kerberos安装

kerberos安装：

http://www.cnblogs.com/xiaodf/p/5968178.html

1.配置hosts

2.选择一台机器安装kdc

yum install krb5-server krb5-libs krb5-auth-dialog

3. 配置kdc.conf

[kdcdefaults]

kdc_ports = 88

kdc_tcp_ports = 88

[realms]

EXAMPLE.COM = {

#master_key_type = aes256-cts

max_life = 1d

max_renewable_life = 7d

acl_file = /var/kerberos/krb5kdc/kadm5.acl

dict_file = /usr/share/dict/words

admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab

supported_enctypes = aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal

default_principal_flags = +renewable, +forwardable

}

4.配置krb5.conf

[libdefaults]

default_realm = EXAMPLE.COM

dns_lookup_kdc = false

dns_lookup_realm = false

ticket_lifetime = 86400

renew_lifetime = 604800

forwardable = true

default_tgs_enctypes = rc4-hmac

default_tkt_enctypes = rc4-hmac

permitted_enctypes = rc4-hmac

udp_preference_limit = 1

max_life = 1d

max_renewable_life = 7d

[realms]

EXAMPLE.COM = {

kdc = test1

admin_server = test1

}

5.创建/初始化Kerberos database

/usr/sbin/kdb5_util create -s

6. 添加database administrator

/usr/sbin/kadmin.local -q "addprinc admin/admin"

7. 为database administrator设置ACL权限

编辑/var/kerberos/krb5kdc/kadm5.acl === */admin @YOUR_REALM *

8.启动kdc相关服务

service krb5kdc start

service kadmin start

开机启动：

chkconfig krb5kdc on

chkconfig kadmin on

9.安装kerberos客户端

yum install krb5-workstation krb5-libs krb5-auth-dialog

注意：

不要用aes-256,aes-256加密需要额外jar包

问题

问题1： Couldn't renew kerberos ticket in order to work around Kerberos 1.8.1 issue. Please check that the ticket for 'hue/test1@EXAMPLE.COM' is still renewable:

解决：modprinc -maxrenewlife 7day krbtgt/ EXAMPLE.COM@EXAMPLE.COM

问题2: java.sql.SQLException: Could not open client transport with JDBC Uri: jdbc:hive2://192.168.199.22:21050/;principal=impala/test1@EXAMPLE.COM: GSS initiate failed

解决：检查principal

问题3: 无法重建principal

解决： 删除 /var/kerberos/krb5kdc 下除 .acl .conf的所有文件，重新create

问题4：创建的principal无法生效

解决：使用admin用户登录，再创建

问题4： kerberos下jdbc连接

解决：keytab+krb5.conf，详见report-center代码

---命令

kinit认证：kinit -kt path-to-keytab principalName