本文已参与「新人创作礼」活动，一起开启掘金创作之路。
主机列表
| 主机名称 | IP | 硬件配置 |
|---|---|---|
| pass-eda-hdp-001 | 10.218.1x.14 | 80 Core、256 G |
| pass-eda-hdp-003 | 10.2x8.12.18 | 80 Core、256 G |
软件清单
| 软件名称 | 版本号 | 备注 |
|---|---|---|
| krb5-server | 1.15.1 | |
| krb5-workstation | 1.15.1 | 主备之间同步数据文件用 |
主机规划
| 主机 | 角色 | 软件 |
|---|---|---|
| 10.218.12.14 | 主 | krb5-server |
| 10.218.12.18 | 备 | krb5-workstation |
安装部署
服务安装
在两台机器上面分别安装kerberos服务。此处只安装服务，暂不做相应配置及启动服务。
yum install krb5-server krb5-workstation -y
修改配置
这里配置文件均在主备两台同时修改。
配置/etc/krb5.conf
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
default_realm = HLJ.CTC
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
HLJ.CTC = {
kdc = pass-eda-hdp-001
kdc = pass-eda-hdp-003
admin_server = pass-eda-hdp-001
}
[domain_realm]
.hlj.ctc = HLJ.CTC
hlj.ctc = HLJ.CTC
说明：
HLJ.CTC是设定的realms。Kerberos可以支持多个realms，大小写敏感，一般为了识别使用全部大写。
kdc代表kdc服务的地址。格式是机器名:端口，端口可以不写默认88。有多少kdc就写几行(admin_server同理)。
配置 /var/kerberos/krb5kdc/kdc.conf
sed -i "s/EXAMPLE.COM/HLJ.CTC/g" /var/kerberos/krb5kdc/kdc.conf
[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88
[realms]
HLJ.CTC = {
#master_key_type = aes256-cts
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
}
配置/var/kerberos/krb5kdc/kadm5.acl
sed -i "s/EXAMPLE.COM/HLJ.CTC/g" /var/kerberos/krb5kdc/kadm5.acl
*/admin@HLJ.CTC *
创建数据库
kdb5_util create -s
拷贝密钥文件
scp -p /var/kerberos/krb5kdc/.k5.CHI.CN pass-bigdata-hadoop-009:/var/kerberos/krb5kdc
]()
创建同步账号
kadmin.local -q "addprinc -randkey host/pass-eda-hdp-001"
kadmin.local -q "addprinc -randkey host/pass-eda-hdp-003"
kadmin.local -q "ktadd host/pass-eda-hdp-001"
kadmin.local -q "ktadd host/pass-eda-hdp-003"
拷贝文件keytab文件
scp -p /etc/krb5.keytab pass-eda-hdp-003:/etc/
声明同步账户(从)
注意主节点上不能有该文件，否则kadmin服务无法启动，会报错：Error. This appears to be a slaveserver, found kpropd.acl。
配置/var/kerberos/krb5kdc/kpropd.acl
host/pass-eda-hdp-001@HLJ.CTC
host/pass-eda-hdp-003@HLJ.CTC
启动Kprop服务(从)
systemctl enable kprop
systemctl start kprop
同步数据库(主)
在主节点dump数据文件。
kdb5_util dump /var/kerberos/krb5kdc/slave_datatrans
启动主节点kerberos服务。
systemctl start krb5kdc
同步数据库文件。
kprop -d pass-eda-hdp-003
Database propagation to pass-eda-hdp-003: SUCCEEDED
pass-eda-hdp-003 上日志
[root@kdcslave ~]# kpropd -dS
ready
waiting for a kprop connection
Connection from kdcmaster
krb5_recvauth(4, kprop5_01, host/kdcslave@HAOHAOZHU.COM, ...)
authenticated client: host/kdcmaster@HAOHAOZHU.COM (etype == Triple DES cbc mode with HMAC/sha1)
Full propagation transfer started.
Full propagation transfer finished.
calling kdb5_util to load database
Load PID is 3565
Database load process for full propagation completed.
waiting for a kprop connection
添加自动同步任务
echo -e "* * * * * root kdb5_util dump /var/kerberos/krb5kdc/slave_datatrans && kprop -d pass-eda-hdp-003" >> /etc/cron.d/sync_krb5
systemctl restart crond
sync_db.sh
#!/bin/sh
kdclist="kdcslave"
echo `date`"start to sync!"
sudo kdb5_util dump /var/kerberos/krb5kdc/slave_datatrans
for kdc in $kdclist;
do
sudo kprop -f /var/kerberos/krb5kdc/slave_datatrans $kdc
done
echo `date`"end to sync!"
添加执行权限
chmod +x sync_db.sh
添加定时任务
crontab -e
*/1 * * * * /root/sync_db.sh >> /root/sync.log
启动从节点
systemctl start krb5kdc
启动Kadmin服务
systemctl start kadmin
测试
添加测试账号
sudo kadmin.local -q "addprinc -pw test test/admin"
停止主节点kdc服务
systemctl stop krb5kdc
登陆测试账号
kadmin -p test/admin
Authenticating as principal test/admin with password.
Password for test/admin@HADOOP.COM:
kadmin.local验证
[root@pass-eda-hdp-003 krb5kdc]# kadmin.local
Authenticating as principal root/admin@HLJ.CTC with password.
kadmin.local: listprincs
K/M@HLJ.CTC
host/pass-eda-hdp-001@HLJ.CTC
host/pass-eda-hdp-003@HLJ.CTC
kadmin/admin@HLJ.CTC
kadmin/changepw@HLJ.CTC
kadmin/pass-eda-hdp-001@HLJ.CTC
kiprop/pass-eda-hdp-001@HLJ.CTC
krbtgt/HLJ.CTC@HLJ.CTC
test/admin@HLJ.CTC
kadmin.local: exit
安装脚本
installKerberos.sh
#! /bin/bash
master=BigdataManager-2
slave=BigdataManager-3
realm=XJYB.ZZQ
realmmin=xjyb.zzq
#安装kerberos
yum install krb5-server krb5-workstation -y
ssh $slave yum install krb5-server krb5-workstation -y
#修改配置并复制到从节点
sed -i "s/EXAMPLE.COM/$realm/g" /etc/krb5.conf
sed -i "s/example.com/$realmmin/g" /etc/krb5.conf
sed -i "/$realm = {/,/}/s|}| kdc = $slave\n}|" /etc/krb5.conf
scp /etc/krb5.conf $slave:/etc
sed -i "s/EXAMPLE.COM/$realm/g" /var/kerberos/krb5kdc/kdc.conf
scp /var/kerberos/krb5kdc/kdc.conf $slave:/var/kerberos/krb5kdc/
sed -i "s/EXAMPLE.COM/$realm/g" /var/kerberos/krb5kdc/kadm5.acl
scp /var/kerberos/krb5kdc/kadm5.acl $slave:/var/kerberos/krb5kdc/
#初始化数据库
kdb5_util create -s
scp /var/kerberos/krb5kdc/.k5.$realm $slave:/var/kerberos/krb5kdc/
#kylin10 需要
systemctl start sssd-kcm
#创建同步账号
kadmin.local -q "addprinc -randkey host/$master"
kadmin.local -q "addprinc -randkey host/$slave"
kadmin.local -q "ktadd host/$master"
kadmin.local -q "ktadd host/$slave"
scp -p /etc/krb5.keytab $slave:/etc/
#从节点启动Kprop服务
echo "host/$master@$realm" > /var/kerberos/krb5kdc/kpropd.acl
echo "host/$slave@$realm" >> /var/kerberos/krb5kdc/kpropd.acl
scp /var/kerberos/krb5kdc/kpropd.acl $slave:/var/kerberos/krb5kdc/
ssh $slave systemctl enable kprop
ssh $slave systemctl start kprop
#同步数据库
kdb5_util dump /var/kerberos/krb5kdc/slave_datatrans
systemctl start krb5kdc
kprop -d $slave
#ssh $slave kprop -f /var/kerberos/krb5kdc/slave_datatrans $slave
#ssh $slave kprop -d $slave
kylin10
#! /bin/bash
master=BigdataManager-2
slave=BigdataManager-3
master=`echo $master|tr 'A-Z' 'a-z'`
slave=`echo $slave|tr 'A-Z' 'a-z'`
realm=ZGYJ.COM
realmmin=zgyj.com
#kylin10 replica_datatrans
datatrans=replica_datatrans
#安装kerberos
yum install krb5-* -y
ssh $slave yum install krb5-* -y
#修改配置并复制到从节点
sed -i "s/EXAMPLE.COM/$realm/g" /etc/krb5.conf
sed -i "s/example.com/$realmmin/g" /etc/krb5.conf
sed -i "/$realm = {/,/}/s|}| kdc = $slave\n}|" /etc/krb5.conf
scp /etc/krb5.conf $slave:/etc
sed -i "s/EXAMPLE.COM/$realm/g" /var/kerberos/krb5kdc/kdc.conf
scp /var/kerberos/krb5kdc/kdc.conf $slave:/var/kerberos/krb5kdc/
sed -i "s/EXAMPLE.COM/$realm/g" /var/kerberos/krb5kdc/kadm5.acl
scp /var/kerberos/krb5kdc/kadm5.acl $slave:/var/kerberos/krb5kdc/
#初始化数据库
kdb5_util create -s
scp /var/kerberos/krb5kdc/.k5.$realm $slave:/var/kerberos/krb5kdc/
#kylin10 需要
systemctl start sssd-kcm
#创建同步账号
kadmin.local -q "addprinc -randkey host/$master"
kadmin.local -q "addprinc -randkey host/$slave"
kadmin.local -q "ktadd host/$master"
kadmin.local -q "ktadd host/$slave"
scp -p /etc/krb5.keytab $slave:/etc/
#从节点启动Kprop服务
echo "host/$master@$realm" > /var/kerberos/krb5kdc/kpropd.acl
echo "host/$slave@$realm" >> /var/kerberos/krb5kdc/kpropd.acl
scp /var/kerberos/krb5kdc/kpropd.acl $slave:/var/kerberos/krb5kdc/
rm -rf /var/kerberos/krb5kdc/kpropd.acl
ssh $slave systemctl enable kprop
ssh $slave systemctl start kprop
#同步数据库
kdb5_util dump /var/kerberos/krb5kdc/$datatrans
systemctl start krb5kdc
kprop -d $slave
#ssh $slave kprop -f /var/kerberos/krb5kdc/$datatrans $slave
#ssh $slave kprop -d $slave
keytab 文件如下方式生成
sudo kadmin.local -q "addprinc -pw ocdp ocdp@HLJ.CTC"
sudo kadmin -padmin/admin -wadmin -q"xst -k /home/ocdp/ocdp.keytab ocdp@HLJ.CTC"
远程连接添加用户
#/usr/bin/kadmin, -s, 10.4.75.32:749, -p, jzy/admin@GROUPB.HADOOP.CN, -w, jzy, -r, GROUPB.HADOOP.CN, -q, add_principal -pw "a1b2c3d4" test1@GROUPB.HADOOP.CN
sudo kadmin -s 10.4.75.32:749 -p jzy/admin@GROUPB.HADOOP.CN -w jzy -r GROUPB.HADOOP.CN
