在各个组件开启kerberos之前需要搭建kerberos服务,安装HTTPS服务
一、搭建kerberos服务
安装kerberos服务端
yum -y install krb5-libs krb5-workstation krb5-server
修改配置:vi /var/kerberos/krb5kdc/kdc.conf
[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88
[realms]
HADOOP.COM = {
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
max_life = 24h 0m 0s
max_renewable_life = 7d
max_life = 1d
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
}
修改配置:vi /etc/krb5.conf
#Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = HADOOP.COM
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
udp_preference_limit = 1
default_realm = EXAMPLE.COM
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
HADOOP.COM = {
kdc = 192.168.248.12
admin_server = 192.168.248.12
}
[domain_realm]
.hadoop.com = HADOOP.COM
hadoop.com = HADOOP.COM
初始化数据库:/usr/sbin/kdb5_util create -s -r HADOOP.COM。密码设为:admin
创建数据库管理员:/usr/sbin/kadmin.local -q “addprinc admin/admin”,密码为admin
管理员设置ACL权限:vi /var/kerberos/krb5kdc/kadm5.acl
*/admin@HADOOP.COM *
设置启动和开机自启动:systemctl enable kadmin -->systemctl start kadmin --> systemctl status kadmin
设置启动和开机自启动:systemctl enable krb5kdc -->systemctl start krb5kdc --> systemctl status krb5kdc
二、kerberos客户端
yum install -y krb5-lib krb5-workstation krb5-devel krb5-auth-dialog
将服务端的/etc/krb5.conf复制到其他节点的/etc底下
账号密码登录:kinit admin/admin
删除当前认证用户的缓存:kdestroy
凭据登录:kinit -kt /home/hadoop/kerberos/admin.keytab admin/admin
凭证生成和kerberos的一些其他操作可自行百度,执行kadmin.local需要root用户
三、zookeeper开启kerberos
修改zookeeper的zoo.cfg配置文件
新增如下代码
kerberos.removeHostFromPrincipal=true
kerberos.removeRealmFromPrincipal=true
authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider
jaasLoginRenew=3600000
生成jaas.conf文件:vi /home/hadoop/zookeeper/apache-zookeeper-3.6.3-bin/conf/jaas.conf
Server {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
keyTab="/etc/security/keytabs/zk.service.keytab"
storeKey=true
useTicketCache=false
principal="zookeeper/hadoop101@HADOOP.COM";
};
Client {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
keyTab="/etc/security/keytabs/zk.service.keytab"
storeKey=true
useTicketCache=false
principal="zkcli/hadoop101@HADOOP.COM";
};
分发到其他节点,需要修改principal,改成对应主机名
生成配置java.env文件:vi /home/hadoop/zookeeper/apache-zookeeper-3.6.3-bin/conf/java.env
export JVMFLAGS="-Djava.security.auth.login.config=$ZOOKEEPER_HOME/conf/jaas.conf"
然后启动zk即可