kerberos安装：
1.配置hosts
2.选择一台机器安装kdc
yum install krb5-server krb5-libs krb5-auth-dialog
3.
配置kdc.conf
[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88
[realms]
EXAMPLE.COM = {
#master_key_type = aes256-cts
max_life = 1d
max_renewable_life = 7d
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
supported_enctypes = aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
default_principal_flags = +renewable, +forwardable
}
4.配置krb5.conf
[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_kdc = false
dns_lookup_realm = false
ticket_lifetime = 86400
renew_lifetime = 604800
forwardable = true
default_tgs_enctypes = rc4-hmac
default_tkt_enctypes = rc4-hmac
permitted_enctypes = rc4-hmac
udp_preference_limit = 1
max_life = 1d
max_renewable_life = 7d
[realms]
EXAMPLE.COM = {
kdc = test1
admin_server = test1
}
5.创建/初始化Kerberos database
/usr/sbin/kdb5_util create -s
6.
添加database administrator
/usr/sbin/kadmin.local -q
“addprinc admin/admin”
7.
为database administrator设置ACL权限
编辑/var/kerberos/krb5kdc/kadm5.acl ===
*/admin
@YOUR_REALM *
8.启动kdc相关服务
service krb5kdc start
service kadmin start
开机启动：
chkconfig krb5kdc on
chkconfig kadmin on
yum install krb5-workstation krb5-libs krb5-auth-dialog
注意：
不要用aes-256,aes-256加密需要额外jar包
问题
问题1：
Couldn’t renew kerberos ticket in order to work around Kerberos 1.8.1 issue. Please check that the ticket for ‘hue/test1@EXAMPLE.COM’ is still renewable:
问题2: java.sql.SQLException: Could not open client transport with JDBC Uri: jdbc:hive2://192.168.199.22:21050/;principal=impala/test1@EXAMPLE.COM: GSS initiate failed
解决：检查principal
问题3: 无法重建principal
解决： 删除
/var/kerberos/krb5kdc 下除 .acl .conf的所有文件，重新create
/var/kerberos/krb5kdc 下除 .acl .conf的所有文件，重新create
问题4：创建的principal无法生效
解决：使用admin用户登录，再创建
问题4： kerberos下jdbc连接
解决：keytab+krb5.conf，详见report-center代码
—命令
kinit认证：kinit -kt path-to-keytab principalName
版权声明：本文为huguoping830623原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。