kerberos安装
下载包
服务端
yum install krb5-server krb5-devel -y
客户端
yum install krb5-workstation krb5-devel -y
修改配置文件
cat /etc/krb5.conf
# Configuration snippets may be placed in this directory as well
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = BDE.CN
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 365d
#renew_lifetime = 365d
forwardable = true
rdns = false
#pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
#spake_preauth_groups = edwards25519
udp_preference_limit = 1
default_ccache_name = /tmp/krb5cc_%{uid}
#default_ccache_name = KEYRING:persistent:%{uid}
[realms]
BDEC.COM = {
kdc = node13.bde.cn:88
master_kdc = node13.bde.cn:88
admin_server = node13.bde.cn:749
default_domain = bde.cn
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
# EXAMPLE.COM = {
# kdc = kerberos.example.com
# admin_server = kerberos.example.com
# }
[domain_realm]
.bde.cn = BDE.CN
bde.cn = BDE.CN
node13.bde.cn = BDE.CN
cat /var/kerberos/krb5kdc/kdc.conf
[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88
[realms]
BDE.CN = {
#master_key_type = aes256-cts
max_life = 365d
max_renewable_life = 365d
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
}
cat /var/kerberos/krb5kdc/kadm5.acl
*/admin@BDE.CN *
初始化数据库
kdb5_util create -r BDE.CN -s
输入密码12345678
启动服务
systemctl start krb5kdc
systemctl enable krb5kdc
systemctl start kadmin
systemctl enable kadmin
创建principal
kadmin.local -q "addprinc -randkey HTTP/node190.bde.cn"
kadmin.local -q "addprinc -randkey HTTP/node191.bde.cn"
kadmin.local -q "addprinc -randkey HTTP/node209.bde.cn"
kadmin.local -q "addprinc -randkey yarn/node189.bde.cn"
kadmin.local -q "addprinc -randkey yarn/node190.bde.cn"
kadmin.local -q "addprinc -randkey yarn/node191.bde.cn"
kadmin.local -q "addprinc -randkey hdfs/node189.bde.cn"
kadmin.local -q "addprinc -randkey hdfs/node190.bde.cn"
kadmin.local -q "addprinc -randkey hdfs/node191.bde.cn"
kadmin.local -q "addprinc -randkey httpfs/node189.bde.cn"
kadmin.local -q "addprinc -randkey httpfs/node190.bde.cn"
kadmin.local -q "addprinc -randkey httpfs/node191.bde.cn"
生成keytab
kadmin.local
ktadd -k hadoop.keytab httpfs/node191.bde.cn httpfs/node190.bde.cn ........