdc相關配置，這裏只設置了端口信息
realms：realms的配置
EXAMPLE.COM：設定的realms領域
master_key_type：和 supported_enctypes 默認使用 aes256-cts。JAVA 使用 aes256-cts 驗證方式需要安裝 JCE包(推薦不使用)
acl_file：標註了 admin 的用戶權限，文件格式是：Kerberos_principal permissions [target_principal] [restrictions]
supported_enctypes：支持的校驗方式
admin_keytab：KDC 進行校驗的 keytab
vim /var/kerberos/krb5kdc/kadm5.acl
2.3 初始化krb databases
#kdb5_util create -r CCTEST.DEV -s
Loading random data
Initializing database '/var/kerberos/krb5kdc/principal' for realm 'CCTEST.DEV',
master key name 'K/[email protected]'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key: cctest
說明：
[-s]表示生成stash file，並在其中存儲master server key（krb5kdc）
[-r]來指定一個realm name —— 當krb5.conf中定義了多個realm時纔是必要的。
如果需要重建數據庫，將/var/kerberos/krb5kdc目錄下的principal相關的文件刪除即可
2.4 添加database administrator
#kadmin.local -q "addprinc admin/admin"
Authenticating as principal root/[email protected] with password.
WARNING: no policy specified for admin/[email protected]; defaulting to no policy
Enter password for principal "admin/[email protected]": admincc
Re-enter password for principal "admin/[email protected]": admincc
Principal "admin/[email protected]" created.
2.5 啓動krb
systemctl start krb5kdc
systemctl start kadmin
systemctl enable krb5kdc
systemctl enable kadmin
2.6 登錄測試
#kadmin -p admin/[email protected]
Authenticating as principal admin/[email protected] with password.
Password for admin/[email protected]:
kadmin: ?
Available kadmin requests:add_principal, addprinc, ank Add principal
delete_principal, delprinc Delete principal
modify_principal, modprinc Modify principal
rename_principal, renprinc Rename principal
change_password, cpw Change password
get_principal, getprinc Get principal
list_principals, listprincs, get_principals, getprincs List principals
add_policy, addpol Add policy
modify_policy, modpol Modify policy
delete_policy, delpol Delete policy
get_policy, getpol Get policy
list_policies, listpols, get_policies, getpols List policies
get_privs, getprivs Get privileges
ktadd, xst Add entry(s) to a keytab
ktremove, ktrem Remove entry(s) from a keytab
lock Lock database exclusively (use with extreme caution!)
unlock Release exclusive database lock
purgekeys Purge previously retained old keys from a principal
get_strings, getstrs Show string attributes on a principal
set_string, setstr Set a string attribute on a principal
del_string, delstr Delete a string attribute on a principal
list_requests, lr, ? List available requests.
quit, exit, q Exit program.
kadmin: list_principals
K/[email protected]
admin/[email protected]
kadmin/[email protected]
kadmin/[email protected]
kadmin/[email protected]
kiprop/[email protected]
krbtgt/[email protected]
2.7 創建host keytab 文件
#kadmin.local
kadmin.local: addprinc -randkey host/ambari1 #添加principal
WARNING: no policy specified for host/[email protected]; defaulting to no policy
Principal "host/[email protected]" created.
kadmin.local: ktadd host/ambari1 #生成keytab文件
Entry for principal host/ambari1 with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari1 with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari1 with kvno 2, encryption type des3-cbc-sha1 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari1 with kvno 2, encryption type arcfour-hmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari1 with kvno 2, encryption type camellia256-cts-cmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari1 with kvno 2, encryption type camellia128-cts-cmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari1 with kvno 2, encryption type des-hmac-sha1 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari1 with kvno 2, encryption type des-cbc-md5 added to keytab FILE:/etc/krb5.keytab.kadmin.local: addprinc -randkey host/ambari2
WARNING: no policy specified for host/[email protected]; defaulting to no policy
Principal "host/[email protected]" created.
kadmin.local: ktadd host/ambari2
Entry for principal host/ambari2 with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari2 with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari2 with kvno 2, encryption type des3-cbc-sha1 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari2 with kvno 2, encryption type arcfour-hmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari2 with kvno 2, encryption type camellia256-cts-cmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari2 with kvno 2, encryption type camellia128-cts-cmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari2 with kvno 2, encryption type des-hmac-sha1 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari2 with kvno 2, encryption type des-cbc-md5 added to keytab FILE:/etc/krb5.keytab.
2.8 查看keytab
klist -ekt /etc/krb5.keytab
3 配置主從高可用
3.1 拷貝配置文件至slaver
scp /etc/krb5.conf root@ambari2:/etc/
scp /etc/krb5.keytab.bk root@ambari2:/etc/
scp /var/kerberos/krb5kdc/kdc.conf root@ambari2:/var/kerberos/krb5kdc/
scp /var/kerberos/krb5kdc/kadm5.acl root@ambari2:/var/kerberos/krb5kdc/
scp /var/kerberos/krb5kdc/.k5.CCTEST.DEV root@ambari2:/var/kerberos/krb5kdc/.k5.CCTEST.DEV
3.2 Slave上創建數據庫
#kdb5_util create -r CCTEST.DEV -s
Loading random data
Initializing database '/var/kerberos/krb5kdc/principal' for realm 'CCTEST.DEV',
master key name 'K/[email protected]'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key: cctest
Re-enter KDC database master key to verify: cctest
3.3 配置同步
#vi /var/kerberos/krb5kdc/kpropd.acl
host/[email protected]
host/[email protected]
3.4 在slave上啓動kpropd服務
systemctl start kprop
systemctl status kprop
3.5 數據同步
在master上將相關數據同步到slave上
#kdb5_util dump /var/kerberos/krb5kdc/kdc.dump
#kprop -f /var/kerberos/krb5kdc/kdc.dump -d ambari2
8964 bytes sent.
Database propagation to ambari2: SUCCEEDED
3.6 配置定時同步
#vi /usr/local/bin/krb5prop.sh
#!/bin/sh
kdclist = "ambari2"
kdb5_util dump /var/kerberos/krb5kdc/slave_datatrans
for kdc in $kdclist
do
kprop -d -f /var/kerberos/krb5kdc/slave_datatrans $kdc
done#crontab -e
15 * * * * /usr/local/bin/krb5prop.sh
3.7 測試主從切換
停止kprop服務
# systemctl stop kprop
將kpropd.acl文件備份並刪除
# mv kpropd.acl kpropd.acl.bak
啓動krb5kdc和kadmin服務
# systemctl start krb5kdc
# systemctl start kadmin
修改備服務器的/etc/krb5.conf文件，將kdc和kadmin_server修改爲備服務器地址
# mv /etc/krb5.conf /etc/krb5.conf.bak
# vi /etc/krb5.conf
[realms]
# EXAMPLE.COM = {
# kdc = kerberos.example.com
# admin_server = kerberos.example.com
# }
#ADD BY CC AT 20190408
CCTEST.DEV = {
#admin_server = ambari1:749
#kdc = ambari1:88
kdc = ambari2:88
admin_server = ambari2:749
}
測試kinit是否正常
# kinit admin/[email protected]
Password for admin/[email protected]:
# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admin/[email protected]Valid starting Expires Service principal
04/18/2019 15:29:27 04/19/2019 15:29:27 krbtgt/[email protected]
renew until 04/25/2019 15:29:27
停krb5kdc和kadmin服務
# systemctl stop krb5kdc
# systemctl stop kadmin
還原/etc/krb5.conf和kpropd.acl
# mv /etc/krb5.conf.bak /etc/krb5.conf
# mv kpropd.acl.bak kpropd.acl
啓動kprop服務
# systemctl start kprop