hadoop 安全应用kerberos ，搭建KDC使其高可用
操作系统 ubuntu 12.04
Kerberos Server ##################### 规范介绍 #######################################Realm: BJPUC1.COM --> 建议大写Primary KDC: nn1.bjpuc1.com --> 建议用域名 192.168.88.16Secondary KDC: nn2.bjpuc1.com --> 192.168.88.17User principal: bjpuc1Admin principal: bjpuc1/adminNTP 时间服务器 --> 时间需要同步 ##################### 规范介绍 #######################################
Primary KDC
apt-get install krb5-kdc krb5-admin-serverkrb5_newrealm dpkg-reconfigure krb5-kdc
cat /etc/krb5.conf ###此文件为所有应用kerbers 机器通用[logging]default = FILE:/var/log/krb5libs.logkdc = FILE:/var/log/krb5kdc.logadmin_server = FILE:/var/log/kadmind.log[libdefaults]default_realm = BJPUC1.COMdns_lookup_realm = falsedns_lookup_kdc = falseticket_lifetime = 24hrenew_lifetime = 2dforwardable = truerenewable = true[realms]BJPUC1.COM = {kdc = nn1.bjpuc1.comkdc = nn2.bjpuc1.comadmin_server = nn1.bjpuc1.com}[domain_realm][kdc]profile=/etc/krb5kdc/kdc.confkadmin.localAuthenticating as principal root/admin@BJPUC1.COM with password.kadmin.local: addprinc bjpuc1/adminWARNING: no policy specified for bjpuc1/admin@BJPUC1.COM; defaulting to no policyEnter password for principal "bjpuc1/admin@BJPUC1.COM": Re-enter password for principal "bjpuc1/admin@BJPUC1.COM": Principal "bjpuc1/admin@BJPUC1.COM" created.kadmin.local: quit
cat /etc/krb5kdc/kadm5.aclbjpuc1/admin@BJPUC1.COM */etc/init.d/krb5-admin-server restartkinit bjpuc1/adminbjpuc1/admin@BJPUC1.COM's Password:
cat /etc/hosts ##或用DNS方式解决host/nn1.bjpuc1.com@bjpuc1.comhost/nn2.bjpuc1.com@bjpuc1.com
kadmin -q "addprinc -randkey host/nn1.bjpuc1.com"kadmin -q "ktadd -norandkey -k /etc/krb5.keytab host/nn1.bjpuc1.com"klist -k /etc/krb5.keytabklist -k /etc/krb5.keytabkprop -r bjpuc1.com -f /var/lib/krb5kdc/dump nn2.bjpuc1.comvi /etc/crontab0 * * * * /usr/sbin/kdb5_util dump /var/lib/krb5kdc/dump && /usr/sbin/kprop -r BJPUC1.COM -f /var/lib/krb5kdc/dump nn2.bjpuc1.com
Secondary KDC
apt-get install krb5-kdc krb5-admin-serverkadmin -q "addprinc -randkey host/nn2.bjpuc1.com"kadmin -q "ktadd -norandkey -k /etc/krb5.keytab host/nn2.bjpuc1.com"vi /etc/krb5kdc/kpropd.aclhost/nn1.bjpuc1.com@bjpuc1.comhost/nn2.bjpuc1.com@bjpuc1.comkdb5_util -s createkpropd -Skdb5_util stash/etc/init.d/krb5-kdc start
Kerberos Linux Client
apt-get install krb5-user libpam-krb5 libpam-ccreds auth-client-config
转载于:https://blog.51cto.com/374400/1428504
![[Android开源项目] GitHub开源项目总结 (转)](http://pic.xiahunao.cn/[Android开源项目] GitHub开源项目总结 (转))
