名词解释
Kerberos: Network Authentication protocol(网络认证协议)
KDC: Key Distribution center(密钥分配中心)
Kadmin: Kerberos Administrator(Kerberos管理)
我这边环境是docker 安装的单节点 Ambari
1配置/etc/hosts
在ip 后面加上kerberos-auth
127.0.0.1 localhost
172.18.0.3 sandbox-hdp.hortonworks.com sandbox-hdp kerberos-auth
2安装Kerberos
yum install krb5-server krb5-libs krb5-workstation -y
3配置Kerberos Server配置文件
[root@ambari-agent01 ~]$ cat /etc/krb5.conf
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h # 认证凭证生命周期
renew_lifetime = 7d # 认证凭证最长延期时限
forwardable = true
renewable = true
rdns = false
pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
default_realm = TEST.COM
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
TEST.COM = {
kdc = kerberos-auth # TEST.COM 域中的 KDC 接口 为我们刚才添加的主机名,下同
admin_server = kerberos-auth # TEST.COM 域中的 Admin Server 接口
}
[domain_realm]
.TEST.com = TEST.COM
TEST.com = TEST.COM
4管理帐号 ACL 配置
[root@ambari-agent01 ~]$ cat /var/kerberos/krb5kdc/kadm5.acl
*/admin@TEST.COM *
5初始化并创建 Kerberos 数据库
重新创建数据则是清空该 /ar/kerberos/krb5kdc/目录下principal相关文件,再重新执行一下命令
[root@ambari-agent01 ~]$ kdb5_util create -r TEST.COM -s
Loading random data
Initializing database '/var/kerberos/krb5kdc/principal' for realm 'TEST.COM',
master key name 'K/M@TEST.COM'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key: # 设置密码
Re-enter KDC database master key to verify: # 确认密码
6创建管理帐号 Principal
[root@ambari-agent01 krb5kdc]$ kadmin.local -q "addprinc admin/admin"
Authenticating as principal root/admin@TEST.COM with password.
WARNING: no policy specified for admin/admin@TEST.COM; defaulting to no policy
Enter password for principal "admin/admin@TEST.COM": # 设置管理帐号密码
Re-enter password for principal "admin/admin@TEST.COM": # 确认密码
Principal "admin/admin@TEST.COM" created.
7查看 Kerberos 数据库帐号列表
[root@ambari-agent01 krb5kdc]$ kadmin.local listprincs
K/M@TEST.COM
admin/admin@TEST.COM
kadmin/admin@TEST.COM
kadmin/ambari-agent01@TEST.COM
kadmin/changepw@TEST.COM
kiprop/ambari-agent01@TEST.COM
krbtgt/TEST.COM@TEST.COM
8启动 Kerberos-Server
systemctl start krb5kdc.service
9启动 Kadmin-Server
systemctl start kadmin.service
配置Ambari集成Kerberos,Ambari页面配置
配置并测试KDC连通性![Ambari2.6.2éæKerberos](https://i-blog.csdnimg.cn/blog_migrate/ea3f1fe422dbec47d6ca8b51cba87785.png)
配置测试kadmin连通性并继续
# 在 Admin Principal 和 Admin Password 中填入手动创建的管理帐号与帐号密码
# 创建的帐号为 admin/admin@TEST.COM 注意:账号输入不正确则会Test Kerberos Clients会报找不到databases
接下来按步骤安装即可完成!