文章目录
一、搭建zookeeper集群
将zookeeper-3.4.14文件上传到/bigdata/目录下,
cd /bigdata/zookeeper-3.4.14/conf
1.1修改zoo.cfg配置文件:
mv zoo_sample.cfg zoo.cfg
vim zoo.cfg
配置如下:
tickTime=2000
initLimit=10
syncLimit=5
clientPort=2181
dataDir=/bigdata/zookeeper-3.4.14/data
dataLogDir=/bigdata/zookeeper-3.4.14/logs
server.1=192.168.27.201:2888:3888
server.2=192.168.27.202:2888:3888
server.3=192.168.27.203:2888:3888
cd /bigdata/zookeeper-3.4.14/
创建数据和日志文件夹:
mkdir data logs
1.2 创建myid
192.168.27.201 节点:
vim data/myid
1
将zookeeper目录分发到集群的其他节点:
[root@cdh1 bigdata]# xsync zookeeper-3.4.14
xsync 设置参考我的另一篇博客:https://blog.csdn.net/qq_39122146/article/details/121014308
修改cdh2、cdh3节点的myid
192.168.27.202 节点:
vim data/myid
2
```bash
192.168.27.203 节点:
vim data/myid
3
1.3 编写启动脚本:
[root@cdh1 zookeeper-3.4.14]# cat start.sh
#!/bin/bash
/bigdata/zookeeper-3.4.14/bin/zkServer.sh start
ssh cdh2 "source /etc/profile;/bigdata/zookeeper-3.4.14/bin/zkServer.sh start"
ssh cdh3 "source /etc/profile;/bigdata/zookeeper-3.4.14/bin/zkServer.sh start"
[root@cdh1 zookeeper-3.4.14]# cat status.sh
#!/bin/bash
/bigdata/zookeeper-3.4.14/bin/zkServer.sh status
ssh cdh2 "source /etc/profile;/bigdata/zookeeper-3.4.14/bin/zkServer.sh status"
ssh cdh3 "source /etc/profile;/bigdata/zookeeper-3.4.14/bin/zkServer.sh status"
[root@cdh1 zookeeper-3.4.14]# cat stop.sh
#!/bin/bash
/bigdata/zookeeper-3.4.14/bin/zkServer.sh stop
ssh cdh2 "/bigdata/zookeeper-3.4.14/bin/zkServer.sh stop"
ssh cdh3 "/bigdata/zookeeper-3.4.14/bin/zkServer.sh stop"
二、Kerberos认证
2.1生成keytab
#服务端
kadmin.local -q "addprinc -randkey zookeeper/cdh1.itcast.cn@ITCAST.CN "
kadmin.local -q "addprinc -randkey zookeeper/cdh2.itcast.cn@ITCAST.CN "
kadmin.local -q "addprinc -randkey zookeeper/cdh3.itcast.cn@ITCAST.CN "
kadmin.local -q "xst -k /etc/security/keytabs/zk.keytab zookeeper/cdh1.itcast.cn@ITCAST.CN "
kadmin.local -q "xst -k /etc/security/keytabs/zk.keytab zookeeper/cdh2.itcast.cn@ITCAST.CN "
kadmin.local -q "xst -k /etc/security/keytabs/zk.keytab zookeeper/cdh3.itcast.cn@ITCAST.CN "
#客户端
kadmin.local -q "addprinc -randkey zkcli/cdh1.itcast.cn@ITCAST.CN "
kadmin.local -q "addprinc -randkey zkcli/cdh2.itcast.cn@ITCAST.CN "
kadmin.local -q "addprinc -randkey zkcli/cdh3.itcast.cn@ITCAST.CN "
kadmin.local -q "xst -k /etc/security/keytabs/zk.keytab zkcli/cdh1.itcast.cn@ITCAST.CN "
kadmin.local -q "xst -k /etc/security/keytabs/zk.keytab zkcli/cdh2.itcast.cn@ITCAST.CN "
kadmin.local -q "xst -k /etc/security/keytabs/zk.keytab zkcli/cdh3.itcast.cn@ITCAST.CN "
将keytab文件拷贝到其他节点
xsync /etc/security/keytabs/zookeeper.keytab
xsync /etc/security/keytabs/zkcli.keytab
并设置权限
$ ssh cdh1 "cd /etc/security/keytabs/;chmod 400 *.keytab"
$ ssh cdh2 "cd /etc/security/keytabs/;chmod 400 *.keytab"
$ ssh cdh3 "cd /etc/security/keytabs/;chmod 400 *.keytab"
由于 keytab 相当于有了永久凭证,不需要提供密码(如果修改 kdc 中的 principal 的密码,则该 keytab 就会失效),所以其他用户如果对该文件有读权限,就可以冒充 keytab 中指定的用户身份访问 hadoop,所以 keytab 文件需要确保只对 owner 有读权限(0400)
2.1.2 修改 zookeeper 配置文件
在 cdh1 节点上修改 /bigdata/zookeeper-3.4.14/conf/zoo.cfg 文件,添加下面内容:
authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider
jaasLoginRenew=3600000
将修改的上面文件同步到其他节点:cdh2、cdh3:
xsync /bigdata/zookeeper-3.4.14/conf/zoo.cfg
2.1.3 创建 JAAS 配置文件
在 cdh1 的配置文件目录创建 jaas.conf 文件,内容如下:
[root@cdh1 zookeeper-3.4.14]# cat conf/jaas.conf
Server {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
keyTab="/etc/security/keytabs/zookeeper.keytab"
storeKey=true
useTicketCache=false
principal="zookeeper/cdh1.itcast.cn@ITCAST.CN";
};
Client {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
keyTab="/etc/security/keytabs/zkcli.keytab"
storeKey=true
useTicketCache=false
principal="zkcli/cdh1.itcast.cn@ITCAST.CN";
};
同样,在 cdh2 和 cdh3 节点也创建该文件,注意每个节点的 principal 有所不同。
然后,在 /etc/zookeeper/conf/ 目录创建 java.env,内容如下:
[root@cdh1 zookeeper-3.4.14]# cat conf/java.env
export JVMFLAGS="-Djava.security.auth.login.config=/bigdata/zookeeper-3.4.14/conf/jaas.conf"
重启测试zk是否正常启动:
sh start.sh
查看zk状态
[root@cdh1 zookeeper-3.4.14]# sh status.sh
ZooKeeper JMX enabled by default
Using config: /bigdata/zookeeper-3.4.14/bin/../conf/zoo.cfg
`Mode: follower`
ZooKeeper JMX enabled by default
Using config: /bigdata/zookeeper-3.4.14/bin/../conf/zoo.cfg
`Mode: leader`
ZooKeeper JMX enabled by default
Using config: /bigdata/zookeeper-3.4.14/bin/../conf/zoo.cfg
`Mode: follower`
测试客户端:
创建一个 znode 节点并查看:
[zk: cdh1:2181(CONNECTED) 0] create /znode1 sasl:zkcli/cdh1.itcast.cn@ITCAST.CN:cdwra
Created /znode1
[zk: cdh1:2181(CONNECTED) 1] getAcl /znode1
'world,'anyone
: cdrwa
注意:这是大坑啊,坑了我好几天
1、在jaas.conf文件中,principal主体错误,正确的主体名称格式: `zookeeper/<hostname>@<realm>`
2、当采用zkCli.sh 的方式请求中,默认的host应该是localhost,因此在kdc中才会发现客户端的请求和 zookeeper/localhost@NETEASE.COM 这个principal进行认证,但是在kerberos的database中却没有这个principal。
解决方法: 使用`zkCli.sh -server host:port` 访问。 同时zookeeper配置文件中sever部分的principal必须为`zookeeper/<hostname>@<your realm>`
3.zookeeper/<hostname>@<your realm>其中hostname`不能用_HOST`代替,不起作用