yarn上配置kerberos（十二）

一、创建认证规则
二、创建Keytab文件
三、部署Kerberos Keytab文件
四、修改YARN配置文件，包括
1）yarn-site.xml
2）mapred-site.xml
3）container-executor.cfg
五、启动服务
六、测试


实施步骤
1、创建认证规则
[root@cdh1 training]# kadmin.local -q "addprinc -randkey yarn/cdh1@ZGP.COM"
Authenticating as principal hdfs/admin@ZGP.COM with password.
WARNING: no policy specified for yarn/cdh1@ZGP.COM; defaulting to no policy
Principal "yarn/cdh1@ZGP.COM" created.
[root@cdh1 training]# kadmin.local -q "addprinc -randkey yarn/cdh2@ZGP.COM"
[root@cdh1 training]# kadmin.local -q "addprinc -randkey yarn/cdh3@ZGP.COM"
[root@cdh1 training]# kadmin.local -q "addprinc -randkey mapred/cdh1@ZGP.COM"
[root@cdh1 training]# kadmin.local -q "addprinc -randkey mapred/cdh2@ZGP.COM"
[root@cdh1 training]# kadmin.local -q "addprinc -randkey mapred/cdh3@ZGP.COM"
[root@cdh1 training]#

查看创建的认证
[root@cdh1 training]# kadmin.local -q "listprincs"
Authenticating as principal hdfs/admin@ZGP.COM with password.
HTTP/cdh1@ZGP.COM
HTTP/cdh2@ZGP.COM
HTTP/cdh3@ZGP.COM
K/M@ZGP.COM
hdfs/cdh1@ZGP.COM
hdfs/cdh2@ZGP.COM
hdfs/cdh3@ZGP.COM
kadmin/admin@ZGP.COM
kadmin/cdh1@ZGP.COM
kadmin/changepw@ZGP.COM
krbtgt/ZGP.COM@ZGP.COM
mapred/cdh1@ZGP.COM
mapred/cdh2@ZGP.COM
mapred/cdh3@ZGP.COM
root/admin@ZGP.COM
yarn/cdh1@ZGP.COM
yarn/cdh2@ZGP.COM
yarn/cdh3@ZGP.COM
[root@cdh1 training]#


2、创建keytab文件
[root@cdh1 training]# cd /var/kerberos/krb5kdc/
[root@cdh1 training]# kadmin.local -q "xst -k yarn.keytab yarn/cdh1@ZGP.COM"
Authenticating as principal hdfs/admin@ZGP.COM with password.
Entry for principal yarn/cdh1@ZGP.COM with kvno 2, encryption type des3-cbc-sha1 added to keytab WRFILE:yarn.keytab.
Entry for principal yarn/cdh1@ZGP.COM with kvno 2, encryption type arcfour-hmac added to keytab WRFILE:yarn.keytab.
Entry for principal yarn/cdh1@ZGP.COM with kvno 2, encryption type des-hmac-sha1 added to keytab WRFILE:yarn.keytab.
Entry for principal yarn/cdh1@ZGP.COM with kvno 2, encryption type des-cbc-md5 added to keytab WRFILE:yarn.keytab.
[root@cdh1 training]# kadmin.local -q "xst -k yarn.keytab yarn/cdh2@ZGP.COM"
[root@cdh1 training]# kadmin.local -q "xst -k yarn.keytab yarn/cdh3@ZGP.COM"
[root@cdh1 training]#
[root@cdh1 krb5kdc]# kadmin.local -q "xst -k mapred.keytab mapred/cdh1@ZGP.COM"
Authenticating as principal hdfs/admin@ZGP.COM with password.
Entry for principal mapred/cdh1@ZGP.COM with kvno 2, encryption type des3-cbc-sha1 added to keytab WRFILE:mapred.keytab.
Entry for principal mapred/cdh1@ZGP.COM with kvno 2, encryption type arcfour-hmac added to keytab WRFILE:mapred.keytab.
Entry for principal mapred/cdh1@ZGP.COM with kvno 2, encryption type des-hmac-sha1 added to keytab WRFILE:mapred.keytab.
Entry for principal mapred/cdh1@ZGP.COM with kvno 2, encryption type des-cbc-md5 added to keytab WRFILE:mapred.keytab.
[root@cdh1 krb5kdc]# kadmin.local -q "xst -k mapred.keytab mapred/cdh2@ZGP.COM"
[root@cdh1 krb5kdc]# kadmin.local -q "xst -k mapred.keytab mapred/cdh3@ZGP.COM"
[root@cdh1 krb5kdc]#

查看加密方式和时间戳
[root@cdh1 training]# klist -ket yarn.keytab
Keytab name: WRFILE:yarn.keytab
KVNO Timestamp         Principal
---- ----------------- --------------------------------------------------------
   2 04/04/17 22:09:43 yarn/cdh1@ZGP.COM (des3-cbc-sha1) 
   2 04/04/17 22:09:43 yarn/cdh1@ZGP.COM (arcfour-hmac) 
   2 04/04/17 22:09:43 yarn/cdh1@ZGP.COM (des-hmac-sha1) 
   2 04/04/17 22:09:43 yarn/cdh1@ZGP.COM (des-cbc-md5) 
   2 04/04/17 22:09:53 yarn/cdh2@ZGP.COM (des3-cbc-sha1) 
   2 04/04/17 22:09:53 yarn/cdh2@ZGP.COM (arcfour-hmac) 
   2 04/04/17 22:09:53 yarn/cdh2@ZGP.COM (des-hmac-sha1) 
   2 04/04/17 22:09:53 yarn/cdh2@ZGP.COM (des-cbc-md5) 
   2 04/04/17 22:10:13 yarn/cdh3@ZGP.COM (des3-cbc-sha1) 
   2 04/04/17 22:10:13 yarn/cdh3@ZGP.COM (arcfour-hmac) 
   2 04/04/17 22:10:13 yarn/cdh3@ZGP.COM (des-hmac-sha1) 
   2 04/04/17 22:10:13 yarn/cdh3@ZGP.COM (des-cbc-md5) 
[root@cdh1 training]#
[root@cdh1 krb5kdc]# klist -ket mapred.keytab
Keytab name: WRFILE:mapred.keytab
KVNO Timestamp         Principal
---- ----------------- --------------------------------------------------------
   2 04/04/17 22:16:58 mapred/cdh1@ZGP.COM (des3-cbc-sha1) 
   2 04/04/17 22:16:58 mapred/cdh1@ZGP.COM (arcfour-hmac) 
   2 04/04/17 22:16:58 mapred/cdh1@ZGP.COM (des-hmac-sha1) 
   2 04/04/17 22:16:58 mapred/cdh1@ZGP.COM (des-cbc-md5) 
   2 04/04/17 22:17:04 mapred/cdh2@ZGP.COM (des3-cbc-sha1) 
   2 04/04/17 22:17:04 mapred/cdh2@ZGP.COM (arcfour-hmac) 
   2 04/04/17 22:17:04 mapred/cdh2@ZGP.COM (des-hmac-sha1) 
   2 04/04/17 22:17:04 mapred/cdh2@ZGP.COM (des-cbc-md5) 
   2 04/04/17 22:17:10 mapred/cdh3@ZGP.COM (des3-cbc-sha1) 
   2 04/04/17 22:17:10 mapred/cdh3@ZGP.COM (arcfour-hmac) 
   2 04/04/17 22:17:10 mapred/cdh3@ZGP.COM (des-hmac-sha1) 
   2 04/04/17 22:17:10 mapred/cdh3@ZGP.COM (des-cbc-md5) 
[root@cdh1 krb5kdc]#

3、部署Kerberos Keytab文件
[root@cdh1 krb5kdc]# cp yarn.keytab /etc/hadoop/conf
[root@cdh1 krb5kdc]# cp mapred.keytab /etc/hadoop/conf
[root@cdh1 krb5kdc]# cd /etc/hadoop/conf
[root@cdh1 conf]# chown yarn:hadoop yarn.keytab 
[root@cdh1 conf]# chown mapred:hadoop mapred.keytab 
[root@cdh1 conf]# chmod 400 yarn.keytab mapred.keytab 
[root@cdh1 conf]# scp mapred.keytab yarn.keytab cdh2:/etc/hadoop/conf   
[root@cdh1 conf]# scp mapred.keytab yarn.keytab cdh3:/etc/hadoop/conf

[root@cdh1 conf]#

确认是否更改完成
[root@cdh1 conf]# slaves.sh ls -l /etc/hadoop/conf/*.keytab
cdh2: -r-------- 1 hdfs hadoop 1298 Apr  1 04:17 /etc/hadoop/conf/hdfs.keytab
cdh2: -r-------- 1 root root    674 Apr  4 22:28 /etc/hadoop/conf/mapred.keytab
cdh2: -r-------- 1 root root    650 Apr  4 22:28 /etc/hadoop/conf/yarn.keytab
cdh3: -r-------- 1 hdfs hadoop 1298 Apr  1 04:17 /etc/hadoop/conf/hdfs.keytab
cdh3: -r-------- 1 root root    674 Apr  4 22:28 /etc/hadoop/conf/mapred.keytab
cdh3: -r-------- 1 root root    650 Apr  4 22:28 /etc/hadoop/conf/yarn.keytab
[root@cdh1 conf]#
[root@cdh1 conf]# ssh cdh2 "chown yarn:hadoop /etc/hadoop/conf/yarn.keytab;chown mapred:hadoop /etc/hadoop/conf/mapred.keytab"
[root@cdh1 conf]# ssh cdh3 "chown yarn:hadoop /etc/hadoop/conf/yarn.keytab;chown mapred:hadoop /etc/hadoop/conf/mapred.keytab"


4、修改YARN配置文件
1） yarn-site.xml
[root@cdh1 conf]# vi yarn-site.xml
  <!--YARN kerberos security-->
 <property>
  <name>yarn.resourcemanager.keytab</name>
  <value>/etc/hadoop/conf/yarn.keytab</value>
 </property>
  <property>
  <name>yarn.resourcemanager.principal</name>
  <value>yarn/_HOST@ZGP.COM</value>
 </property>
  <property>
  <name>yarn.nodemanager.keytab</name>
  <value>/etc/hadoop/conf/yarn.keytab</value>
 </property>
<property>
  <name>yarn.nodemanager.principal</name>
  <value>yarn/_HOST@ZGP.COM</value>
 </property>
  <property>
    <name>yarn.nodemanager.container-executor.class</name>
    <value>org.apache.hadoop.yarn.server.nodemanager.LinuxContainerExecutor</value>
  </property>
    <property>
    <name>yarn.nodemanager.linux-container-executor.group</name>
    <value>yarn</value>
  </property>

2） mapred-site.xml

<!--mapred kerberos security-->
  <property>
    <name>mapreduce.jobhistory.keytab</name>
    <value>/etc/hadoop/conf/mapred.keytab</value>
  </property>
  <property>
    <name>mapreduce.jobhistory.principal</name>
    <value>mapred/_HOST@ZGP.COM</value>
  </property>


3） container-executor.cfg
[root@cdh1 conf]# vi container-executor.cfg
yarn.nodemanager.linux-container-executor.group=yarn
#configured value of yarn.nodemanager.linux-container-executor.group


banned.users=bin
#comma separated list of users who can not run applications


min.user.id=0
#Prevent other super-users


allowed.system.users=root,yarn,hdfs,mapred,nobody
##comma separated list of system users who CAN run applications


修改属组与权限
[root@cdh1 conf]# chown root:yarn container-executor.cfg 
[root@cdh1 conf]# chmod 400 container-executor.cfg 
[root@cdh1 conf]#

配置文件分发
[root@cdh1 conf]# scp yarn-site.xml mapred-site.xml container-executor.cfg cdh2:/etc/hadoop/conf
[root@cdh1 conf]# scp yarn-site.xml mapred-site.xml container-executor.cfg cdh3:/etc/hadoop/conf
[root@cdh1 conf]# slaves.sh chown root:yarn /etc/hadoop/conf/container-executor.cfg
[root@cdh1 conf]# slaves.sh chmod 400 /etc/hadoop/conf/container-executor.cfg

5、启动服务

启动resourcemanager和nodemanager
[root@cdh1 ~]# cat yarn_start.sh
ssh cdh1 "kinit -k -t /etc/hadoop/conf/yarn.keytab yarn/cdh1@ZGP.COM;/etc/init.d/hadoop-yarn-resourcemanager start"
ssh cdh2 "kinit -k -t /etc/hadoop/conf/yarn.keytab yarn/cdh1@ZGP.COM;/etc/init.d/hadoop-yarn-nodemanager start"
ssh cdh3 "kinit -k -t /etc/hadoop/conf/yarn.keytab yarn/cdh1@ZGP.COM;/etc/init.d/hadoop-yarn-nodemanager start"
[root@cdh1 ~]# ./yarn_start.sh
6、测试

[root@cdh1 ~]# hadoop jar /usr/lib/hadoop-mapreduce/hadoop-mapreduce-examples.jar wordcount /tmp/wordcount/in /tmp/wordcount/out

yarn上配置kerberos完成