背景介绍:rock集群和stone集群,希望能够互相访问
1. 添加互信的principal(两个集群的kdc都要进行操作)
kadmin: addprinc -e "des3-hmac-sha1:normal des-cbc-crc:normal" krbtgt/KERBEROS.STONE@KERBEROS.ROCK
kadmin: addprinc -e "des3-hmac-sha1:normal des-cbc-crc:normal" krbtgt/KERBEROS.ROCK@KERBEROS.STONE
注:同样的pricipal分别于两kdc上的密码,version number,加密方式必须一致。
2. 修改kdc中krb5.conf的realms,这样才能找到对方
KERBEROS.ROCK = {
kdc = rock-kdc.dscc:50088
admin_server = rock-kdc.dscc:50749
kpasswd_server = rock-kdc.dscc:50464
default_domain = .kerberos.rock
supported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal
}
KERBEROS.STONE &#