由於最近環境需要用到Kerberos認證，之前對Kerberos這塊瞭解甚少，今天抽空自己手動安裝一下Kerberos，以此加深對Kerberos的理解。

1 選擇一臺機器執行KDC，安裝Kerberos相關服務

yum install -y krb5-devel krb5-server krb5-workstation

2 配置Kerberos，包括krb5.conf和kdc.conf，修改其中的realm，把預設的EXAMPLE.COM修改為自己要定義的值

[[email protected] ~]# cat /etc/krb5.conf
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = TRAFKDC.COM  --修改之處
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

[realms]
 TRAFKDC.COM = {  --修改之處
  kdc = namenode01  --修改之處
  admin_server = namenode01  --修改之處
 }

[domain_realm]
 .TRAFKDC.com = TRAFKDC.COM  --修改之處
 TRAFKDC.com = TRAFKDC.COM  --修改之處

[
 
[email protected] ~]# cat /var/kerberos/krb5kdc/kdc.conf
[kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88

[realms]
 TRAFKDC.COM = {  --修改之處
  max_life = 24h  --新增
  max_renewable_life = 7d  --新增
  default_principal_flags = +renewable --新增
  #master_key_type = aes256-cts
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  supported_enctypes = aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
 }
 

3 建立KDC資料庫，其中需要設定管理員密碼，建立完成會在/var/kerberos/krb5kdc/下面生成一系列檔案，若重建資料庫則需先刪除/var/kerberos/krb5kdc下面principal相關檔案

[[email protected] ~]# /usr/sbin/kdb5_util create -s
Loading random data
Initializing database '/var/kerberos/krb5kdc/principal' for realm 'TRAFKDC.COM',
master key name 'K/[email protected]'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key:
Re-enter KDC database master key to verify:

[
 
[email protected] ~]# ll /var/kerberos/krb5kdc/
total 24
-rw-------. 1 root root   22 Mar  9  2016 kadm5.acl
-rw-------. 1 root root  403 Jan 13 10:18 kdc.conf
-rw-------. 1 root root 8192 Jan 13 10:23 principal
-rw-------. 1 root root 8192 Jan 13 10:23 principal.kadm5
-rw-------. 1 root root    0 Jan 13 10:23 principal.kadm5.lock
-rw-------. 1 root root    0 Jan 13 10:24 principal.ok

4 給資料庫管理員新增ACL許可權，修改kadm5.acl檔案，*代表全部許可權

[[email protected] ~]# cat /var/kerberos/krb5kdc/kadm5.acl
*/[email protected] *

5 新增資料庫管理員，注意kadmin.local可以直接執行在KDC上，而無需通過Kerberos認證

[[email protected] ~]# /usr/sbin/kadmin.local -q "addprinc kdcadmin/admin"
Enter password for principal "kdcadmin/[email protected]":
Re-enter password for principal "kdcadmin/[email protected]":
Principal "kdcadmin/[email protected]" created.
[[email protected] ~]# kadmin.local
Authenticating as principal centos/[email protected] with password.
kadmin.local:  listprinc
kadmin.local: Unknown request "listprinc".  Type "?" for a request list.
kadmin.local:  listprincs
K/[email protected]
kdcadmin/[email protected]
kadmin/[email protected]
kadmin/[email protected]
kadmin/[email protected]
krbtgt/[email protected]

6 啟動Kerberos程序並設定開機啟動，通過/var/log/krb5kdc.log 和 /var/log/kadmind.log檢視日誌，通過kinit檢查Kerberos正常執行

service krb5kdc start
service kadmin start
chkconfig krb5kdc on
chkconfig kadmin on

[[email protected] UnlimitedJCEPolicyJDK8]# ll
total 16
-rw-rw-r--. 1 root root 3035 Dec 21  2013 local_policy.jar
-rw-r--r--. 1 root root 7323 Dec 21  2013 README.txt
-rw-rw-r--. 1 root root 3023 Dec 21  2013 US_export_policy.jar
[[email protected] security]# cp /home/centos/UnlimitedJCEPolicyJDK8/ /usr/java/jdk1.8.0_11/jre/lib/security/
local_policy.jar      README.txt            US_export_policy.jar
[[email protected] security]# cp /home/centos/UnlimitedJCEPolicyJDK8/US_export_policy.jar /usr/java/jdk1.8.0_11/jre/lib/security/
cp: overwrite `/usr/java/jdk1.8.0_11/jre/lib/security/US_export_policy.jar'? y

8 到此，Kerberos服務端已搭好，現在選擇另外一臺機器安裝客戶端，並配置/etc/krb5.conf與KDC相同

yum install -y krb5-workstation

9 驗證客戶端可以訪問KDC

kadmin -p 'kdcadmin/admin' -w '<kdcadmin/admin password>' -s '<kdc server ip>' -q 'list_principals'

10 kadmin生成keytab，如果是KDC上面直接執行kadmin.local,如果是在客戶端先kinit再kadmin

(1)KDC

[[email protected] ~]# kadmin.local
Authenticating as principal trafodion/[email protected] with password.
kadmin.local:  listprincs
K/[email protected]
kadmin/[email protected]
kadmin/[email protected]
kadmin/[email protected]
krbtgt/[email protected]
[email protected]
kadmin.local:  xst -k /opt/trafodion.keytab trafodion
Entry for principal trafodion with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:/opt/trafodion.keytab.
Entry for principal trafodion with kvno 2, encryption type des3-cbc-sha1 added to keytab WRFILE:/opt/trafodion.keytab.
Entry for principal trafodion with kvno 2, encryption type arcfour-hmac added to keytab WRFILE:/opt/trafodion.keytab.
Entry for principal trafodion with kvno 2, encryption type des-hmac-sha1 added to keytab WRFILE:/opt/trafodion.keytab.
Entry for principal trafodion with kvno 2, encryption type des-cbc-md5 added to keytab WRFILE:/opt/trafodion.keytab.

[[email protected] opt]# ll /opt/trafodion.keytab
-rw-------. 1 root root 279 Jan 13 13:05 /opt/trafodion.keytab

(2)Client(需先kinit)

[[email protected] ~]# kinit kadmin/admin
Password for kadmin/[email protected]:
[[email protected] ~]# kadmin
Authenticating as principal kadmin/[email protected] with password.
Password for kadmin/[email protected]:
kadmin:  addprinc centos
WARNING: no policy specified for [email protected]; defaulting to no policy
Enter password for principal "[email protected]":
Re-enter password for principal "[email protected]":
Principal "[email protected]" created.
kadmin:  listprincs
K/[email protected]
[email protected]
kadmin/[email protected]
kadmin/[email protected]
kadmin/[email protected]
krbtgt/[email protected]
[email protected]

11 相關Kerberos命令

//新增principal
kadmin -p 'kdcadmin/admin' -w '<kdc password>' -s '<kdc server>' -q 'addprinc -randkey trafodion'
//生成keytab檔案
ktadd -k /opt/trafodion.keytab trafodion
//認證使用者
kinit -kt /opt/trafodion.keytab trafodion
//檢視當前認證使用者資訊
klist