cdh启用kerberos配置

以下为客户端配置：

[root@test-vm1 ~]# vi /etc/krb5.conf

# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = FAYSON.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

[realms]
 FAYSON.COM = {
  kdc = 192.168.116.137
  admin_server = 192.168.116.137
 }

[domain_realm]
 .192.168.116.137 = FAYSON.COM
 192.168.116.137 = FAYSON.COM

以下为参考：

[ec2-user@ip-172-31-16-68 ~]$ sudo vim /etc/krb5.conf
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
default_realm = FAYSON.COM
#default_ccache_name = KEYRING:persistent:%{uid}
[realms]
FAYSON.COM = {
 kdc = ip-172-31-16-68.ap-southeast-1.compute.internal
 admin_server = ip-172-31-16-68.ap-southeast-1.compute.internal
}
[domain_realm]
.ap-southeast-1.compute.internal = FAYSON.COM
ap-southeast-1.compute.internal = FAYSON.COM

服务端权限控制：

[root@test-vm3 ~]# vi /var/kerberos/krb5kdc/kadm5.acl

*/admin@FAYSON.COM      *
~                            

服务端配置：

[root@test-vm3 ~]# vi /var/kerberos/krb5kdc/kdc.conf

[kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88

[realms]
 FAYSON.COM= {
  #master_key_type = aes256-cts
  max_renewable_life= 7d 0h 0m 0s
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  supported_enctypes = aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
 }

.创建Kerberos数据库

[ec2-user@ip-172-31-16-68 ~]$ sudo kdb5_util create -r FAYSON.COM -s
Loading random data
Initializing database '/var/kerberos/krb5kdc/principal' for realm 'FAYSON.COM',
master key name 'K/M@FAYSON.COM'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key:
Re-enter KDC database master key to verify:
[ec2-user@ip-172-31-16-68 ~]$

创建Kerberos的管理账号

 

[ec2-user@ip-172-31-16-68 ~]$ sudo kadmin.local
Authenticating as principal root/admin@FAYSON.COM with password.
kadmin.local:  addprinc admin/admin@FAYSON.COM
WARNING: no policy specified for admin/admin@FAYSON.COM; defaulting to no policy
Enter password for principal "admin/admin@FAYSON.COM":
Re-enter password for principal "admin/admin@FAYSON.COM":
Principal "admin/admin@FAYSON.COM" created.
kadmin.local:  exit
[ec2-user@ip-172-31-16-68 ~]$

 

将Kerberos服务添加到自启动服务，并启动krb5kdc和kadmin服务

 

[ec2-user@ip-172-31-16-68 ~]$ sudo systemctl enable krb5kdc
[ec2-user@ip-172-31-16-68 ~]$ sudo systemctl enable kadmin
[ec2-user@ip-172-31-16-68 ~]$ sudo systemctl start krb5kdc
[ec2-user@ip-172-31-16-68 ~]$ sudo systemctl start kadmin