Installing Kerberos

Before we get started with configuring Kerberos for Apache Hadoop, we need to set up the KDC and the different nodes on the cluster with the required packages.

Configuring the KDC Server

KDC is the Kerberos server and should be the first step in configuring Kerberos on the cluster. The following are the steps to install the server packages:

  1. Choose a node on the cluster that you would want to set up as the KDC. Ideally, this node should be used exclusively for the KDC; however, for this demonstration, I am using node1.hcluster for the KDC.
  2. Install the krb5-libs, krb5-server, and krb5-workstation packages on the KDC node. Use the following commands as the root user to install the packages:
    $ yum install krb5-libs
$ yum install krb5-server
$ yum install krb5-workstation
  3. Update the krb5.conf file in the /etc/ folder from the root user as shown in the following code:
    [logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = MYREALM.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

[realms]
 MYREALM.COM = {
  kdc = node1.hcluster
  admin_server = node1.hcluster
 }

[domain_realm]
 .hcluster = MYREALM.COM
 hcluster = MYREALM.COM

    For our configuration, we are using MYREALM.COM as our realm. In this configuration, node1.hcluster is the KDC.

  4. Next, update the kdc.conf files in the /var/kerberos/krb5kdc/ folder from the root user as shown in the following code:
    [kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88

[realms]
 MYREALM.COM = {
  master_key_type = aes256-cts
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
}
  5. Next, we need to get the Java Cryptography Extension policy files from Oracle. These files are needed for our configuration as we are using the AES256-CTS type of cryptography for authentication. These policy files are not part of the Java Runtime Environment (JRE) by default and need to be explicitly downloaded. The policy files can be downloaded from http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html.
  6. After downloading the UnlimitedJCEPolicyJDK7.zip file, unzip the file to get the following two files:
    • local_policy.jar
    • Us_export_policy.jar
  7. On installing Cloudera Manager, Java was installed in /usr/java/jdk1.7.0_45-cloudera/. Place the extracted files as the root user under the /usr/java/jdk1.7.0_45-cloudera/jre/lib/security/ directory on all the machines that are part of the cluster. The JDK folder may be different for your installation, so please verify the path before placing the files. You may be prompted to overwrite the existing files. You should choose yes to overwrite the files.
  8. Next, we need to set up the database for the KDC. Use kdb5_util create -s command as the root user as shown in the following screenshot:
    Configuring the KDC Server
  9. Next, update the kadm5.acl file in the /var/kerberos/krb5kdc/ folder from the root user as follows:
    */[email protected] *
  10. Create the first principal for the root user as root user using kadmin.local -q "addprinc root/admin" command as shown in the following screenshot:
    Configuring the KDC Server
  11. Start the KDC services using the following commands as the root user:
    $ service krb5kdc start
$ service kadmin start

The previously mentioned steps should install all the required packages and start the services for KDC.

Testing the KDC installation

It is a good practice to test the KDC server after installation using the following steps:

  1. From the machine hosting the KDC service, run the following command to get the ticket granting ticket for the root user:
    $ kinit root/[email protected]
  2. Verify the existence of the ticket granting ticket (TGT) using the klist command as shown in the following screenshot:
    Testing the KDC installation

Configuring the Kerberos clients

After configuring the server, we need to set up the clients to work with Kerberos. Following are the steps to install the client packages on all the nodes of the cluster:

  1. Install the krb5-libs and krb5-workstation packages on all the client nodes as a root user using the following commands:
    $ yum install krb5-libs
$ yum install krb5-workstation
  2. Copy /etc/krb5.conf from the KDC server as the root user to all the client nodes on the cluster.

The client nodes are now configured to work with Kerberos.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.216.96.94