kerberos安装测试

博客地址:http://www.fanlegefan.com
文章地址:http://www.fanlegefan.com/archives/kerberosinstall/

---

服务器列表

主机名	ip	role
work	192.168.1.115	master KDC
zuoyeji	192.168.1.116	kerberos_client

在work节点上安装KDC服务器搭建以及配置

yum install krb5-server.x86_64 krb5-libs.x86_64 krb5-workstation.x86_64 krb5

安装完后生成两个文件

/etc/krb5.conf ——>realm
/var/kerberos/krb5kdc/kdc.conf ——>domain.to.realm mappings

配置kdc.conf

[root@work etc]# vi /var/kerberos/krb5kdc/kdc.conf 
[kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88

[realms]
 XIAOMI.PRESTO = {
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  database_name = /var/kerberos/principal
  max_renewable_life = 7d
  supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
 }

• XIAOMI.PRESTO这个是realms，名字可以随便写
• acl_file配置了admin用户的权限，以后会讲到怎么配

配置krb5.conf

[root@work ~]$ vi /etc/krb5.conf

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = XIAOMI.PRESTO
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

[realms]
 XIAOMI.PRESTO = {
  kdc = xiaobin
  admin_server = xiaobin
 }

[domain_realm]
 .xiaomi.presto = XIAOMI.PRESTO
 xiaomi.presto = XIAOMI.PRESTO

初始化Kerberos Databases

[root@work ~]$ kdb5_util create -s -r XIAOMI.PRESTO

Loading random data
Initializing database '/var/kerberos/principal' for realm 'XIAOMI.PRESTO',
master key name 'K/M@XIAOMI.PRESTO'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key: 
Re-enter KDC database master key to verify: 

• [-s] 表示生成 stash file ，并在其中存储master server key（krb5kdc）
• [-r] 来指定一个realm name ， 当krb5.conf中定义了多个realm时使用
• 当 Kerberos database创建好之后，在 /var/kerberos/ 中可以看到生成的 principal相关文件

[root@work ~]$ ll /var/kerberos/
总用量 28
drwxr-xr-x. 2 root root  4096 7月  21 04:00 krb5kdc
-rw-------. 1 root root 16384 7月  29 23:46 principal
-rw-------. 1 root root  8192 7月  21 03:59 principal.kadm5
-rw-------. 1 root root     0 7月  21 04:00 principal.kadm5.lock
-rw-------. 1 root root     0 7月  29 23:46 principal.ok

添加 database administrator

我们需要为Kerberos database添加administrative principals (即能够管理database的principals)
—— 至少要添加1个principal来使得Kerberos的管理进程“kadmind”能够在网络上与程序kadmin进
行通讯。

[root@work ~]$ kadmin.local -q "addprinc admin/admin"
Authenticating as principal root/admin@XIAOMI.PRESTO with password.
WARNING: no policy specified for admin/admin@XIAOMI.PRESTO; defaulting to no policy
Enter password for principal "admin/admin@XIAOMI.PRESTO": 
Re-enter password for principal "admin/admin@XIAOMI.PRESTO": 
Principal "admin/admin@XIAOMI.PRESTO" created.

• 此处设置密码为admin

配置kadm5.acl

在KDC上我们需要编辑acl文件来设置权限，该acl文件的默认路径是
/var/kerberos/krb5kdc/kadm5.acl（也可以在文件kdc.conf中修改）。Kerberos的kadmind
daemon会使用该文件来管理对Kerberos database的访问权限。对于那些可能会对pincipal产生影
响的操作，acl文件也能控制哪些principal能操作哪些其他pricipals。

[root@work]# cat /var/kerberos/krb5kdc/kadm5.acl
*/admin@XIAOMI.PRESTO	*

acl_file:标注了admin的用户权限，需要用户自己创建。文件格式是
Kerberos_principal permissions [target_principal] [restrictions]
支持通配符等。最简单的写法是
/admin@XIAOMI.PRESTO *
代表名称匹配/admin@XIAOMI.PRESTO 都认为是admin，权限是 *。代表全部权限。

测试启动 Kerberos daemons

krb5kdc启动
service krb5kdc start
正在启动 Kerberos 5 KDC：                                  [确定]

kadmin启动
service kadmin start
正在启动 Kerberos 5 Admin Server：                         [确定]

注意：启动krb5kdc和kadmin的时候如果报错，尝试使用service krb5kdc start 这种方式

设置开机启动

chkconfig krb5kdc on
chkconfig kadmin on

查看进程

[root@work]# netstat -anpl|grep kadmin
tcp        0      0 0.0.0.0:749                 0.0.0.0:*                   LISTEN      1111/kadmind        
tcp        0      0 0.0.0.0:464                 0.0.0.0:*                   LISTEN      1111/kadmind        
tcp        0      0 :::749                      :::*                        LISTEN      1111/kadmind        
tcp        0      0 :::464                      :::*                        LISTEN      1111/kadmind        
udp        0      0 0.0.0.0:464                 0.0.0.0:*                               1111/kadmind        
udp        0      0 fe80::a00:27ff:fe4b:4faa:464 :::*                                    1111/kadmind        
[root@work]# netstat -anpl|grep kdc
tcp        0      0 0.0.0.0:88                  0.0.0.0:*                   LISTEN      1102/krb5kdc        
tcp        0      0 :::88                       :::*                        LISTEN      1102/krb5kdc        
udp        0      0 0.0.0.0:88                  0.0.0.0:*                               1102/krb5kdc        
udp        0      0 fe80::a00:27ff:fe4b:4faa:88 :::*                                    1102/krb5kdc

查看日志

[root@work]# tail -10f /var/log/krb5kdc.log 

在zuoyeji节点上配置Kerberos_client,并将master上的krb5.conf 覆盖client本地的/etc/krb5.conf文件

[root@zuoyeji ~]# yum install krb5-libs.x86_64 krb5-workstation.x86_64 krb5
[root@zuoyeji ~]# scp root@work:/etc/krb5.conf /etc/krb5.conf

---

kerberos常用操作

登录

• 在master节点上登录(KDC节点)，无需密码

[root@work]# kadmin.local 
Authenticating as principal admin/admin@XIAOMI.PRESTO with password.
kadmin.local:  

• 在client节点上登录，需要密码

[root@zuoyeji]# kinit admin/admin
Password for admin/admin@XIAOMI.PRESTO: 
[root@zuoyeji]# kadmin
Authenticating as principal admin/admin@XIAOMI.PRESTO with password.
Password for admin/admin@XIAOMI.PRESTO: 
kadmin:  q
[root@zuoyeji]# 

注意

1. 如果出现报错 kinit: Cannot contact any KDC for realm ‘ATHENA.MIT.EDU’ while getting initial credentials

• 可能因为KDC机器上的火墙
• 可能是hosts文件中没有解析
• 可能是路由配置
• 可能是局域网内ip冲突

对用户增删改查

在管理员的状态下使用 addprinc , delprinc , modprinc , listprincs 命令。使用?可以列出所有的命令。

1. 增加用户usertest

kadmin:  addprinc usertest
WARNING: no policy specified for usertest@XIAOMI.PRESTO; defaulting to no policy
Enter password for principal "usertest@XIAOMI.PRESTO": 
Re-enter password for principal "usertest@XIAOMI.PRESTO": 
Principal "usertest@XIAOMI.PRESTO" created.

2. 查看用户

kadmin:  list_principals 
K/M@XIAOMI.PRESTO
admin/admin@XIAOMI.PRESTO
kadmin/admin@XIAOMI.PRESTO
kadmin/changepw@XIAOMI.PRESTO
kadmin/xiaobin@XIAOMI.PRESTO
krbtgt/XIAOMI.PRESTO@XIAOMI.PRESTO
presto/presto-coordinator.xiaomi.presto@XIAOMI.PRESTO
presto@XIAOMI.PRESTO
qun/slave1@XIAOMI.PRESTO
qun@XIAOMI.PRESTO
test@XIAOMI.PRESTO
user1@XIAOMI.PRESTO
usertest@XIAOMI.PRESTO

3. 删除用户

kadmin:  delprinc usertest
Are you sure you want to delete the principal "usertest@XIAOMI.PRESTO"? (yes/no): yes
Principal "usertest@XIAOMI.PRESTO" deleted.
Make sure that you have removed this principal from all ACLs before reusing.

不使用交互窗口进行操作

1. 查询用户，需要输入密码

[root@zuoyeji]# kadmin -p admin/admin -q "list_principals"
Authenticating as principal admin/admin with password.
Password for admin/admin@XIAOMI.PRESTO: 
K/M@XIAOMI.PRESTO
admin/admin@XIAOMI.PRESTO
kadmin/admin@XIAOMI.PRESTO
kadmin/changepw@XIAOMI.PRESTO
kadmin/xiaobin@XIAOMI.PRESTO
krbtgt/XIAOMI.PRESTO@XIAOMI.PRESTO
presto/presto-coordinator.xiaomi.presto@XIAOMI.PRESTO
presto@XIAOMI.PRESTO
qun/slave1@XIAOMI.PRESTO
qun@XIAOMI.PRESTO
test@XIAOMI.PRESTO
user1@XIAOMI.PRESTO

生成keytab

可以理解为密钥cache。Keytab一般给service使用，这样service在认证自己或者给客户端认证的
时候，不用输入密钥。该文件是加密的，存储在服务器的本地磁盘上。Keytab文件的默认路径
是/etc/krb5.keytab。

kadmin:  ktadd test@XIAOMI.PRESTO
Entry for principal test@XIAOMI.PRESTO with kvno 4, encryption type aes256-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.
Entry for principal test@XIAOMI.PRESTO with kvno 4, encryption type aes128-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.
Entry for principal test@XIAOMI.PRESTO with kvno 4, encryption type des3-cbc-sha1 added to keytab FILE:/etc/krb5.keytab.
Entry for principal test@XIAOMI.PRESTO with kvno 4, encryption type arcfour-hmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal test@XIAOMI.PRESTO with kvno 4, encryption type des-hmac-sha1 added to keytab FILE:/etc/krb5.keytab.

Entry for principal test@XIAOMI.PRESTO with kvno 4, encryption type des-cbc-md5 added to keytab FILE:/etc/krb5.keytab.

• 生成keytab路径：/etc/krb5.keytab

[root@zuoyeji ~]$ ll /etc/krb5.keytab 
-rw------- 1 root root 346 7月  30 20:02 /etc/krb5.keytab

查看使用keytab登录

[root@zuoyeji]# klist -k
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   4 test@XIAOMI.PRESTO
   4 test@XIAOMI.PRESTO
   4 test@XIAOMI.PRESTO
   4 test@XIAOMI.PRESTO
   4 test@XIAOMI.PRESTO
   4 test@XIAOMI.PRESTO

[root@zuoyeji]# kinit -k -t /etc/krb5.keytab test@XIAOMI.PRESTO
[root@zuoyeji]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: test@XIAOMI.PRESTO

Valid starting     Expires            Service principal
07/30/17 20:09:12  07/31/17 20:09:12  krbtgt/XIAOMI.PRESTO@XIAOMI.PRESTO
	renew until 07/30/17 20:09:12

注意：

• 防火墙和selinux必须要关闭
• kdc和client的时钟要同步

相关链接

• http://www.cnblogs.com/xiaodf/p/5968178.html
• http://blog.csdn.net/wulantian/article/details/42173023
• http://joshuasabrina.iteye.com/blog/1895281