(复盘)基于CentOS 7安装kerberos并生成keytab文件

1. Kerberos

1.1 学习Kerberos初衷

本人在项目中负责Real time 的业务，用户需要接入我们的kafka集群，订阅我们的topic获取数据；其中涉及用户身份认证和鉴权的问题，认证授权的框架选用的就是kerberos，需要用户从我方获取keytab文件订阅我方的topics；此内容是为了让自己更加理解业务细节，更好地服务用户；用户在与我方交互时，我方需要向他提供keytab文件；

1.2 Kerberos概述

Kerberos was originally developed for MIT's Project Athena in the 1980s and has grown to become the most widely deployed system for authentication and authorization in modern computer networks. Kerberos is currently shipped with all major computer operating systems and is uniquely positioned to become a universal solution to the distributed authentication and authorization problem of permitting universal "single sign-on" within and between federated enterprises and peer-to-peer communities. MIT has developed and maintains implementations of Kerberos software for the Apple Macintosh, Windows and Unix operating systems.

翻译：Kerberos一开始是为了20世纪80年代麻省理工学院的Athena项目而开发的，已经成长现在计算机网络方面部署的最为广泛的认证授权系统；Kerberos 目前随所有主要计算机操作系统一起提供，并且具有独特的优势，可以成为分布式身份验证和授权问题的通用解决方案，该问题允许在联合企业和点对点社区内部和之间实现通用的“单点登录”。麻省理工学院为Apple Macintosh、Windows和Unix操作系统开发并维护了Kerberos软件的实现。

2. 环境准备

2.1 基本配置

	kdc-server	kerberos-node1	kerberos-node2
操作系统	CentOS 7	CentOS 7	CentOS 7
IP地址	192.168.2.171	192.168.2.172	192.168.2.173
安装包	krb5-server krb5-workstation krb5-libs	krb5-workstation krb5-libs	krb5-workstation krb5-libs

 2.2 准备工作 

 2.2.1  编辑/etc/sysconfig/network-scripts/ifcfg-ens33

vi /etc/sysconfig/network-scripts/ifcfg-ens33

TYPE="Ethernet"
PROXY_METHOD="none"
BROWSER_ONLY="no"
BOOTPROTO="static"
DEFROUTE="yes"
IPV4_FAILURE_FATAL="no"
IPV6INIT="yes"
IPV6_AUTOCONF="yes"
IPV6_DEFROUTE="yes"
IPV6_FAILURE_FATAL="no"
IPV6_ADDR_GEN_MODE="stable-privacy"
NAME="ens33"
UUID="acadd860-4edf-4da9-947f-0abf74e26f65"
DEVICE="ens33"
ONBOOT="yes"
IPADDR=192.168.2.171
NETMASK=255.255.255.0
GATEWAY=192.168.2.2
DNS1=8.8.8.8
DNS2=114.114.114.114 

2.2.2 关闭防火墙

#关闭防火墙
systemctl stop firewalld
systemctl disable firewalld

2.2.3 编辑/etc/hosts

192.168.2.171 kdc-server
192.168.2.172 kerberos-node1
192.168.2.173 kerberos-node2

3. kerberos安装流程

3.1 安装kerberos server（节点kdc-server）

#安装krb5-server，krb5-workstation，krb5-libs
yum install -y krb5-server krb5-workstation krb5-libs

#检查
rpm -qa | grep krb5


##打印内容
krb5-server-1.15.1-55.el7_9.x86_64
krb5-libs-1.15.1-55.el7_9.x86_64
krb5-workstation-1.15.1-55.el7_9.x86_64

3.2 安装kerberos client（kerberos-node1，kerberos-node2）

#安装krb5-workstation， krb5-libs
yum install -y krb5-workstation krb5-libs

#检查
rpm -qa | grep krb5

#打印内容
krb5-libs-1.15.1-55.el7_9.x86_64
krb5-workstation-1.15.1-55.el7_9.x86_64

 3.3 编辑/var/kerberos/krb5kdc/kdc.conf（节点kdc-server）

加粗部分是需要注意修改的地方

[kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88

[realms]
 HADOOP.COM = {
  #master_key_type = aes256-cts
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  max_life = 1d
  max_renewable_life = 7d
  supported_enctypes = aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
 }

3.4 编辑/etc/krb5.conf （节点kdc-server，kerberos-node1，kerberos-node2）

# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
 pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
 default_realm = HADOOP.COM
 #default_ccache_name = KEYRING:persistent:%{uid}
 udp_preference_limit= 1

[realms]
 HADOOP.COM = {
  kdc = kdc-server
  admin_server = kdc-server
 }

[domain_realm]
 .hadoop.com = HADOOP.COM
 hadoop.com = HADOOP.COM

 3.5 编辑/var/kerberos/krb5kdc/kadm5.acl （节点kdc-server）

*/admin@HADOOP.COM      *

4. 启动（节点kdc-server）

#启动krb5kdc
systemctl start krb5kdc
systemctl enable krb5kdc
systemctl is-enabled krb5kdc
#查看krb5kdc服务是否开启
sudo chkconfig --level 35 krb5kdc on

#启动kadmin
systemctl start kadmin
systemctl enable kadmin
systemctl is-enabled kadmin

5. 注册用户实体

#超级用户
kadmin.local -q "addprinc admin/admin"

#普通用户
kadmin.local -q "addprinc abc/abc"

#查看实体
kadmin.local -q "list_principals"

6. 用户验证（节点不限）

#方式一  用户验证+密码
kinit admin/admin

#查看实体
klist

#方式二 keytab方式验证

#生成keytab密钥文件并指定keytab的存放路径
kadmin.local -q "xst -k /root/abc.keytab abc@HADOOP.COM"

#keytab验证
kinit -kt /root/abc.keytab abc

#查看实体
klist

7. 安装问题

在kerberos-node1，kerberos-node2节点执行身份验证的时候发现报错

kinit: Cannot contact any KDC for realm 'HADOOP.COM' while getting initial credentials

 这个问题产生的根本原因是kdc server 跟client 之间的网络不通 或者配置不正确，需要检查一下配置文件/etc/krb5.conf；另外还有可能是防火墙的问题，我的问题是防火墙；

#关闭防火墙
systemctl stop firewalld
systemctl disable firewalld