安裝JCE
從如下下載鏈接下載jce_policy-8.zip文件。
https://www.oracle.com/technetwork/java/javase/downloads/jce-6-download-429243.html
解壓到$JAVA_HOME/jre/lib/security/目錄。例如/usr/java/jdk1.8.0_171-amd64/jre/lib/security/
安裝Kerberos
在KDC節點安裝KDC Server
yum install krb5-server krb5-libs krb5-auth-dialog krb5-workstation -y
在其他節點安裝krb5-devel、krb5-workstation
yum install krb5-devel krb5-workstation -y
修改krb5.conf 和 kdc.conf
他們的路徑分別爲：
/etc/krb5.conf
/var/kerberos/krb5kdc/kdc.conf
krb5.conf
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
default_realm = HADOOP.COM //修改此處
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
HADOOP.COM = { //修改此處
kdc = manager.bigdata
admin_server = manager.bigdata
}
[domain_realm]
# .example.com = EXAMPLE.COM
# example.com = EXAMPLE.COM
修改完成後將改文件複製到其他節點同名目錄中。
kdc.conf
[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88
[realms]
// 修改此處
HADOOP.COM = {
#master_key_type = aes256-cts
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
創建KDC數據庫
/usr/sbin/kdb5_util create -r HADOOP.COM -s
修改KDC的ACL
/var/kerberos/krb5kdc/kadm5.acl:
*/[email protected] *
創建kerberos principal (管理員)
su root
kadmin.local
addprinc paul/admin
ktadd -norandkey -k path/to/keytabFile.keytab paul/admin
啓動KDC和Kadmin
/sbin/service krb5kdc start
/sbin/service kadmin start
通過命令認證的方式
kdestroy
# 兩種認證方式，keytab和密碼
kinit -k -t path/to/keytab paul/admin
kinit paul/admin
配置Ambari支持Kerberos認證
增加Kerberos認證
選擇左側菜單的Kerberos選項。
再點擊右側的Enable Kerberos按鈕。
接下來在彈出的窗口選擇Proceed Anyway。
如圖所示，選擇Existing MIT KDC並且勾選下方3個複選框
填寫如圖所示的信息，點擊Test KDC Connection測試是否能連通KDC Server。KDC host和Kadmin host一定要填寫hostname，否則kerberos會提示找不到kadmin/[email protected]這個principal。
接下來系統會安裝Kerberos客戶端，此步驟如果遇到其他錯誤，可查看/var/log/krb5kdc.log日誌。
如果彈出如下對話框，填寫正確的admin principal相關信息。
接下來這個配置頁面全部使用默認配置。
確認KDC配置
接着一路下一步。Ambari集成Kerberos操作完畢。
參考鏈接
https://community.hortonworks.com/questions/134851/hdp-kerberos-enable-through-ambari.html