搭建开启keberos的hadoop集群（2）

在各个组件开启kerberos之前需要搭建kerberos服务，安装HTTPS服务

一、搭建kerberos服务

安装kerberos服务端

yum -y install krb5-libs krb5-workstation krb5-server

修改配置：vi /var/kerberos/krb5kdc/kdc.conf

[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88
[realms]
HADOOP.COM = {
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
max_life = 24h 0m 0s
max_renewable_life = 7d
max_life = 1d
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
}

修改配置：vi /etc/krb5.conf

#Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = HADOOP.COM
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
udp_preference_limit = 1
default_realm = EXAMPLE.COM
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
HADOOP.COM = {
kdc = 192.168.248.12
admin_server = 192.168.248.12
}
[domain_realm]
.hadoop.com = HADOOP.COM
hadoop.com = HADOOP.COM

初始化数据库：/usr/sbin/kdb5_util create -s -r HADOOP.COM。密码设为：admin

创建数据库管理员：/usr/sbin/kadmin.local -q “addprinc admin/admin”,密码为admin

管理员设置ACL权限：vi /var/kerberos/krb5kdc/kadm5.acl

*/admin@HADOOP.COM *

设置启动和开机自启动：systemctl enable kadmin -->systemctl start kadmin --> systemctl status kadmin

设置启动和开机自启动：systemctl enable krb5kdc -->systemctl start krb5kdc --> systemctl status krb5kdc

二、kerberos客户端

yum install -y krb5-lib krb5-workstation krb5-devel krb5-auth-dialog

将服务端的/etc/krb5.conf复制到其他节点的/etc底下

账号密码登录：kinit admin/admin

删除当前认证用户的缓存：kdestroy 

凭据登录：kinit -kt /home/hadoop/kerberos/admin.keytab admin/admin

凭证生成和kerberos的一些其他操作可自行百度，执行kadmin.local需要root用户

三、zookeeper开启kerberos

修改zookeeper的zoo.cfg配置文件

新增如下代码

kerberos.removeHostFromPrincipal=true
kerberos.removeRealmFromPrincipal=true
authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider
jaasLoginRenew=3600000

生成jaas.conf文件：vi /home/hadoop/zookeeper/apache-zookeeper-3.6.3-bin/conf/jaas.conf

Server {
  com.sun.security.auth.module.Krb5LoginModule required
  useKeyTab=true
  keyTab="/etc/security/keytabs/zk.service.keytab"
  storeKey=true
  useTicketCache=false
  principal="zookeeper/hadoop101@HADOOP.COM";
};
 
Client {
  com.sun.security.auth.module.Krb5LoginModule required
  useKeyTab=true
  keyTab="/etc/security/keytabs/zk.service.keytab"
  storeKey=true
  useTicketCache=false
  principal="zkcli/hadoop101@HADOOP.COM";
};

分发到其他节点，需要修改principal，改成对应主机名

生成配置java.env文件：vi /home/hadoop/zookeeper/apache-zookeeper-3.6.3-bin/conf/java.env

export JVMFLAGS="-Djava.security.auth.login.config=$ZOOKEEPER_HOME/conf/jaas.conf"

然后启动zk即可