hadoop使用kerberos增加权限验证功能

1. 
   
   
   1. 更改network中的hostname

      • vim /etc/sysconfig/network NETWORKING=yes HOSTNAME=nn21021

   2. 更改hosts

      • vim /etc/hosts 127.0.0.1   localhost #::1         localhost localhost.localdomain localhost6 localhost6.localdomain6 172.17.210.21 nn21021 172.17.210.22 snn21022 172.17.210.23 dn21023 172.17.210.24 dn21024 172.17.210.25 dn21025

   3. 关闭防火墙(建议：关闭自启动项设置)

      • service iptables status service iptables stop chkconfig iptables off

   4. 安装免密码登陆功能
      • 略
   5. 增加用户组、用户

      • groupadd hadoop useradd -g hadoop hdfs useradd -g hadoop yarn useradd -g hadoop mapred

   6. 对应用户增加密码

      • passwd hdfs passwd yarn passwd mapred

   7. 安装KDC SERVER

      • yum install krb5-server krb5-libs krb5-auth-dialog krb5-workstation

   8. 安装 krb5-devel、krb5-workstation

      • yum install krb5-devel krb5-workstation

   9. 修改/etc/krb5.conf

      • vim  /etc/krb5.conf [logging]  default = FILE:/data/logs/krb5/krb5libs.log  kdc = FILE:/data/logs/krb5/krb5kdc.log  admin_server = FILE:/data/logs/krb5/kadmind.log [libdefaults]  default_realm = WONHIGH.CN  dns_lookup_realm = false  dns_lookup_kdc = false  ticket_lifetime = 24h  renew_lifetime = 7d  forwardable = true [realms]  WONHIGH.CN = {   kdc = nn21021:88   admin_server = nn21021:749  } [domain_realm]  .wonhigh.cn = WONHIGH.CN  wonhigh.cn = WONHIGH.CN [kdc]   profile=/var/kerberos/krb5kdc/kdc.conf

   10. 修改/var/kerberos/krb5kdc/kdc.conf

       • vim  /var/kerberos/krb5kdc/kdc.conf [kdcdefaults]  kdc_ports = 88  kdc_tcp_ports = 88 [realms]  WONHIGH.CN = {   #master_key_type = aes256-cts   acl_file = /var/kerberos/krb5kdc/kadm5.acl   dict_file = /usr/share/dict/words   admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab   supported_enctypes = aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal  }

   11. 修改/var/kerberos/krb5kdc/kadmin.acl

       • vim /var/kerberos/krb5kdc/kadm5.acl */ [email protected] *

   12. 增加目录

       • mkdir -p  /data/logs/krb5 mkdir -p /data/hadoop/hdfs/name mkdir -p /data/hadoop/hdfs/data mkdir -p /data/hadoop/hdfs/tmp mkdir -p /etc/hadoop/conf

   13. 创建数据库

       • kdb5_util create -r WONHIGH.CN -s

   14. 启动服务

       • chkconfig --level 35 krb5kdc on chkconfig --level 35 kadmin on service krb5kdc start service kadmin start

   15. 创建kerberos管理员账户

       • echo -e "wonhigh@014\nwonhigh@014" | kadmin.local -q "addprinc root/admin"

   16. 抽取秘钥保存至kadm5.keytab中

       • kadmin.local -q "ktadd -k /var/kerberos/krb5kdc/kadm5.keytab kadmin/[email protected]" kadmin.local -q "ktadd -k /var/kerberos/krb5kdc/kadm5.keytab kadmin/[email protected]" kadmin.local -q "ktadd -k /var/kerberos/krb5kdc/kadm5.keytab kadmin/[email protected]"

   17. 查看秘钥

       • klist -k /var/kerberos/krb5kdc/kadm5.keytab

   18. 在kerberos数据库中增加hdfs、http、yarn、mapred用户

       • kadmin.local -q "addprinc -randkey hdfs/nn21021@WONHIGH.CN" kadmin.local -q "addprinc -randkey hdfs/dn21024@WONHIGH.CN" kadmin.local -q "addprinc -randkey HTTP/nn21021@WONHIGH.CN" kadmin.local -q "addprinc -randkey HTTP/dn21024@WONHIGH.CN" kadmin.local -q "addprinc -randkey yarn/nn21021@WONHIGH.CN" kadmin.local -q "addprinc -randkey yarn/dn21024@WONHIGH.CN" kadmin.local -q "addprinc -randkey mapred/nn21021@WONHIGH.CN" kadmin.local -q "addprinc -randkey mapred/dn21024@WONHIGH.CN"

   19. 查看创建的用户

       • kadmin.local -q "listprincs"

   20. 创建hdfs.keytab文件

       • cd /var/kerberos/krb5kdc/ kadmin.local -q "xst -k hdfs.keytab hdfs/[email protected]" kadmin.local -q "xst -k hdfs.keytab hdfs/[email protected]" kadmin.local -q "xst -k hdfs.keytab HTTP/[email protected]" kadmin.local -q "xst -k hdfs.keytab HTTP/[email protected]"

   21. 创建yarn.keytab文件

       • cd /var/kerberos/krb5kdc/ kadmin.local -q "xst -k yarn.keytab yarn/[email protected]" kadmin.local -q "xst -k yarn.keytab yarn/[email protected]"

   22. 创建mapred.keytab

       • cd /var/kerberos/krb5kdc/ kadmin.local -q "xst -k mapred.keytab mapred/[email protected]" kadmin.local -q "xst -k mapred.keytab mapred/[email protected]"

   23. 复制生成的keytab到指定目录并赋予权限

       • cd /var/kerberos/krb5kdc/ scp hdfs.keytab yarn.keytab mapred.keytab nn21021:/etc/hadoop/conf chown -R hdfs:hadoop  /etc/hadoop/conf/hdfs.keytab chown -R yarn:hadoop  /etc/hadoop/conf/yarn.keytab chown -R mapred:hadoop  /etc/hadoop/conf/mapred.keytab scp hdfs.keytab yarn.keytab mapred.keytab dn21024:/etc/hadoop/conf chown -R  hdfs:hadoop /etc/hadoop/conf/hdfs.keyt