CDH6.3.2集群部署3—启用kerberos

术语解释

为了方便阅读理解，规范以下术语

• 主节点：master节点
• 非主节点：worker节点

为什么启用kerberos

CDH6.3.2集群部署2—集群安装 完成后服务没有安全认证
详情可参考：CDH6.3.2之Kerberos安全认证（二）

安装及配置kerberos

安装kerberos

#在master节点上执行
yum install -y krb5-server krb5-workstation krb5-libs
#在worker节点上执行
yum install -y krb5-workstation krb5-libs krb5-devel-1.15.1-46.el7.x86_64

• 验证kerberos是否都安装成功了rpm -qa | grep krb5
  
  
  

配置kerberos

1. 修改配置文件

#备份配置文件
#在master节点执行
cp /var/kerberos/krb5kdc/kdc.conf /var/kerberos/krb5kdc/kdc.conf.bak
#在所有节点执行
cp /etc/krb5.conf /etc/krb5.conf.bak

在master节点配置/var/kerberos/krb5kdc/kdc.conf文件，内容如下

[kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88

[realms]
 HADOOP.COM = {
  #master_key_type = aes256-cts
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  max_life = 1d
  max_renewable_life = 7d
  supported_enctypes = aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
 }

在所有节点配置/etc/krb5.conf，内容如下

# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
 pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
 default_realm = HADOOP.COM
# default_ccache_name = KEYRING:persistent:%{uid}

[realms]
 HADOOP.COM = {
  kdc = dbnode1
  admin_server = dbnode1
 }

[domain_realm]
# .example.com = EXAMPLE.COM
# example.com = EXAMPLE.COM

2. 初始化KDC数据库
   master节点执行

kdb5_util create -s

3. 修改管理员权限配置文件
   在master节点执行

#将EXAMPLE改成HADOOP
vi /var/kerberos/krb5kdc/kadm5.acl

5. 启动Kerberos相关服务
   在master节点执行

#启动KDC
systemctl start krb5kdc
#启动Kadmin，该服务为KDC数据库访问入口
systemctl start kadmin
#设置KDC和Kadmin开机自启
systemctl enable krb5kdc
systemctl enable kadmin

CDH集群启用Kerberos

1. 为CM创建Kerberos管理员主体
   master节点执行

kadmin.local -q "addprinc cloudera-scm/admin"

2. 启用Kerberos
   登录Cloudera Manager
   
3. 环境确认（勾选全部）
   
4. 填写KDC配置
   
   
5. 填写主体名(cloudera-scm/admin)和密码
   
6. 导入KDC
   
7. 启用Kerberos命令
   
8. 等待重启集群
   
9. 完成