Kerberos 操作命令使用

一. 指南

1. 登录

kinit

2. 查询登录状态

klist

3. 退出

kdestroy

二. 使用指南

1. 登录管理KDC服务器，登录后台

kadmin.local

2. 查看用户列表

listprincs

3. 修改帐号密码(可修改忘记密码)

[root@dounine ~]# kadmin.local
Authenticating as principal root/admin@EXAMPLE.COM with password.
kadmin.local:  change_password admin/admin@EXAMPLE.COM
Enter password for principal "admin/admin@EXAMPLE.COM": 123456
Re-enter password for principal "admin/admin@EXAMPLE.COM": 123456
Password for "admin/admin@EXAMPLE.COM" changed.

4. 创建用户

[root@dounine ~]# kadmin.local
Authenticating as principal root/admin@EXAMPLE.COM with password.
kadmin.local:  add_principal test1
WARNING: no policy specified for test1@EXAMPLE.COM; defaulting to no policy
Enter password for principal "test1@EXAMPLE.COM": 123456
Re-enter password for principal "test1@EXAMPLE.COM": 123456
Principal "test1@EXAMPLE.COM" created.

5. 删除用户

[root@dounine ~]# kadmin.local
Authenticating as principal root/admin@EXAMPLE.COM with password.
kadmin.local:  delete_principal test1
Are you sure you want to delete the principal "test1@EXAMPLE.COM"? (yes/no): yes
Principal "test1@EXAMPLE.COM" deleted.
Make sure that you have removed this principal from all ACLs before reusing.

6. 只导出用户keytab文件(并且不要修改密码)

[root@dounine ~]# kadmin.local
Authenticating as principal root/admin@EXAMPLE.COM with password.
kadmin.local:  xst -k admin.keytab -norandkey admin/admin@EXAMPLE.COM
Entry for principal admin/admin@EXAMPLE.COM with kvno 6, encryption type aes256-cts-hmac-sha1-96 added to keytab WRFILE:admin.keytab.
Entry for principal admin/admin@EXAMPLE.COM with kvno 6, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:admin.keytab.
Entry for principal admin/admin@EXAMPLE.COM with kvno 6, encryption type des3-cbc-sha1 added to keytab WRFILE:admin.keytab.
Entry for principal admin/admin@EXAMPLE.COM with kvno 6, encryption type arcfour-hmac added to keytab WRFILE:admin.keytab.
Entry for principal admin/admin@EXAMPLE.COM with kvno 6, encryption type camellia256-cts-cmac added to keytab WRFILE:admin.keytab.
Entry for principal admin/admin@EXAMPLE.COM with kvno 6, encryption type camellia128-cts-cmac added to keytab WRFILE:admin.keytab.
Entry for principal admin/admin@EXAMPLE.COM with kvno 6, encryption type des-hmac-sha1 added to keytab WRFILE:admin.keytab.
Entry for principal admin/admin@EXAMPLE.COM with kvno 6, encryption type des-cbc-md5 added to keytab WRFILE:admin.keytab.
kadmin.local:  exit

7. 使用Keytab验证是否可以登录（无错误输出即可）

kinit -kt /etc/security/keytabs/admin.keytab admin/admin@EXAMPLE.COM

8. 查看Keytab文件中的账号列表

[root@dounine ~]# klist -ket hbase.headless.keytab

Keytab name: FILE:hbase.headless.keytab
KVNO Timestamp           Principal
---- ------------------- ------------------------------------------------------
   7 2018-07-30T10:19:16 hbase-flink@demo.com (des-cbc-md5) 
   7 2018-07-30T10:19:16 hbase-flink@demo.com (aes128-cts-hmac-sha1-96) 
   7 2018-07-30T10:19:16 hbase-flink@demo.com (aes256-cts-hmac-sha1-96) 
   7 2018-07-30T10:19:16 hbase-flink@demo.com (des3-cbc-sha1) 
   7 2018-07-30T10:19:16 hbase-flink@demo.com (arcfour-hmac)

三. Kerberos 常用命令总结

# 进入kadmin
kadmin.local / kadmin

# 创建数据库
kdb5_util create -r JENKIN.COM -s

# 启动kdc服务
service krb5kdc start

# 启动kadmin服务
service kadmin start

# 修改当前密码
kpasswd

# 测试keytab可用性 / 通过keytab文件认证登录
kinit -kt /etc/security/keytabs/root.keytab root/cdh-master.hadoop.cn@HADOOP.CN

# 查看keytab
klist -e -k -t /etc/krb5.keytab

# 清除缓存
kdestroy




# kadmin 模式下
# 生成随机key的principal
addprinc -randkey root/master.hadoop.cn@HADOOP.CN

# 生成指定key的principal
Addprinc -pw **** admin/admin@JENKIN.COM

# 查看principal
listprincs

# 修改admin/admin的密码
cpw -pw xxxx admin/admin

# 添加/删除principle
addprinc/delprinc admin/admin

# 直接生成到keytab
ktadd -k /etc/krb5.keytab host/master1@JENKIN.COM　

# 设置密码策略(policy)
addpol -maxlife "90 days" -minlife "75 days" -minlength 8 -minclasses 3 -maxfailure 10 -history 10 user

# 添加带有密码策略的用户
addprinc -policy user hello/admin@HADOOP.COM

# 修改用户的密码策略
modprinc -policy user1 hello/admin@HADOOP.COM

# 删除密码策略
delpol [-force] user

# 修改密码策略
modpol -maxlife "90 days" -minlife "75 days" -minlength 8 -minclasses 3 -maxfailure 10 user