Cloudera-Mnanager启用Kerberos的流程

安全模块

集成kerberos/home/cloudera 安装kdc服务

点击kerberos安装 （centos 6.6的系统）

实际运行下面的脚本

1. 完成KDC安装
2. 创建acl文件echo "*/admin@${KERBEROS_REALM} *" > /var/kerberos/krb5kdc/kadm5.acl
3. 创建KERBEROS_PRINCIPAL管理KDC 默认cloudera-scm/admin@CLOUDERA 密码：cloudera
4. 启动服务

#! /usr/bin/env bash

set -e #脚本遇到错误，立即退出

function terminate() {
    if [ "${PAUSE}" == 'true' ]; then
        read -p "Press [Enter] to exit..."
    fi
    exit ${1}
}

function ensure_user_is_root() {
    if [[ "$EUID" -ne "0" ]]; then
        echo "You must run this script as root. Try 'sudo ${0} ${@}'."
        terminate 1
    fi
}

function parse_arguments() {
    for argument in ${@}; do
        if [ "${argument}" == '--force' ]; then
            export FORCE='true'
        elif [ "${argument}" == '--pause' ]; then
            export PAUSE='true'
        else
            echo "Unknown option: ${argument}"
            terminate 1
        fi
    done
}

function log() {
    echo "[QuickStart] ${1}"
}

parse_arguments ${@}

KERBEROS_REALM=${KERBEROS_REALM:-CLOUDERA}
KERBEROS_DOMAIN=${KERBEROS_DOMAIN:-cloudera}
KERBEROS_HOSTNAME=${KERBEROS_HOSTNAME:-quickstart.${KERBEROS_DOMAIN}}
KERBEROS_PRINCIPAL=${KERBEROS_PRINCIPAL:-cloudera-scm/admin}
KERBEROS_PASSWORD=${KERBEROS_PASSWORD:-cloudera}
JAVA_HOME=${JAVA_HOME:-/usr/java/jdk1.7.0_*-cloudera}

ensure_user_is_root

log 'Installing Kerberos...'
yum install -y krb5-server krb5-workstation openldap
#开机自启
chkconfig krb5kdc on
chkconfig kadmin on

touch /var/lib/cloudera-quickstart/.kerberos

log 'Configuring Kerberos...'

cat > /etc/krb5.conf <<EOF
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = ${KERBEROS_REALM}
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true

[realms]
${KERBEROS_REALM} = {
  kdc = ${KERBEROS_HOSTNAME}
  admin_server = ${KERBEROS_HOSTNAME}
  max_renewable_life = 7d 0h 0m 0s
  default_principal_flags = +renewable
}

[domain_realm]
.${KERBEROS_DOMAIN} = ${KERBEROS_REALM}
${KERBEROS_DOMAIN} = ${KERBEROS_REALM}
EOF

cat > /var/kerberos/krb5kdc/kdc.conf <<EOF
[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88

[realms]
${KERBEROS_REALM} = {
  #master_key_type = aes256-cts
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  # Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files
  # for JDK/JRE 7 must be installed in order to use 256-bit AES encryption (aes256-cts:normal)
  supported_enctypes = aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal       max_life = 30d
  max_renewable_life = 30d
}
EOF

#acl文件,KERBEROS_PRINCIPAL就是admin管理principal
echo "*/admin@${KERBEROS_REALM}  *" > /var/kerberos/krb5kdc/kadm5.acl

log 'Setting root password for Kerberos...'
expect - <<EOF
set timeout 60
spawn kdb5_util create -s
expect "Enter KDC database master key:"
send "${KERBEROS_PASSWORD}\r"
expect "Re-enter KDC database master key to verify:"
send "${KERBEROS_PASSWORD}\r"
expect eof
EOF


log 'Creating Kerberos principal...'
#脚本交互
expect - <<EOF
#交互超时时间设定 
set timeout 60
#spawn 执行要调用的命令
spawn kadmin.local -q "addprinc ${KERBEROS_PRINCIPAL}"
#expect 等待命令提示出现
expect "Enter password for principal \"${KERBEROS_PRINCIPAL}@${KERBEROS_REALM}\":"
#send 发送要输入的值，避免手动交互
send "${KERBEROS_PASSWORD}\r"
expect "Re-enter password for principal \"${KERBEROS_PRINCIPAL}@${KERBEROS_REALM}\":"
send "${KERBEROS_PASSWORD}\r"
#expect 必须要和spawn对应，表示终止获取终端信息
expect eof
EOF

#启动KDC\Kadmin服务
log 'Starting Kerberos services...'
service krb5kdc start
service kadmin start

建完后的KDC库

kadmin.local:  listprincs
K/M@CLOUDERA
cloudera-scm/admin@CLOUDERA
kadmin/admin@CLOUDERA
kadmin/changepw@CLOUDERA
kadmin/quickstart.cloudera@CLOUDERA
krbtgt/CLOUDERA@CLOUDERA

页面配置：

图片.png

管理其他账号的principal配置，也是第一个建的cloudera-scm/admin这个

图片.png