开始安装
一、安装之前的注意点
关于AES-256加密:
对于使用 centos5. 6及以上的系统,默认使用 AES-256 来加密的。这就需要集群中的所有节点上安装 http://stackoverflow.com/questions/18754243/securityexception-even-after-replacing-crypto-policy-jars
要下载对应jdk版本的jce 页面直接搜索JCE 然后点进去进行下载文件
JDK8对应的 JCE版本是 jce_policy-8
下载的文件是一个 zip 包,解开后,将里面的两个文件放到下面的目录中:
$JAVA_HOME/jre/lib/security
并用scp的方式复制到集群每个节点
scp local_policy.jar US_export_policy.jar 10.10.2.24:/usr/java/jdk1.8.0_152/jre/lib/security
二、开始安装Kerberos
1、在Cloudera Manager服务器上安装KDC服务
yum -y install krb5-server krb5-libs krb5-auth-dialog krb5-workstation
2、修改/etc/krb5.conf配置
vim /etc/krb5.conf
下面的配置都打开 ,直接使用默认的例子配置即可
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
default_realm = HADOOP.COM
# default_ccache_name = KEYRING:persistent:%{uid}
#这边随便起的,可以是多个,但是会造成复杂度上升 与上面default_realm对应 默认即可 主机名:端口
[realms]
HADOOP.COM = {
kdc = cdh21:88
admin_server = cdh21:749
}
[domain_realm]
.hadoop.com = HADOOP.COM
hadoop.com = HADOOP.COM
3、修改/var/kerberos/krb5kdc/kadm5.acl配置 密码更改成与上述 default_realm对应,代表的是以这个为后缀的全部这样管理
[root@chd22]# vim /var/kerberos/krb5kdc/kadm5.acl
*/admin@HADOOP.COM *
4、修改/var/kerberos/krb5kdc/kdc.conf配置
realms与上面要对应
[root@cdh22]# vim /var/kerberos/krb5kdc/kdc.conf
[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88
[realms]
HADOO.COM = {
#master_key_type = aes256-cts
max_renewable_life= 7d 0h 0m 0s
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
}
5、创建Kerberos数据库 执行的域名就是上面起的 realms 密码设置自己备注下
[root@chd22]# kdb5_util create -s –r HADOOP.COM
Loading random data
Initializing database '/var/kerberos/krb5kdc/principal' for realm 'HADOOP.COM',
master key name 'K/M@HADOOP.COM'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key:
Re-enter KDC database master key to verify:
6、.创建Kerberos的管理账号
[root@cdh22]# kadmin.local
Authenticating as principal root/admin@HADOOP.COM with password.
kadmin.local: addprinc admin/admin@HADOOP.COM
WARNING: no policy specified for admin/admin@HADOOP.COM; defaulting to no policy
Enter password for principal "admin/admin@HADOOP.COM": 密码
Re-enter password for principal "admin/admin@HADOOP.COM": 密码
Principal "admin/admin@HADOOP.COM" created.
kadmin.local: exit
7、将Kerberos服务添加到自启动服务,并启动krb5kdc和kadmin服务
[root@cdh21]# systemctl enable krb5kdc
Created symlink from /etc/systemd/system/multi-user.target.wants/krb5kdc.service to /usr/lib/systemd/system/krb5kdc.service.
[root@cdh21]# systemctl enable kadmin
Created symlink from /etc/systemd/system/multi-user.target.wants/kadmin.service to /usr/lib/systemd/system/kadmin.service.
[root@cdh21]# systemctl start krb5kdc
[root@cdh21]# systemctl start kadmin
8、测试Kerberos的管理员账号 如果这边错误的话,可以回到上面看看那个步骤错误了,或者realms里面的KDC主机名设置错误
[root@cdh21]# kinit admin/admin@HADOOP.COM
Password for admin/admin@HADOOP.COM: 输入密码
[root@cdh21]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admin/admin@HADOOP.COM
Valid starting Expires Service principal
09/12/2018 12:54:17 09/13/2018 12:54:17 krbtgt/HADOOP.COM@HADOOP.COM
renew until 09/19/2018 12:54:17
9、为集群安装所有Kerberos客户端,包括Cloudera Manager,每个节点都安装一遍
[root@cdh21]# yum -y install krb5-libs krb5-workstation
10、在Cloudera Manager Server服务器上安装额外的包 主节点
[root@cdh21]# yum -y install openldap-clients
11、将配置好的KDC Server上的krb5.conf文件拷贝到所有Kerberos客户端 这边使用scp 方式
[root@ip-172-31-6-83 shell]# scp /etc/krb5.conf root@10.10.2.22:/etc
三、CDH集群启用Kerberos
1、在KDC中给Cloudera Manager添加管理员账号 这边创建的时候@后面跟的域名,都是在上面设置过的,保证一致
[root@cdh21]# kadmin.local
Authenticating as principal admin/admin@HADOOP.COM with password.
kadmin.local: addprinc cloudera/admin@HADOOP.COM
WARNING: no policy specified for cloudera/admin@HADOOP.COM; defaulting to no policy
Enter password for principal "cloudera/admin@HADOOP.COM":
Re-enter password for principal "cloudera/admin@HADOOP.COM":
Principal "cloudera/admin@HADOOP.COM" created.
kadmin.local: exit
2、在KDC中给Cloudera Manager添加管理员账号 这边创建的时候@后面跟的域名,都是在上面设置过的,保证一致
在集群安装的时候使用的是root用户,使用root用户初始化下面这个
在整个集群安装的时候使用的 Kerberos 管理用户 cloudera/admin@HADOOP.COM 通过 kinit cloudera/admin@HADOOP.COM 的方式确保 整个集群使用的 默认 的用户管理是这个用户
[root@cdh21]# kadmin.local
Authenticating as principal admin/admin@HADOOP.COM with password.
kadmin.local: addprinc cloudera/admin@HADOOP.COM
WARNING: no policy specified for cloudera/admin@HADOOP.COM; defaulting to no policy
Enter password for principal "cloudera/admin@HADOOP.COM":
Re-enter password for principal "cloudera/admin@HADOOP.COM":
Principal "cloudera/admin@HADOOP.COM" created.
kadmin.local: exit