HDFS集群整合Kerberos配置步骤

1 概述

本文档用于HDFS集群整合Kerberos配置的详细步骤说明，版本分别为2.7.3和1.16。

2 前提条件

假设已有安装配置好的HDFS集群和YARN，本文使用4台服务器，角色分别为：

192.168.1.10：NameNode、SecondaryNameNode、ResourceManager
192.168.1.11：DataNode、NodeManager
192.168.1.12：DataNode、NodeManager
192.168.1.13：DataNode、NodeManager

3 安装与配置kerberos

3.1 新增kerberos用户

在需要安装kerberos的服务器（本文使用192.168.1.14）执行以下命令新增用户，用于启动kerberos服务：

# useradd kerberos

3.2 编译安装kerberos

下载kerberos的源码压缩包（https://kerberos.org/dist/krb5/1.16/krb5-1.16.tar.gz），保存在/opt/kerberos-1.16.tar.gz，执行以下命令解压：

# cd /opt/
# tar xvf kerberos-1.16.tar.gz
# cd krb5-1.16/src/
# ./configure  --prefix=/opt/kerberos-1.16  && make && make install

安装过程中可能会出现缺失yacc命令，这需要提前编译安装好bison-3.0.4.tar.gz

# chown -R kerberos:kerberos /opt/kerberos-1.16

3.3 修改环境变量

修改/etc/profile文件，新增以下kerberos的变量并保存：

# vi /etc/profile

export KRB5_CONFIG=/opt/kerberos-1.16/conf/krb5.conf
export KRB5_KDC_PROFILE=/opt/kerberos-1.16/conf/kdc.conf
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/kerberos-1.16/lib

3.4 修改配置文件

3.4.1 kdc.conf

[kdcdefaults]
    # 默认端口为88，修改为1088
    kdc_listen = 1088
    kdc_tcp_listen = 1088

[realms]
BDP.DOMAIN = {
    # 默认端口为749，修改为1749
    kadmind_port = 1749
    max_life = 12h 0m 0s
    max_renewable_life = 7d 0h 0m 0s
    master_key_type = aes256-cts
    supported_enctypes = aes256-cts:normal aes128-cts:normal
    # 根据实际安装目录修改以下路径
    database_name = /opt/kerberos-1.16/var/krb5kdc/principal
    key_stash_file = /opt/kerberos-1.16/var/krb5kdc/.k5.BDP.DOMAIN
    acl_file = /opt/kerberos-1.16/var/krb5kdc/kadm5.acl
    dict_file = /opt/kerberos-1.16/var/krb5kdc/dict
    default_principal_flags = +forwardable,+renewable
}

[logging]
    # 修改日志输出路径
    kdc = FILE:/opt/kerberos-1.16/log/krb5kdc.log
    admin_server = FILE:/opt/kerberos-1.16/log/kadmin.log
    default = FILE:/opt/kerberos-1.16/log/krb5lib.log	

3.4.2 krb5.conf

[logging]
 # 修改日志输出路径
 kdc = FILE:/opt/kerberos-1.16/log/krb5kdc.log
 admin_server = FILE:/opt/kerberos-1.16/log/kadmin.log
 default = FILE:/opt/kerberos-1.16/log/krb5lib.log

[libdefaults]
 # 域和票据的有效期
 default_realm = BDP.DOMAIN
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 renewable = true

[realms]
 # 配置的kdc服务器地址和端口，这里因为修改了默认的端口所以要指定
 BDP.DOMAIN = {
  kdc = kerberos:1088
  admin_server = kerberos:1749
 }

[domain_realm]
 # 配置的域信息，要和kdc.conf一致
 .bdp.domain = BDP.DOMAIN
 bdp.domain = BDP.DOMAIN

3.5 修改hosts文件

因5台服务器需要使用域名访问，所以需要配置服务器ip和hostname对应关系。在命令行输入以下命令：

# vi /etc/hosts

按Insert键进入编辑模式，输入以下对应关系：

192.168.1.10  hadoop0  hadoop0.bdp.domain
192.168.1.11  hadoop1  hadoop1.bdp