KDC服务安装及配置
本文档中将KDC服务安装在Cloudera Manager Server所在服务器上（KDC服务可根据自己需要安装在其他服务器）
1.在Cloudera Manager服务器上安装KDC服务
[root@server01 /]# yum -y install krb5-server krb5-libs krb5-auth-dialog krb5-workstation
image.png
2.修改/etc/krb5.conf配置
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = ALADING.COM
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
# default_realm = EXAMPLE.COM
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
ALADING.COM = {
kdc = server01
admin_server = server01
}
# EXAMPLE.COM = {
# kdc = kerberos.example.com
# admin_server = kerberos.example.com
# }
[domain_realm]
.alading.com = ALADING.COM
alading.com = ALADING.COM
# .example.com = EXAMPLE.COM
# example.com = EXAMPLE.COM
红色为修改部分：
3.修改/var/kerberos/krb5kdc/kdc.conf配置
[root@server01 /]# vi /var/kerberos/krb5kdc/kdc.conf
[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88
[realms]
ALADING.COM = {
#master_key_type = aes256-cts
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
}
红色为修改部分：
4. 配置acl文件
vim /var/kerberos/krb5kdc/kadm5.acl
*/admin@ALADING.COM *
5. 以上3个文件拷贝到集群中其他服务器。
需要同步的文件：
krb5.conf
kdc.conf
kadm5.acl
下载jce替换ocal_policy.jar and US_export_policy.jar 文件
http://www.oracle.com/technetwork/java/javase/downloads/jce-6-download-429243.html
下载完毕后，解压得到的如下.jar拷贝到java_home/jre/lib/security/文件目录下：
[root@server01 UnlimitedJCEPolicyJDK8]# ll
total 16
-rw-rw-r-- 1 root root 3035 Dec 21 2013 local_policy.jar
-rw-r--r-- 1 root root 7323 Dec 21 2013 README.txt
-rw-rw-r-- 1 root root 3023 Dec 21 2013 US_export_policy.jar
# 同步到所有服务器的JDK8目录下：
[root@server01 UnlimitedJCEPolicyJDK8]# cp /root/UnlimitedJCEPolicyJDK8/*.jar /usr/java/default/jre/lib/security/
6.创建Kerberos数据库
[root@server01 /]# kdb5_util create -r ALADING.COM -s
Loading random data
Initializing database '/var/kerberos/krb5kdc/principal' for realm 'ALADING.COM',
master key name 'K/M@ALADING.COM'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key:
Re-enter KDC database master key to verify:
7. 添加新的管理员用户
[root@ip-172-31-6-148 ~]# kadmin.local
Authenticating as principal admin/admin@ALADING.COM with password.
kadmin.local: addprinc admin/admin@ALADING.COM
WARNING: no policy specified for admin/admin@ALADING.COM; defaulting to no policy
Enter password for principal "admin/admin@ALADING.COM":
Re-enter password for principal "admin/admin@ALADING.COM":
Principal "admin/admin@ALADING.COM" created.
kadmin.local: exit
# 列出所有的principle
kadmin.local: listprincs
K/M@CTBJ.COM
debugo/admin@CTBJ.COM
kadmin/admin@CTBJ.COM
kadmin/cdh_manager@CTBJ.COM
kadmin/changepw@CTBJ.COM
krbtgt/CTBJ.COM@CTBJ.COM
# 查看principle：getprinc debugo/admin@CTBJ.COM
# 删除principle：delprinc debugo/admin@CTBJ.COM
# 修改principle密码：cpw,change_passwd
8. 启动服务
[root@server01 /]# chkconfig krb5kdc on
[root@server01 /]# chkconfig kadmin on
[root@server01 /]# service krb5kdc restart
Starting Kerberos 5 KDC: [ OK ]
[root@server01 /]# service kadmin restart
Starting Kerberos 5 Admin Server: [ OK ]
9. 验证Kerveros管理员账号
> kinit admin/admin@ALADING.COM
Password for admin/admin@ALADING.COM:
> klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: debugo/hdp01.ctbj.com@CTBJ.COM
Valid starting Expires Service principalna jiu
/08/14 11:58:00 09/09/14 11:58:00 krbtgt/CTBJ.COM@CTBJ.COM
renew until 09/08/14 11:58:00
CDH集群启用Kerberos
1. 在KDC中给Cloudera Manager添加管理员账号
[root@ip-172-31-6-148 cdh-shell-bak]# kadmin.local
Authenticating as principal admin/admin@ALADING.COM with password.
kadmin.local: addprinc cloudera-scm/admin@ALADING.COM
WARNING: no policy specified for cloudera-scm/admin@FAYSON.COM; defaulting to no policy
Enter password for principal "cloudera-scm/admin@ALADING.COM":
Re-enter password for principal "cloudera-scm/admin@FAYSON.COM":
Principal "cloudera-scm/admin@ALADING.COM" created.
kadmin.local: exit
[root@ip-172-31-6-148 cdh-shell-bak]#
2.进入Cloudera Manager的“管理”-> “安全”界面
3.选择“启用Kerberos”，进入如下界面
确保如下列出的所有检查项都已完成
4.点击“继续”，配置相关的KDC信息，包括类型、KDC服务器、KDC Realm、加密类型以及待创建的Service Principal（hdfs，yarn,，hbase，hive等）的更新生命期等
5.点击“继续”
6.不建议让Cloudera Manager来管理krb5.conf, 点击“继续”
7.输入Cloudera Manager的Kerbers管理员账号，必须和之前创建的账号一致，点击“继续”
8.等待启用Kerberos完成，点击“继续”
9.点击“继续”
10.勾选重启集群，点击“继续”
11.等待集群重启成功，点击“继续”
至此已成功启用Kerberos。
Kerberos使用
使用fayson用户运行MapReduce任务及操作Hive，需要在集群所有节点创建fayson用户。
1.使用kadmin创建一个fayson的principal
[root@ip-172-31-6-148 cdh-shell-bak]# kadmin.local
Authenticating as principal admin/admin@FAYSON.COM with password.
kadmin.local: addprinc fayson@FAYSON.COM
WARNING: no policy specified for fayson@FAYSON.COM; defaulting to no policy
Enter password for principal "fayson@FAYSON.COM":
Re-enter password for principal "fayson@FAYSON.COM":
Principal "fayson@FAYSON.COM" created.
kadmin.local: exit
[root@ip-172-31-6-148 cdh-shell-bak]#
2.使用fayson用户登录Kerberos
[root@ip-172-31-6-148 cdh-shell-bak]# kdestroy
[root@ip-172-31-6-148 cdh-shell-bak]# kinit fayson
Password for fayson@FAYSON.COM:
[root@ip-172-31-6-148 cdh-shell-bak]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: fayson@FAYSON.COM
Valid starting Expires Service principal
09/05/17 17:19:08 09/06/17 17:19:08 krbtgt/FAYSON.COM@FAYSON.COM
renew until 09/12/17 17:19:08
[root@ip-172-31-6-148 cdh-shell-bak]#
3.运行MapReduce作业
[root@ip-172-31-6-148~]# hadoop jar /opt/cloudera/parcels/CDH/lib/hadoop-0.20-mapreduce/hadoop-examples.jar pi 10 1
...
Starting Job
17/09/02 20:10:43 INFO mapreduce.Job: Running job: job_1504383005209_0001
17/09/02 20:10:56 INFO mapreduce.Job: Job job_1504383005209_0001 running in ubermode : false
17/09/02 20:10:56 INFO mapreduce.Job: map0% reduce 0%
17/09/02 20:11:09 INFO mapreduce.Job: map20% reduce 0%
17/09/02 20:11:12 INFO mapreduce.Job: map40% reduce 0%
17/09/02 20:11:13 INFO mapreduce.Job: map50% reduce 0%
17/09/02 20:11:15 INFO mapreduce.Job: map60% reduce 0%
17/09/02 20:11:16 INFO mapreduce.Job: map70% reduce 0%
17/09/02 20:11:19 INFO mapreduce.Job: map80% reduce 0%
17/09/02 20:11:21 INFO mapreduce.Job: map100% reduce 0%
17/09/02 20:11:26 INFO mapreduce.Job: map100% reduce 100%
17/09/02 20:11:26 INFO mapreduce.Job: Job job_1504383005209_0001 completedsuccessfully
参考：
https://mp.weixin.qq.com/s?__biz=MzI4OTY3MTUyNg==&mid=2247484735&idx=1&sn=b021eb28562d566b5d3c97f3d4024905&chksm=ec2ad536db5d5c2017b61638eeb3bbc5640cff080e2a376923f3cb06ba4e57211fee4fc027e8&scene=21#wechat_redirect
https://blog.csdn.net/DF_XIAO/article/details/52838648
http://www.aboutyun.com/forum.php?mod=viewthread&tid=22835
