cdh kerberos 安装

重建数据库:kdb5_util -r AQ.COM destroy

建数据库:kdb5_util create -r AQ.COM –s
master 安装

yum install krb5-server krb5-workstation krb5-libs krb5-devel krb5-authdialog
–y

worker安装

yum install krb5-workstation krb5-libs krb5-devel krb5-auth-dialog -y

kdc 服务器器涉及到三个配置⽂文件

/etc/krb5.conf
/var/kerberos/krb5kdc/kdc.conf
/var/kerberos/krb5kdc/kadm5.acl

/etc/krb5.conf

[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = AQ.COM
udp_preference_limit = 1
edp_pr_limit = 1
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 30d
renew_lifetime = 30d
max_life = 30d
[realms]
AQ.COM={
kdc=master
admin_server=master
}
[domain_realm]
.AQ.COM = AQ.COM
AQ.COM = AQ.COM
[appdefaults]

/var/kerberos/krb5kdc/kdc.conf

[kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88

[realms]
 AQ.COM = {
  #master_key_type = aes256-cts
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
 }

/var/kerberos/krb5kdc/kadm5.acl

*/admin@AQ.COM *

关于AES-256 加密

$JAVA_HOME/jre/lib/security
http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html
unzip

同步配置文件

scp -P 20822 /etc/krb5.conf worker-1:/etc/krb5.conf

创建数据库

kdb5_util create -r AQ.COM –s

启动服务

chkconfig --level 35 krb5kdc on
 chkconfig --level 35 kadmin on
service krb5kdc start
 service kadmin start

创建管理员并输入密码

kadmin.local -q "addprinc admin/admin"

在每个节点测试，成功进入，搭建成功

kinit admin/admin
kadmin

启动

chkconfig --level 35 krb5kdc on
 chkconfig --level 35 kadmin on
service krb5kdc start
 service kadmin start