CDH6.3.2 集成 Freeipa 的kerberos

标签(空格分隔): 大数据运维专栏


  • 一:系统环境
  • 二:CDH6.3.2 集成freeipa 的Kerberos

一:系统环境

1.2 系统配置

要求大数据的所有主机注入到FreeIPA当中

cdh 最低版本为CDH6.3.2 版本

image_1eh1ndtgq17r513njk5ivuf1oci9.png-309.9kB


二:CDH6.3.2 集成freeipa 的Kerberos

2.1 修改Kerberos 的 krb5.conf 文件

vim /etc/krb5.conf 
----
#File modified by ipa-client-install

includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/

[libdefaults]
  default_realm = VPC.UNIONDRUG.COM
  dns_lookup_realm = false
  dns_lookup_kdc = false
  rdns = false
  dns_canonicalize_hostname = false
  ticket_lifetime = 24h
  forwardable = true
  udp_preference_limit = 0
  renew_lifetime = 7d
  renewable = true
#  default_ccache_name = KEYRING:persistent:%{uid}

[realms]
  VPC.UNIONDRUG.COM = {
    kdc = rc07bigdata.vpc.uniondrug.com:88
    master_kdc = rc07bigdata.vpc.uniondrug.com:88
    admin_server = rc07bigdata.vpc.uniondrug.com:749
    kpasswd_server = rc07bigdata.vpc.uniondrug.com:464
    default_domain = vpc.uniondrug.com
    pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
    pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem

  }

[domain_realm]
  .vpc.uniondrug.com = VPC.UNIONDRUG.COM
  vpc.uniondrug.com = VPC.UNIONDRUG.COM
  rc01bigdata.vpc.uniondrug.com = VPC.UNIONDRUG.COM

-----
  renew_lifetime = 7d
  renewable = true
#  default_ccache_name = KEYRING:persistent:%{uid}  
所有大数据主机节点注释掉这行

image_1eh1nkfl7qupe1e6uu1f6o10n716.png-140.7kB

2.2 在FreeIPA 当中创建cdh的管理角色

创建一个cloudera-role的角色

image_1egkn1126mk618gh1a53d5012p513.png-571kB

为cloudera-role 创建权限

image_1egkn3pg57sm1da410v7jse9qe1g.png-176kB

image_1egkn71ne1j8sl1bqqm1egr1fcf1t.png-225kB

在FreeIPA上创建一个cloudera-scm的用户

密码为:cloudera-scm

image_1egknb54j1k041qb1jal1vp81rn32a.png-215.6kB

点击“角色” 为 cloudera-scm 添加角色

image_1egkncfq713gejcc1g9s1isb1b722n.png-350.8kB

image_1egknegg5ikk14k110s1cto1bb734.png-146.5kB

image_1eh20sj8h1ep81b741lbk1pel105c9.png-224.6kB

在节点上面添加测试 cloudera-scm 的Kerberos  账号

image_1eh20um2q5qf1g9cldvhpn1epom.png-139.6kB

添加所有DNS 解析到 freeIPA 当中

image_1eh21dgmfk041dad2op1j4uqav13.png-191.8kB

image_1eh21e8d110f8l97p3v1vvu1l9m1g.png-210.9kB


2.3 在cdh6.3.2 启用 FreeIPA 角色

登陆CM,进入Administration->Security,准备启动安全

image_1eid0ljjs1fb511s21ufm5r92f39.png-463.6kB

image_1eid0mc2dcfg154mc4u11pi5qam.png-179kB

在设置KDC页面中,KDC Type选择Redhat IPA,然后依次填写配置相关的KDC信息,包括类型、KDC服务器、KDC Realm、加密类型以及待创建的Service Principal(hdfs,yarn,,hbase,hive等)的更新生命期等,填写完成后点击下一步

image_1eid0na8nvkd3iupl1olpi6d13.png-471.5kB

image_1eid0p4qvhg219es1hhn1adh11km1g.png-227.9kB

image_1eid0rnv91i8136o1j0s19fu1vqa1t.png-186kB

image_1eid0snck167u1c05aht15316t82a.png-203.6kB

image_1eid0tgb91qsd1m091k8o1qhc9ms2n.png-148.8kB

image_1eid0u8r79si1sdrkd91lccpod34.png-322.8kB

image_1eid0urho1jle139p1gu71tm9v573h.png-275.7kB

image_1eida1pt115tpc9jft8ltpm809.png-315.9kB

image_1eida2p1d19v52b6705qlsj3tm.png-158kB

FreeIPA  会在服务器上面 生成 kerberos 的所有的principals  

image_1eh154mmkftk1o1j17ut18oiadm37.png-314.7kB

image_1eh13ilrj3er1ovj1bl71t3n2ss20.png-260.1kB


导出所有的常用大数据角色的prinicipals 

kadmin.local
xst -kt /root/cdh.keytab -norandkey hdfs/rc01bigdata.vpc.uniondrug.com@VPC.UNIONDRUG.COM

xst -kt /root/cdh.keytab -norandkey hive/rc02bigdata.vpc.uniondrug.com@VPC.UNIONDRUG.COM

xst -kt /root/cdh.keytab -norandkey
impala/rc01bigdata.vpc.uniondrug.com@VPC.UNIONDRUG.COM

image_1eh1505tu17dkqjuoc71rqdgio2d.png-563.5kB

image_1eh150s5f53i5kr7hq1np31ge82q.png-454.1kB