Ambari学习笔记-安装Kerberos

1 安装前准备

1.1 主机列表

本次实验选择2台主机，1台作为KDC master主机，1台作为KDC slaver

节点ip	OS版本	jdk版本	hostname -f	安装软件
192.168.0.1	RHEL7.4	openjdk-1.8.0.131	ambari1	KDC master
192.168.0.2	RHEL7.4	openjdk-1.8.0.131	ambari2	KDC slaver

注意：

• 关闭防火墙
• 开启NTP服务

2 安装Kerberos

2.1安装krb5

yum -y install krb5-libs krb5-server krb5-workstation

2.2配置krb

vim /etc/krb5.conf

# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
#default_realm = EXAMPLE.COM
#default_ccache_name = KEYRING:persistent:%{uid}
#ADD BY CC AT 20190408
 default_realm = CCTEST.DEV
 dns_lookup_realm = false
 udp_preference_limit = 1
 clockskew = 300
 renewable = true

[realms]
# EXAMPLE.COM = {
#  kdc = kerberos.example.com
#  admin_server = kerberos.example.com
# }
#ADD BY CC AT 20190408
 CCTEST.DEV = {
  admin_server = ambari1:749
  kdc = ambari1:88
  kdc = ambari2:88
}

[domain_realm]
# .example.com = EXAMPLE.COM
# example.com = EXAMPLE.COM
#ADD BY CC AT 20190408
.cctest.dev = CCTEST.DEV
cctest.dev = CCTEST.DEV

配置项说明：
[logging]：日志输出设置 （可选）
[libdefaults]：连接的默认配置
default_realm：Kerberos应用程序的默认领域，所有的principal都将带有这个领域标志
ticket_lifetime： 表明凭证生效的时限，一般为24小时
renew_lifetime： 表明凭证最长可以被延期的时限，一般为一个礼拜。当凭证过期之后，对安全认证的服务的后续访问则会失败
clockskew：时钟偏差是不完全符合主机系统时钟的票据时戳的容差，超过此容差将不接受此票据。通常，将时钟扭斜设置为 300 秒（5 分钟）。这意味着从服务器的角度看，票证的时间戳与它的偏差可以是在前后 5 分钟内
udp_preference_limit= 1：禁止使用 udp 可以防止一个 Hadoop 中的错误
default_ccache_name：credential缓存名，默认值为
[realms]：列举使用的 realm
kdc：代表要 kdc 的位置。格式是 机器:端口
admin_server：代表 admin 的位置。格式是 机器:端口
default_domain：代表默认的域名
[domain_realm]：域名到realm的关系 （可选） 

vim /var/kerberos/krb5kdc/kdc.conf

[kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88

[realms]
# EXAMPLE.COM = {
#  #master_key_type = aes256-cts
#  acl_file = /var/kerberos/krb5kdc/kadm5.acl
#  dict_file = /usr/share/dict/words
#  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
#  supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
# }
 CCTEST.DEV = {
  master_key_type = aes256-cts
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  max_life = 24h
  max_renewable_life = 10d
  default_principal_flags= +renewable,+forwardable
  supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
 }

配置项说明：
kdcdefaults：kdc相关配置，这里只设置了端口信息
realms：realms的配置
    EXAMPLE.COM：设定的realms领域
    master_key_type：和 supported_enctypes 默认使用 aes256-cts。JAVA 使用 aes256-cts 验证方式需要安装 JCE包(推荐不使用)
    acl_file：标注了 admin 的用户权限，文件格式是：Kerberos_principal permissions [target_principal] [restrictions]
    supported_enctypes：支持的校验方式
    admin_keytab：KDC 进行校验的 keytab

vim /var/kerberos/krb5kdc/kadm5.acl

*/admin@CCTEST.DEV * 

2.3 初始化krb databases

#kdb5_util create -r CCTEST.DEV -s
Loading random data
Initializing database '/var/kerberos/krb5kdc/principal' for realm 'CCTEST.DEV',
master key name 'K/M@CCTEST.DEV'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key: cctest

说明：
[-s]表示生成stash file，并在其中存储master server key（krb5kdc）
[-r]来指定一个realm name —— 当krb5.conf中定义了多个realm时才是必要的。
如果需要重建数据库，将/var/kerberos/krb5kdc目录下的principal相关的文件删除即可

 2.4 添加database administrator

#kadmin.local -q "addprinc admin/admin"
Authenticating as principal root/admin@CCTEST.DEV with password.
WARNING: no policy specified for admin/admin@CCTEST.DEV; defaulting to no policy
Enter password for principal "admin/admin@CCTEST.DEV": admincc
Re-enter password for principal "admin/admin@CCTEST.DEV": admincc
Principal "admin/admin@CCTEST.DEV" created.

2.5 启动krb

systemctl start krb5kdc
systemctl start kadmin
systemctl enable krb5kdc
systemctl enable kadmin 

2.6 登录测试

#kadmin -p admin/admin@CCTEST.DEV
Authenticating as principal admin/admin@CCTEST.DEV with password.
Password for admin/admin@CCTEST.DEV: 
kadmin:  ?
Available kadmin requests:

add_principal, addprinc, ank    Add principal
delete_principal, delprinc     Delete principal
modify_principal, modprinc    Modify principal
rename_principal, renprinc    Rename principal
change_password, cpw     Change password
get_principal, getprinc  Get principal
list_principals, listprincs, get_principals, getprincs        List principals
add_policy, addpol       Add policy
modify_policy, modpol    Modify policy
delete_policy, delpol    Delete policy
get_policy, getpol       Get policy
list_policies, listpols, get_policies, getpols      List policies
get_privs, getprivs      Get privileges
ktadd, xst               Add entry(s) to a keytab
ktremove, ktrem          Remove entry(s) from a keytab
lock                     Lock database exclusively (use with extreme caution!)
unlock                   Release exclusive database lock
purgekeys                Purge previously retained old keys from a principal
get_strings, getstrs     Show string attributes on a principal
set_string, setstr       Set a string attribute on a principal
del_string, delstr       Delete a string attribute on a principal
list_requests, lr, ?     List available requests.
quit, exit, q            Exit program.
kadmin:  list_principals
K/M@CCTEST.DEV
admin/admin@CCTEST.DEV
kadmin/admin@CCTEST.DEV
kadmin/ambari1@CCTEST.DEV
kadmin/changepw@CCTEST.DEV
kiprop/ambari1@CCTEST.DEV
krbtgt/CCTEST.DEV@CCTEST.DEV

 2.7 创建host keytab 文件

#kadmin.local
kadmin.local:  addprinc -randkey host/ambari1  #添加principal
WARNING: no policy specified for host/ambari1@CCTEST.DEV; defaulting to no policy
Principal "host/ambari1@CCTEST.DEV" created.
kadmin.local:  ktadd host/ambari1 #生成keytab文件
Entry for principal host/ambari1 with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari1 with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari1 with kvno 2, encryption type des3-cbc-sha1 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari1 with kvno 2, encryption type arcfour-hmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari1 with kvno 2, encryption type camellia256-cts-cmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari1 with kvno 2, encryption type camellia128-cts-cmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari1 with kvno 2, encryption type des-hmac-sha1 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari1 with kvno 2, encryption type des-cbc-md5 added to keytab FILE:/etc/krb5.keytab.

kadmin.local:  addprinc -randkey host/ambari2
WARNING: no policy specified for host/ambari2@CCTEST.DEV; defaulting to no policy
Principal "host/ambari2@CCTEST.DEV" created.
kadmin.local:  ktadd host/ambari2
Entry for principal host/ambari2 with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari2 with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari2 with kvno 2, encryption type des3-cbc-sha1 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari2 with kvno 2, encryption type arcfour-hmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari2 with kvno 2, encryption type camellia256-cts-cmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari2 with kvno 2, encryption type camellia128-cts-cmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari2 with kvno 2, encryption type des-hmac-sha1 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/ambari2 with kvno 2, encryption type des-cbc-md5 added to keytab FILE:/etc/krb5.keytab.

2.8 查看keytab

klist -ekt /etc/krb5.keytab 

3 配置主从高可用

3.1 拷贝配置文件至slaver

scp /etc/krb5.conf root@ambari2:/etc/
scp /etc/krb5.keytab.bk root@ambari2:/etc/
scp /var/kerberos/krb5kdc/kdc.conf root@ambari2:/var/kerberos/krb5kdc/
scp /var/kerberos/krb5kdc/kadm5.acl root@ambari2:/var/kerberos/krb5kdc/
scp /var/kerberos/krb5kdc/.k5.CCTEST.DEV root@ambari2:/var/kerberos/krb5kdc/.k5.CCTEST.DEV

3.2 Slave上创建数据库

#kdb5_util create -r CCTEST.DEV -s
Loading random data
Initializing database '/var/kerberos/krb5kdc/principal' for realm 'CCTEST.DEV',
master key name 'K/M@CCTEST.DEV'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key: cctest
Re-enter KDC database master key to verify: cctest

3.3 配置同步

#vi /var/kerberos/krb5kdc/kpropd.acl
host/ambari1@CCTEST.DEV
host/ambari2@CCTEST.DEV

3.4 在slave上启动kpropd服务

systemctl start kprop
systemctl status kprop

3.5 数据同步

在master上将相关数据同步到slave上
#kdb5_util dump /var/kerberos/krb5kdc/kdc.dump
#kprop -f /var/kerberos/krb5kdc/kdc.dump -d ambari2
8964 bytes sent.
Database propagation to ambari2: SUCCEEDED

 3.6 配置定时同步

#vi /usr/local/bin/krb5prop.sh
#!/bin/sh
kdclist = "ambari2"
kdb5_util dump /var/kerberos/krb5kdc/slave_datatrans
for kdc in $kdclist
do
    kprop -d -f /var/kerberos/krb5kdc/slave_datatrans $kdc
done

#crontab -e
15 * * * * /usr/local/bin/krb5prop.sh

 3.7 测试主从切换

停止kprop服务
# systemctl stop kprop
将kpropd.acl文件备份并删除
# mv kpropd.acl kpropd.acl.bak
启动krb5kdc和kadmin服务
# systemctl start krb5kdc
# systemctl start kadmin
修改备服务器的/etc/krb5.conf文件，将kdc和kadmin_server修改为备服务器地址
# mv /etc/krb5.conf /etc/krb5.conf.bak
# vi /etc/krb5.conf
[realms]
# EXAMPLE.COM = {
#  kdc = kerberos.example.com
#  admin_server = kerberos.example.com
# }
#ADD BY CC AT 20190408
 CCTEST.DEV = {
  #admin_server = ambari1:749
  #kdc = ambari1:88
  kdc = ambari2:88
  admin_server = ambari2:749
}
测试kinit是否正常
# kinit admin/admin@CCTEST.DEV
Password for admin/admin@CCTEST.DEV: 
# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admin/admin@CCTEST.DEV

Valid starting       Expires              Service principal
04/18/2019 15:29:27  04/19/2019 15:29:27  krbtgt/CCTEST.DEV@CCTEST.DEV
        renew until 04/25/2019 15:29:27
停krb5kdc和kadmin服务
#  systemctl stop krb5kdc
#  systemctl stop kadmin
还原/etc/krb5.conf和kpropd.acl
# mv /etc/krb5.conf.bak /etc/krb5.conf
# mv kpropd.acl.bak kpropd.acl
启动kprop服务
# systemctl start kprop