hadoop 安全应用kerberos ，搭建KDC使其高可用

操作系统 ubuntu 12.04

Kerberos Server
#####################   规范介绍    #######################################Realm: BJPUC1.COM        --> 建议大写Primary KDC: nn1.bjpuc1.com  --> 建议用域名 192.168.88.16Secondary KDC: nn2.bjpuc1.com --> 192.168.88.17User principal: bjpuc1Admin principal: bjpuc1/adminNTP 时间服务器        --> 时间需要同步
#####################   规范介绍    #######################################

Primary KDC

    apt-get install krb5-kdc krb5-admin-serverkrb5_newrealm    dpkg-reconfigure krb5-kdc

    cat /etc/krb5.conf    ###此文件为所有应用kerbers 机器通用[logging]default = FILE:/var/log/krb5libs.logkdc = FILE:/var/log/krb5kdc.logadmin_server = FILE:/var/log/kadmind.log[libdefaults]default_realm = BJPUC1.COMdns_lookup_realm = falsedns_lookup_kdc = falseticket_lifetime = 24hrenew_lifetime = 2dforwardable = truerenewable = true[realms]BJPUC1.COM = {kdc = nn1.bjpuc1.comkdc = nn2.bjpuc1.comadmin_server = nn1.bjpuc1.com}[domain_realm][kdc]profile=/etc/krb5kdc/kdc.conf

    kadmin.localAuthenticating as principal root/admin@BJPUC1.COM with password.kadmin.local: addprinc bjpuc1/adminWARNING: no policy specified for bjpuc1/admin@BJPUC1.COM; defaulting to no policyEnter password for principal "bjpuc1/admin@BJPUC1.COM": Re-enter password for principal "bjpuc1/admin@BJPUC1.COM": Principal "bjpuc1/admin@BJPUC1.COM" created.kadmin.local: quit

    cat /etc/krb5kdc/kadm5.aclbjpuc1/admin@BJPUC1.COM        */etc/init.d/krb5-admin-server restartkinit bjpuc1/adminbjpuc1/admin@BJPUC1.COM's Password:

    cat /etc/hosts        ##或用DNS方式解决host/nn1.bjpuc1.com@bjpuc1.comhost/nn2.bjpuc1.com@bjpuc1.com

    kadmin -q "addprinc -randkey host/nn1.bjpuc1.com"kadmin -q "ktadd -norandkey -k /etc/krb5.keytab host/nn1.bjpuc1.com"klist -k /etc/krb5.keytabklist -k /etc/krb5.keytabkprop -r bjpuc1.com -f /var/lib/krb5kdc/dump nn2.bjpuc1.comvi /etc/crontab0 * * * * /usr/sbin/kdb5_util dump /var/lib/krb5kdc/dump && /usr/sbin/kprop -r BJPUC1.COM -f /var/lib/krb5kdc/dump nn2.bjpuc1.com

Secondary KDC

    apt-get install krb5-kdc krb5-admin-serverkadmin -q "addprinc -randkey host/nn2.bjpuc1.com"kadmin -q "ktadd -norandkey -k /etc/krb5.keytab host/nn2.bjpuc1.com"vi /etc/krb5kdc/kpropd.aclhost/nn1.bjpuc1.com@bjpuc1.comhost/nn2.bjpuc1.com@bjpuc1.comkdb5_util -s createkpropd -Skdb5_util stash/etc/init.d/krb5-kdc start

Kerberos Linux Client

    apt-get install krb5-user libpam-krb5 libpam-ccreds auth-client-config