CentOS7部署MIT Kerberos

邢为栋

已于 2022-04-15 11:18:00 修改

阅读量601

点赞数

分类专栏： Bigdata 文章标签：安全

于 2020-09-04 17:08:27 首次发布

本文链接：https://blog.csdn.net/xwd127429/article/details/108407873

版权

Bigdata 专栏收录该内容

79 篇文章

订阅专栏

本文详细介绍如何在Linux环境下部署Kerberos认证服务，包括主机名设置、软件安装、配置文件调整、数据库创建及守护进程启动等关键步骤。

摘要由CSDN通过智能技术生成

准备

主机名必须是FQDN形式，修改主机名为krb.bigdata.zxxk.com

hostnamectl set-hostname krb.bigdata.zxxk.com

/etc/hosts配置：

127.0.0.1  localhost
10.1.25.31  krb.bigdata.zxxk.com krb

部署

安装

yum install krb5-server krb5-libs krb5-workstation

配置

编辑 /etc/krb5.conf 文件，调整如下：

# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
 pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
 default_realm = BIGDATA.ZXXK.COM
 default_ccache_name = KEYRING:persistent:%{uid}

[realms]
# EXAMPLE.COM = {
#  kdc = kerberos.example.com
#  admin_server = kerberos.example.com
# }
  BIGDATA.ZXXK.COM = {
   kdc = utility1.bigdata.zxxk.com
   admin_server = utility1.bigdata.zxxk.com
  }

[domain_realm]
# .example.com = EXAMPLE.COM
# example.com = EXAMPLE.COM
  .bigdata.zxxk.com = BIGDATA.ZXXK.COM
  bigdata.zxxk.com = BIGDATA.ZXXK.COM

编辑 /var/kerberos/krb5kdc/kdc.conf 文件，调整如下：

[kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88

[realms]
 BIGDATA.ZXXK.COM = {
  kadmind_port = 749
  max_life = 12h 0m 0s
  max_renewable_life = 7d 0h 0m 0s
  master_key_type = aes256-cts
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
 }

[logging]
 # By default, the KDC and kadmind will log output using
 # syslog.  You can instead send log output to files like this:
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmin.log
 default = FILE:/var/log/krb5lib.log

创建KDC数据库

kdb5_util create -r BIGDATA.ZXXK.COM -s

创建管理员

执行kadmin.local进入管理交互程序，创建管理员如下：

addprinc admin/admin@BIGDATA.ZXXK.COM

启动Kerberos守护进程

systemctl start krb5kdc
systemctl start kadmin
systemctl enable krb5kdc
systemctl enable kadmin

Kerberos client配置

yum install krb5-libs krb5-workstation

将server端的 /etc/krb5.conf 文件同步到client端。