Oracle/Kerberos验证异机SQLPlus免密访问

接《Oracle/Kerberos验证SSH访问》《Oracle/Kerberos验证本地SQLPlus访问》

案例二：配置在异机KCT上通过SQLPlus连接KO2

三、配置SQL使用Kerberos登录
1、把KDC上抽取的Key table传输并部署KCT上

# 把keytab从KDC传输到KCT
[root@kdc ~]# scp /tmp/keytab root@kct.testko.com:/tmp
[root@kct ~]# chown oracle:oinstall /tmp/keytab
# 转换Key table
[root@kct ~]# mv /tmp/keytab /etc/v5srvtab

3、确认KO2上数据库初始参数：$ORACLE_HOME/dbs/init.ora已经修改为OS_AUTHENT_PREFIX=’’
4、配置KO2上Oracle Net Services： $ORACLE_HOME/network/admin/sqlnet.ora

# sqlnet.ora Network Configuration File: /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/sqlnet.ora
# Generated by Oracle configuration tools.
SQLNET.KERBEROS5_REALMS = /etc/krb.realms
SQLNET.KERBEROS5_CONF_MIT=TRUE
SQLNET.AUTHENTICATION_SERVICES= (BEQ, TCPS, KERBEROS5)
SQLNET.KERBEROS5_CONF = /etc/krb5.conf
SQLNET.AUTHENTICATION_KERBEROS5_SERVICE = oracle
SQLNET.KERBEROS5_CC_NAME=/usr/tmp/krbcache
ADR_BASE = /u01/app/oracle

5、配置KCT上TNSNAME： $ORACLE_HOME/network/admin/tnsnames.ora

# tnsnames.ora Network Configuration File: /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/tnsnames.ora
# Generated by Oracle configuration tools.

ORACLE =
  (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCP)(HOST = ko2.testko.com)(PORT = 1521))
    (CONNECT_DATA =
      (SERVER = DEDICATED)
      (SERVICE_NAME = orcl)
    )
  )

6、修改KCT上/etc/krb5.conf，添加

[libdefaults]
...
kdc_timesync = 1
ccache_type = 4

7、KDC上创建Kerberos User

[root@kdc ~]# kadmin.local
kadmin.local: addprinc testuser

8、KO2上创建Externally Authenticated Oracle User

sys@ORCL> CREATE USER "TESTUSER@TESTKO.COM" IDENTIFIED EXTERNALLY; 
sys@ORCL> GRANT CREATE SESSION TO "TESTUSER@TESTKO.COM"; 

9、初始化凭据

[oracle@kct ~]$ okinit testuser
[oracle@kct ~]$ oklist -f
Kerberos Utilities for Linux: Version 11.2.0.4.0 - Production on 26-MAY-2021 13:41:41
Copyright (c) 1996, 2013 Oracle.  All rights reserved.
Ticket cache: /usr/tmp/krbcache
Default principal: testuser@TESTKO.COM
   Valid Starting           Expires            Principal
26-May-2021 13:41:33  26-May-2021 21:41:31  krbtgt/TESTKO.COM@TESTKO.COM        Flags: I

10、登录

sqlplus /@oracle
[oracle@kct ~]$ sqlplus /@oracle
SQL*Plus: Release 11.2.0.4.0 Production on Wed May 26 13:42:08 2021
Copyright (c) 1982, 2013, Oracle.  All rights reserved.
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
testuser@testko.com@ORCL>show user;
USER is "TESTUSER@TESTKO.COM"