Oracle/Kerberos验证SSH免密访问

一、基础环境

# 1、DNS Server正反解析（非hosts）
kdc.testko.com      192.168.1.253       KDC Server：CentOS7 
ko2.testko.com      192.168.1.232       Oracle Server：Oracle 11.2.0.4.210420:sid = orcl
kct.testko.com      192.168.1.233       Oracle Client
# 2、/etc/hosts
192.168.1.253 kdc.testko.com
192.168.1.232 ko2.testko.com
192.168.1.233 kct.testko.com
# 3、软件
yum install -y rng-tools ntp bind-utils
ntpdate 0.rhel.pool.ntp.org
systemctl start ntpd rngd
systemctl enable ntpd rngd
# 4、KDC Server：
yum install -y krb5-server krb5-libs
# 5、Oracle Server/Oracle Client
yum install -y krb5-workstation

所有服务器的主配置文件/etc/krb5.conf（均相同）

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
 pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
 default_realm = TESTKO.COM
 default_ccache_name = KEYRING:persistent:%{uid}

[realms]
 TESTKO.COM = {
 kdc = kdc.testko.com
 admin_server = kdc.testko.com
 }

[domain_realm]
 .testko.com = TESTKO.COM
  testko.com = TESTKO.COM

二、配置Kerberos：
一）KDC Server：

1、主配置文件：/etc/krb5.conf（上述）
2、KDC的两个配置文件

#1、 /var/kerberos/krb5kdc/kdc.conf
[kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88

[realms]
 TESTKO.COM = {
  #master_key_type = aes256-cts
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
 }

#2、 /var/kerberos/krb5kdc/kadm5.acl
*/admin@TESTKO.COM      *

3、配置KDC服务

# 1、创建KDC数据库
kdb5_util create -s -r TESTKO.COM
# 2、服务
systemctl start krb5kdc kadmin
systemctl enable krb5kdc kadmin
# 3.1、KDC本地登录Kerberos，创建管理员角色(root)和测试用户(oracle)
[root@kdc ~]# kadmin.local
kadmin.local: addprinc root/admin
kadmin.local: addprinc oracle
# 3.2、KDC本地登录Kerberos,给KDC服务器添加角色
kadmin.local: addprinc -randkey host/kdc.testko.com
kadmin.local: ktadd host/kdc.testko.com
kadmin.local: quit
# 查看
kadmin.local: listprincs

二）KDC Client（Oracle Server/Oracle Client）：
1、主配置文件：/etc/krb5.conf（上述）

2、配置Kerberos客户端

# 登录KDC,添加host角色
[root@ko2 ~]# kadmin -p root/admin
kadmin: addprinc -randkey host/ko2.testko.com
kadmin: ktadd host/ko2.testko.com
[root@kct ~]# kadmin -p root/admin
kadmin: addprinc -randkey host/kct.testko.com
kadmin: ktadd host/kct.testko.com

三）配置SSH使用Kerberos登录

# 1、每个Oracle S/C服务器上都存在系统用户oracle
# 2、KCT/KCO上修改SSH配置文件/etc/ssh/ssh_config（结尾添加）
echo "GSSAPIAuthentication yes" >> /etc/ssh/ssh_config
echo "GSSAPIDelegateCredentials yes" >> /etc/ssh/ssh_config
# 2、在当前用户oracle下初始化oracle的Kerberos凭据
# 角色oracle已经在Kerberos上创建（在配置KDC服务过程中已经添加）
# KCT登录KO1
[oracle@kct ~]$ kinit               # 首次获取凭据的时候需要执行一次
[oracle@kct ~]$ ssh ko1.testko.com
# 其他略