博客

1 安装前准备

1.1 主机列表

本次实验选择2台主机，1台作为KDC master主机，1台作为KDC slaver

注意

：

• 关闭防火墙
• 开启NTP服务

2 安装Kerberos

2.1安装krb5

yum -y install krb5-libs krb5-server krb5-workstation

2.2配置krb

vim /etc/krb5.conf

# Configuration snippets may be placed in this directory as well

includedir /etc/krb5.conf.d/

[logging]

default = FILE:/var/log/krb5libs.log

kdc = FILE:/var/log/krb5kdc.log

admin_server = FILE:/var/log/kadmind.log

[libdefaults]

dns_lookup_realm = false

ticket_lifetime = 24h

renew_lifetime = 7d

forwardable = true

rdns = false

#default_realm = EXAMPLE.COM

#default_ccache_name = KEYRING:persistent:%{uid}

#ADD BY CC AT 20190408

default_realm = CCTEST.DEV

dns_lookup_realm = false

udp_preference_limit = 1

clockskew = 300

renewable = true

[realms]

# EXAMPLE.COM = {


#  kdc = kerberos.example.com

#  admin_server = kerberos.example.com

# }

#ADD BY CC AT 20190408

CCTEST.DEV = {


admin_server = ambari1:749

kdc = ambari1:88

kdc = ambari2:88

}

[domain_realm]

# .example.com = EXAMPLE.COM

# example.com = EXAMPLE.COM

#ADD BY CC AT 20190408

.cctest.dev = CCTEST.DEV

cctest.dev = CCTEST.DEV

配置项说明：


[logging]：日志输出设置 （可选）

[libdefaults]：连接的默认配置

default_realm：Kerberos应用程序的默认领域，所有的principal都将带有这个领域标志

ticket_lifetime： 表明凭证生效的时限，一般为24小时

renew_lifetime： 表明凭证最长可以被延期的时限，一般为一个礼拜。当凭证过期之后，对安全认证的服务的后续访问则会失败

clockskew：时钟偏差是不完全符合主机系统时钟的票据时戳的容差，超过此容差将不接受此票据。通常，将时钟扭斜设置为 300 秒（5 分钟）。这意味着从服务器的角度看，票证的时间戳与它的偏差可以是在前后 5 分钟内

udp_preference_limit= 1：禁止使用 udp 可以防止一个 Hadoop 中的错误

default_ccache_name：credential缓存名，默认值为

[realms]：列举使用的 realm

kdc：代表要 kdc 的位置。格式是 机器:端口

admin_server：代表 admin 的位置。格式是 机器:端口

default_domain：代表默认的域名

[domain_realm]：域名到realm的关系 （可选）

vim /var/kerberos/krb5kdc/kdc.conf

[kdcdefaults]

kdc_ports = 88

kdc_tcp_ports = 88

[realms]

# EXAMPLE.COM = {


#  #master_key_type = aes256-cts

#  acl_file = /var/kerberos/krb5kdc/kadm5.acl

#  dict_file = /usr/share/dict/words

#  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab

#  supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal

# }

CCTEST.DEV = {


master_key_type = aes256-cts

acl_file = /var/kerberos/krb5kdc/kadm5.acl

dict_file = /usr/share/dict/words

admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab

max_life = 24h

max_renewable_life = 10d

default_principal_flags= +renewable,+forwardable

supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal

}

配置项说明：


kdcdefaults：kdc相关配置，这里只设置了端口信息

realms：realms的配置

EXAMPLE.COM：设定的realms领域

master_key_type：和 supported_enctypes 默认使用 aes256-cts。JAVA 使用 aes256-cts 验证方式需要安装 JCE包(推荐不使用)

acl_file：标注了 admin 的用户权限，文件格式是：Kerberos_principal permissions [target_principal] [restrictions]

supported_enctypes：支持的校验方式

admin_keytab：KDC 进行校验的 keytab

vim /var/kerberos/krb5kdc/kadm5.acl

*/admin@CCTEST.DEV *

2.3 初始化krb databases

#kdb5_util create -r CCTEST.DEV -s

Loading random data

Initializing database ‘/var/kerberos/krb5kdc/principal’ for realm ‘CCTEST.DEV’,

master key name ‘K/M@CCTEST.DEV’

You will be prompted for the database Master Password.

It is important that you NOT FORGET this password.

Enter KDC database master key: cctest

说明：


[-s]表示生成stash file，并在其中存储master server key（krb5kdc）

[-r]来指定一个realm name —— 当krb5.conf中定义了多个realm时才是必要的。

如果需要重建数据库，将/var/kerberos/krb5kdc目录下的principal相关的文件删除即可

2.4 添加database administrator

#kadmin.local -q “addprinc admin/admin”

Authenticating as principal root/admin@CCTEST.DEV with password.

WARNING: no policy specified for admin/admin@CCTEST.DEV; defaulting to no policy

Enter password for principal “admin/admin@CCTEST.DEV”: admincc

Re-enter password for principal “admin/admin@CCTEST.DEV”: admincc

Principal “admin/admin@CCTEST.DEV” created.

2.5 启动krb

systemctl start krb5kdc

systemctl start kadmin

systemctl enable krb5kdc

systemctl enable kadmin

2.6 登录测试

#kadmin -p admin/admin@CCTEST.DEV

Authenticating as principal admin/admin@CCTEST.DEV with password.

Password for admin/admin@CCTEST.DEV:

kadmin:  ?

Available kadmin requests:

add_principal, addprinc, ank    Add principal

delete_principal, delprinc     Delete principal

modify_principal, modprinc    Modify principal

rename_principal, renprinc    Rename principal

change_password, cpw     Change password

get_principal, getprinc  Get principal

list_principals, listprincs, get_principals, getprincs        List principals

add_policy, addpol       Add policy

modify_policy, modpol    Modify policy

delete_policy, delpol    Delete policy

get_policy, getpol       Get policy

list_policies, listpols, get_policies, getpols      List policies

get_privs, getprivs      Get privileges

ktadd, xst               Add entry(s) to a keytab

ktremove, ktrem          Remove entry(s) from a keytab

lock                     Lock database exclusively (use with extreme caution!)

unlock                   Release exclusive database lock

purgekeys                Purge previously retained old keys from a principal

get_strings, getstrs     Show string attributes on a principal

set_string, setstr       Set a string attribute on a principal

del_string, delstr       Delete a string attribute on a principal

list_requests, lr, ?     List available requests.

quit, exit, q            Exit program.

kadmin:  list_principals

K/M@CCTEST.DEV

admin/admin@CCTEST.DEV

kadmin/admin@CCTEST.DEV

kadmin/ambari1@CCTEST.DEV

kadmin/changepw@CCTEST.DEV

kiprop/ambari1@CCTEST.DEV

krbtgt/CCTEST.DEV@CCTEST.DEV

2.7 创建host keytab 文件

#kadmin.local

kadmin.local:  addprinc -randkey host/ambari1  #添加principal

WARNING: no policy specified for host/ambari1@CCTEST.DEV; defaulting to no policy

Principal “host/ambari1@CCTEST.DEV” created.

kadmin.local:  ktadd host/ambari1 #生成keytab文件

Entry for principal host/ambari1 with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.

Entry for principal host/ambari1 with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.

Entry for principal host/ambari1 with kvno 2, encryption type des3-cbc-sha1 added to keytab FILE:/etc/krb5.keytab.

Entry for principal host/ambari1 with kvno 2, encryption type arcfour-hmac added to keytab FILE:/etc/krb5.keytab.

Entry for principal host/ambari1 with kvno 2, encryption type camellia256-cts-cmac added to keytab FILE:/etc/krb5.keytab.

Entry for principal host/ambari1 with kvno 2, encryption type camellia128-cts-cmac added to keytab FILE:/etc/krb5.keytab.

Entry for principal host/ambari1 with kvno 2, encryption type des-hmac-sha1 added to keytab FILE:/etc/krb5.keytab.

Entry for principal host/ambari1 with kvno 2, encryption type des-cbc-md5 added to keytab FILE:/etc/krb5.keytab.

kadmin.local:  addprinc -randkey host/ambari2

WARNING: no policy specified for host/ambari2@CCTEST.DEV; defaulting to no policy

Principal “host/ambari2@CCTEST.DEV” created.

kadmin.local:  ktadd host/ambari2

Entry for principal host/ambari2 with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.

Entry for principal host/ambari2 with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.

Entry for principal host/ambari2 with kvno 2, encryption type des3-cbc-sha1 added to keytab FILE:/etc/krb5.keytab.

Entry for principal host/ambari2 with kvno 2, encryption type arcfour-hmac added to keytab FILE:/etc/krb5.keytab.

Entry for principal host/ambari2 with kvno 2, encryption type camellia256-cts-cmac added to keytab FILE:/etc/krb5.keytab.

Entry for principal host/ambari2 with kvno 2, encryption type camellia128-cts-cmac added to keytab FILE:/etc/krb5.keytab.

Entry for principal host/ambari2 with kvno 2, encryption type des-hmac-sha1 added to keytab FILE:/etc/krb5.keytab.

Entry for principal host/ambari2 with kvno 2, encryption type des-cbc-md5 added to keytab FILE:/etc/krb5.keytab.

2.8 查看keytab

klist -ekt /etc/krb5.keytab

3 配置主从高可用

3.1 拷贝配置文件至slaver

scp /etc/krb5.conf root@ambari2:/etc/

scp /etc/krb5.keytab.bk root@ambari2:/etc/

scp /var/kerberos/krb5kdc/kdc.conf root@ambari2:/var/kerberos/krb5kdc/

scp /var/kerberos/krb5kdc/kadm5.acl root@ambari2:/var/kerberos/krb5kdc/

scp /var/kerberos/krb5kdc/.k5.CCTEST.DEV root@ambari2:/var/kerberos/krb5kdc/.k5.CCTEST.DEV

3.2 Slave上创建数据库

#kdb5_util create -r CCTEST.DEV -s

Loading random data

Initializing database ‘/var/kerberos/krb5kdc/principal’ for realm ‘CCTEST.DEV’,

master key name ‘K/M@CCTEST.DEV’

You will be prompted for the database Master Password.

It is important that you NOT FORGET this password.

Enter KDC database master key: cctest

Re-enter KDC database master key to verify: cctest

3.3 配置同步

#vi /var/kerberos/krb5kdc/kpropd.acl

host/ambari1@CCTEST.DEV

host/ambari2@CCTEST.DEV

3.4 在slave上启动kpropd服务

systemctl start kprop

systemctl status kprop

3.5 数据同步

在master上将相关数据同步到slave上

#kdb5_util dump /var/kerberos/krb5kdc/kdc.dump

#kprop -f /var/kerberos/krb5kdc/kdc.dump -d ambari2

8964 bytes sent.

Database propagation to ambari2: SUCCEEDED

3.6 配置定时同步

#vi /usr/local/bin/krb5prop.sh

#!/bin/sh

kdclist = “ambari2”

kdb5_util dump /var/kerberos/krb5kdc/slave_datatrans

for kdc in $kdclist

do

kprop -d -f /var/kerberos/krb5kdc/slave_datatrans $kdc

done

#crontab -e

15 * * * * /usr/local/bin/krb5prop.sh

3.7 测试主从切换

停止kprop服务


# systemctl stop kprop


将kpropd.acl文件备份并删除


# mv kpropd.acl kpropd.acl.bak


启动krb5kdc和kadmin服务


# systemctl start krb5kdc

# systemctl start kadmin


修改备服务器的/etc/krb5.conf文件，将kdc和kadmin_server修改为备服务器地址


# mv /etc/krb5.conf /etc/krb5.conf.bak

# vi /etc/krb5.conf

[realms]

# EXAMPLE.COM = {


#  kdc = kerberos.example.com

#  admin_server = kerberos.example.com

# }

#ADD BY CC AT 20190408

CCTEST.DEV = {


#admin_server = ambari1:749

#kdc = ambari1:88

kdc = ambari2:88

admin_server = ambari2:749

}


测试kinit是否正常


# kinit admin/admin@CCTEST.DEV

Password for admin/admin@CCTEST.DEV:

# klist

Ticket cache: FILE:/tmp/krb5cc_0

Default principal: admin/admin@CCTEST.DEV

Valid starting       Expires              Service principal

04/18/2019 15:29:27  04/19/2019 15:29:27  krbtgt/CCTEST.DEV@CCTEST.DEV

renew until 04/25/2019 15:29:27


停krb5kdc和kadmin服务


#  systemctl stop krb5kdc

#  systemctl stop kadmin


还原/etc/krb5.conf和kpropd.acl


# mv /etc/krb5.conf.bak /etc/krb5.conf

# mv kpropd.acl.bak kpropd.acl


启动kprop服务


# systemctl start kprop