术语解释
为了方便阅读理解,规范以下术语
- 主节点:master节点
- 非主节点:worker节点
为什么启用kerberos
CDH6.3.2集群部署2—集群安装 完成后服务没有安全认证
详情可参考:CDH6.3.2之Kerberos安全认证(二)
安装及配置kerberos
安装kerberos
#在master节点上执行
yum install -y krb5-server krb5-workstation krb5-libs
#在worker节点上执行
yum install -y krb5-workstation krb5-libs krb5-devel-1.15.1-46.el7.x86_64
- 验证kerberos是否都安装成功了
rpm -qa | grep krb5
配置kerberos
- 修改配置文件
#备份配置文件
#在master节点执行
cp /var/kerberos/krb5kdc/kdc.conf /var/kerberos/krb5kdc/kdc.conf.bak
#在所有节点执行
cp /etc/krb5.conf /etc/krb5.conf.bak
在master节点配置/var/kerberos/krb5kdc/kdc.conf文件,内容如下
[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88
[realms]
HADOOP.COM = {
#master_key_type = aes256-cts
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
max_life = 1d
max_renewable_life = 7d
supported_enctypes = aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
}
在所有节点配置/etc/krb5.conf,内容如下
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
default_realm = HADOOP.COM
# default_ccache_name = KEYRING:persistent:%{uid}
[realms]
HADOOP.COM = {
kdc = dbnode1
admin_server = dbnode1
}
[domain_realm]
# .example.com = EXAMPLE.COM
# example.com = EXAMPLE.COM
- 初始化KDC数据库
master节点执行
kdb5_util create -s
- 修改管理员权限配置文件
在master节点执行
#将EXAMPLE改成HADOOP
vi /var/kerberos/krb5kdc/kadm5.acl
- 启动Kerberos相关服务
在master节点执行
#启动KDC
systemctl start krb5kdc
#启动Kadmin,该服务为KDC数据库访问入口
systemctl start kadmin
#设置KDC和Kadmin开机自启
systemctl enable krb5kdc
systemctl enable kadmin
CDH集群启用Kerberos
- 为CM创建Kerberos管理员主体
master节点执行
kadmin.local -q "addprinc cloudera-scm/admin"
- 启用Kerberos
登录Cloudera Manager
- 环境确认(勾选全部)
- 填写KDC配置
- 填写主体名(cloudera-scm/admin)和密码
- 导入KDC
- 启用Kerberos命令
- 等待重启集群
- 完成