0027-如何在CDH叢集啟用Kerberos
阿新 • • 發佈：2018-11-20
溫馨提示：要看高清無碼套圖，請使用手機開啟並單擊圖片放大檢視。
1.文件編寫目的
本文件講述如何在CDH叢集啟用及配置Kerberos，您將學習到以下知識：
1.如何安裝及配置KDC服務
2.如何通過CDH啟用Kerberos
3.如何登入Kerberos並訪問Hadoop相關服務
文件主要分為以下幾步：
1.安裝及配置KDC服務
2.CDH叢集啟用Kerberos
3.Kerberos使用
這篇文件將重點介紹如何在CDH叢集啟用及配置Kerberos，並基於以下假設：
1.CDH叢集執行正常
2.叢集未啟用Kerberos
3.MySQL 5.1.73
以下是本次測試環境，但不是本操作手冊的必需環境：
1.作業系統：CentOS 6.5
2.CDH和CM版本為5.12.0
3.採用root使用者進行操作
2.KDC服務安裝及配置
本文件中將KDC服務安裝在Cloudera Manager Server所在伺服器上（KDC服務可根據自己需要安裝在其他伺服器）
1.在Cloudera Manager伺服器上安裝KDC服務
[[email protected]~]# yum -y install krb5-serverkrb5-libs krb5-auth-dialog krb5-workstation
2.修改/etc/krb5.conf配置
[[email protected] fayson_r]# vim /etc/krb5.conf [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = FAYSON.COM dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true [realms] FAYSON.COM = { kdc = ip-172-31-6-148.fayson.com admin_server = ip-172-31-6-148.fayson.com } [domain_realm] .ip-172-31-6-148.fayson.com = FAYSON.COM ip-172-31-6-148.fayson.com = FAYSON.COM
標紅部分為需要修改的資訊。
3.修改/var/kerberos/krb5kdc/kadm5.acl配置
[[email protected]~]# vim /var/kerberos/krb5kdc/kadm5.acl
*/[email protected] *
4.修改/var/kerberos/krb5kdc/kdc.conf配置
[[email protected] ~]# vim /var/kerberos/krb5kdc/kdc.conf
[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88
[realms]
FAYSON.COM= {
#master_key_type = aes256-cts
max_renewable_life= 7d 0h 0m 0s
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:n
ormal des-cbc-md5:normal des-cbc-crc:normal
}標紅部分為需要修改的配置。
5.建立Kerberos資料庫
[[email protected] ~]# kdb5_util create –r FAYSON.COM -s
Loading random data
Initializing database '/var/kerberos/krb5kdc/principal' for realm 'FAYSON.COM',
master key name 'K/[email protected]'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key:
Re-enter KDC database master key to verify: 
此處需要輸入Kerberos資料庫的密碼。
6.建立Kerberos的管理賬號
[[email protected] ~]# kadmin.local
Authenticating as principal fayson/[email protected] with password.
kadmin.local: addprinc admin/[email protected]
WARNING: no policy specified for admin/[email protected]; defaulting to no policy
Enter password for principal "admin/[email protected]":
Re-enter password for principal "admin/[email protected]":
Principal "admin/[email protected]" created.
kadmin.local: exit
[[email protected] ~]# 
標紅部分為Kerberos管理員賬號，需要輸入管理員密碼。
7.將Kerberos服務新增到自啟動服務，並啟動krb5kdc和kadmin服務
[[email protected]~]# chkconfig krb5kdc on
[[email protected] ~]# chkconfig kadmin on
[[email protected] ~]# service krb5kdc start
Starting Kerberos 5 KDC: [ OK ]
[[email protected] ~]# service kadmin start
Starting Kerberos 5 Admin Server: [ OK ]
[[email protected] ~]# 
8.測試Kerberos的管理員賬號
[[email protected] ~]# kinit admin/[email protected]
Password for admin/[email protected]:
[[email protected] ~]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admin/[email protected]
Valid starting Expires Service principal
09/05/17 16:39:17 09/06/17 16:39:17 krbtgt/[email protected]
renew until 09/12/17 16:39:17
[[email protected] ~]# 
9.為叢集安裝所有Kerberos客戶端，包括Cloudera Manager
[[email protected] cdh-shell-master]# yum -y install krb5-libs krb5-workstation
10.在Cloudera Manager Server伺服器上安裝額外的包
[[email protected]]# yum -y install openldap-clients
11.將KDC Server上的krb5.conf檔案拷貝到所有Kerberos客戶端
[[email protected]]# scp -r /etc/krb5.conf [email protected]:/etc/此處使用指令碼進行拷貝
[[email protected]]# sh b.sh node.list /etc/krb5.conf /etc/
krb5.conf 100% 451 0.4KB/s 00:00
krb5.conf 100% 451 0.4KB/s 00:00
krb5.conf 100% 451 0.4KB/s 00:00
krb5.conf 100% 451 0.4KB/s 00:00
[[email protected] cdh-shell-master]# 
3.CDH叢集啟用Kerberos
1.在KDC中給Cloudera Manager新增管理員賬號
[[email protected] cdh-shell-bak]# kadmin.local
Authenticating as principal admin/[email protected] with password.
kadmin.local: addprinc cloudera-scm/[email protected]
WARNING: no policy specified for cloudera-scm/[email protected]; defaulting to no policy
Enter password for principal "cloudera-scm/[email protected]":
Re-enter password for principal "cloudera-scm/[email protected]":
Principal "cloudera-scm/[email protected]" created.
kadmin.local: exit
[[email protected] cdh-shell-bak]# 
2.進入Cloudera Manager的“管理”-> “安全”介面
3.選擇“啟用Kerberos”，進入如下介面
確保如下列出的所有檢查項都已完成
4.點選“繼續”，配置相關的KDC資訊，包括型別、KDC伺服器、KDC Realm、加密型別以及待建立的Service Principal（hdfs，yarn,，hbase，hive等）的更新生命期等
5.點選“繼續”
6.不建議讓Cloudera Manager來管理krb5.conf, 點選“繼續”
7.輸入Cloudera Manager的Kerbers管理員賬號，必須和之前建立的賬號一致，點選“繼續”
8.等待啟用Kerberos完成，點選“繼續”
9.點選“繼續”
10.勾選重啟叢集，點選“繼續”
11.等待叢集重啟成功，點選“繼續”
至此已成功啟用Kerberos。
4.Kerberos使用
使用fayson使用者執行MapReduce任務及操作Hive，需要在叢集所有節點建立fayson使用者。
1.使用kadmin建立一個fayson的principal
[[email protected] cdh-shell-bak]# kadmin.local
Authenticating as principal admin/[email protected] with password.
kadmin.local: addprinc [email protected]
WARNING: no policy specified for [email protected]; defaulting to no policy
Enter password for principal "[email protected]":
Re-enter password for principal "[email protected]":
Principal "[email protected]" created.
kadmin.local: exit
[[email protected] cdh-shell-bak]#
2.使用fayson使用者登入Kerberos
[[email protected] cdh-shell-bak]# kdestroy
[[email protected] cdh-shell-bak]# kinit fayson
Password for [email protected]:
[[email protected] cdh-shell-bak]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: [email protected]
Valid starting Expires Service principal
09/05/17 17:19:08 09/06/17 17:19:08 krbtgt/[email protected]
renew until 09/12/17 17:19:08
[[email protected] cdh-shell-bak]# 
3.執行MapReduce作業
[[email protected]~]# hadoop jar /opt/cloudera/parcels/CDH/lib/hadoop-0.20-mapreduce/hadoop-examples.jar pi 10 1
...
Starting Job
17/09/02 20:10:43 INFO mapreduce.Job: Running job: job_1504383005209_0001
17/09/02 20:10:56 INFO mapreduce.Job: Job job_1504383005209_0001 running in ubermode : false
17/09/02 20:10:56 INFO mapreduce.Job: map0% reduce 0%
17/09/02 20:11:09 INFO mapreduce.Job: map20% reduce 0%
17/09/02 20:11:12 INFO mapreduce.Job: map40% reduce 0%
17/09/02 20:11:13 INFO mapreduce.Job: map50% reduce 0%
17/09/02 20:11:15 INFO mapreduce.Job: map60% reduce 0%
17/09/02 20:11:16 INFO mapreduce.Job: map70% reduce 0%
17/09/02 20:11:19 INFO mapreduce.Job: map80% reduce 0%
17/09/02 20:11:21 INFO mapreduce.Job: map100% reduce 0%
17/09/02 20:11:26 INFO mapreduce.Job: map100% reduce 100%
17/09/02 20:11:26 INFO mapreduce.Job: Job job_1504383005209_0001 completedsuccessfully
4.使用beeline連線hive進行測試
[[email protected] cdh-shell-bak]# beeline
Beeline version 1.1.0-cdh5.12.1 by Apache Hive
beeline> !connect jdbc:hive2://localhost:10000/;principal=hive/[email protected]
...
Transaction isolation: TRANSACTION_REPEATABLE_READ
0: jdbc:hive2://localhost:10000/> show tables;
...
INFO : OK
+-------------+--+
| tab_name |
+-------------+--+
| test_table |
+-------------+--+
1 row selected (0.194 seconds)
0: jdbc:hive2://localhost:10000/> select * from test_table;
...
INFO : OK
+----------------+----------------+--+
| test_table.s1 | test_table.s2 |
+----------------+----------------+--+
| 4 | lisi |
| 1 | test |
| 2 | fayson |
| 3 | zhangsan |
+----------------+----------------+--+
4 rows selected (0.144 seconds)
0: jdbc:hive2://localhost:10000/> 
執行Hive MapReduce作業
0: jdbc:hive2://localhost:10000/> select count(*) from test_table;
...
INFO : OK
+------+--+
| _c0 |
+------+--+
| 4 |
+------+--+
1 row selected (35.779 seconds)
0: jdbc:hive2://localhost:10000/> 
5.常見問題
1.使用Kerberos使用者身份執行MapReduce作業報錯
main : run as user is fayson
main : requested yarn user is fayson
Requested user fayson is not whitelisted and has id 501,whichis below the minimum allowed 1000
Failing this attempt. Failing the application.
17/09/02 20:05:04 INFO mapreduce.Job: Counters: 0
Job Finished in 6.184 seconds
java.io.FileNotFoundException: File does not exist:hdfs://ip-172-31-6-148:8020/user/fayson/QuasiMonteCarlo_1504382696029_1308422444/out/reduce-out
at org.apache.hadoop.hdfs.DistributedFileSystem$20.doCall(DistributedFileSystem.java:1266)
at org.apache.hadoop.hdfs.DistributedFileSystem$20.doCall(DistributedFileSystem.java:1258)
at org.apache.hadoop.fs.FileSystemLinkResolver.resolve(FileSystemLinkResolver.java:81)
at org.apache.hadoop.hdfs.DistributedFileSystem.getFileStatus(DistributedFileSystem.java:1258)
at org.apache.hadoop.io.SequenceFile$Reader.<init>(SequenceFile.java:1820)
at org.apache.hadoop.io.SequenceFile$Reader.<init>(SequenceFile.java:1844)
at org.apache.hadoop.examples.QuasiMonteCarlo.estimatePi(QuasiMonteCarlo.java:314)
at org.apache.hadoop.examples.QuasiMonteCarlo.run(QuasiMonteCarlo.java:354)
at org.apache.hadoop.util.ToolRunner.run(ToolRunner.java:70)
at org.apache.hadoop.examples.QuasiMonteCarlo.main(QuasiMonteCarlo.java:363)
at sun.reflect.NativeMethodAccessorImpl.invoke0(NativeMethod)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at org.apache.hadoop.util.ProgramDriver$ProgramDescription.invoke(ProgramDriver.java:71)
at org.apache.hadoop.util.ProgramDriver.run(ProgramDriver.java:144)
at org.apache.hadoop.examples.ExampleDriver.main(ExampleDriver.java:74)
at sun.reflect.NativeMethodAccessorImpl.invoke0(NativeMethod)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
atorg.apache.hadoop.util.RunJar.run(RunJar.java:221)
at org.apache.hadoop.util.RunJar.main(RunJar.java:136)
問題原因：是由於Yarn限制了使用者id小於10000的使用者提交作業；
解決方法：修改Yarn的min.user.id來解決
醉酒鞭名馬，少年多浮誇！ 嶺南浣溪沙，嘔吐酒肆下！摯友不肯放，資料玩的花！
溫馨提示：要看高清無碼套圖，請使用手機開啟並單擊圖片放大檢視。
推薦關注Hadoop實操，第一時間，分享更多Hadoop乾貨，歡迎轉發和分享。
原創文章，歡迎轉載，轉載請註明：轉載自微信公眾號Hadoop實操