kerberos

cdh5.12.2 开启kerberos认证

由 我只是一个虾纸丫 提交于 2019-12-26 15:10:46
一：kdc 服务的安装与配置 二：集群所有节点安装Kerberos客户端(包括CM) 三：CDH集群启用Kerberos 一： kdc 服务的安装与配置 1.1 安装kdc服务 # yum install krb5-server krb5-libs krb5-auth-dialog krb5-workstation -y 1.2 配置kdc 服务 vim /etc/krb5.conf --- includedir /etc/krb5.conf.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] dns_lookup_kdc = false dns_lookup_realm = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true rdns = false default_realm = GEMS.COM default_tgs_enctypes = rc4-hmac default_tkt_enctypes = rc4-hmac permitted_enctypes = rc4

Kerberos+LDAP+NFSv4 实现单点登录(下)

由 耗尽温柔 提交于 2019-12-26 15:10:37
Kerberos+LDAP+NFSv4 实现单点登录(下) 六.nfs客户机的安装 nfs客户机也即SSSD客户机,需安装sssd和nfs-common 1.安装sssd 会自动安装libsasl2-modules-gssapi-mit(非依赖) libsasl2-modules-gssapi-mit和libsasl2-modules-gssapi-heimdal两者冲突,安装libsasl2-modules-gssapi-heimdal也可以 root@debian:~# apt-get install sssd sssd-krb5 sssd-ldap libsasl2-modules-gssapi-heimdal 安装后的sssd.conf是空白文件,nsswitch.conf没改变 root@debian:~# ls -l /etc/sssd/sssd.conf -rw------- 1 root root 1938 Jun 10 11:18 /etc/sssd/sssd.conf 仅拥有者可读(SSSD文档要求sssd.conf仅root根用户可读写,否则无法启动sssd) 修改配置文件sssd.conf、nsswitch.conf 1)查看sssd.conf root@debian:~# cat /etc/sssd/sssd.conf [sssd] config_file

Kerberos+LDAP+NFSv4 实现单点登录(上)

由 不打扰是莪最后的温柔 提交于 2019-12-26 15:10:30
Kerberos+LDAP+NFSv4 实现单点登录(上) Kerberos : 身份认证 LDAP : 目录信息服务 NFSv4 : 网络共享 实验环境 : debian 9 三台主机: nfs服务器 : 192.168.1.103 nfs客户机 : 192.168.1.102 即SSSD客户端+NFS客户端 kdc服务器 : 192.168.1.101 即Kerberos+LDAP 以下 root@debian:~# 表示以root根用户运行命令 一.安装NTP时间同步 要使用Kerberos提供身份认证,各主机需时间同步 在一台主机上安装时间同步服务器 root@debian:~# apt-get install ntp 在其它主机上安装时间同步客户端 root@debian:~# apt-get install ntpdate 二.配置本地域 假定域是ctp.net 安装Kerberos、LDAP过程都会用到域,NFSv4认证需要到域 以上三台主机的/etc/hosts文件内容都配置如下: 127.0.0.1 localhost 127.0.1.1 debian.ctp.net debian 192.168.1.103 srvnf.ctp.net srvnf 192.168.1.102 clnf.ctp.net clnf 注意:127.0.1.1一定要xxx.ctp

Kerberos+LDAP+NFSv4 实现单点登录(续4)--SASL/GSSAPI

由 随声附和 提交于 2019-12-26 14:44:01
前篇<Kerberos+LDAP+NFSv4 实现单点登录(续1)--dns+dhcp>的krb5 + ldap + bind9 + bind9-dyndb-ldap 全面升级到debian 10,出现bind9-dyndb-ldap的GSSAPI+krb5_keytab认证机制无法连接ldap数据库. 查看日志: SASL/GSSAPI authentication started Error: Local error Additional info: SASL(-1): generic failure: GSSAPI Error: Miscellaneous failure (see text) (Did not find a plugin for ccache_ops) 网上搜索有关GSSAPI+ccache_ops未果,不得不自己动手调试. 思路:从bind9-dyndb-ldap软件包开始及其各依赖包逐个手动降级;或者从正常debian 9开始,修改软件源为debian 10,逐个升级.即降级/升级一个,测试一次. 说明:debian系统是无法自动降级的,可修改软件源为低版或手动下载低版deb包重装软件包 实际整个调试过程还是盲人摸象.krb5、ldap、sasl都是复杂的东西,问题有可能在服务端,也有可能在客户端,也有可能配置上漏缺. 本人能力有限

Is Kerberos Authentication supported in WASB in Azure VM?

由 为君一笑 提交于 2019-12-25 09:25:16
问题 I have created Linux Azure VM and running Java application on it. Then I created HDInsight Spark Cluster which has hdfs, yarn, spark, etc. I have connected VM with Spark cluster using the Storage Access Key in core-site.xml on VM. core-site.xml <property> <name>fs.azure.account.key.YOUR_ACCOUNT.blob.core.windows.net</name> <value>Storage_Access_Key</value> </property> and I am able to authenticate my application with above. But I want to authenticate for my JAVA application using Kerberos in

Connecting to Kerberized hadoop cluster using python module impyla

由 微笑、不失礼 提交于 2019-12-25 08:59:30
问题 I am using impyla module to connect to kerberized hadoop cluster. I want to access hiveserver2/hive but I was getting the below error: test_conn.py from impala.dbapi import connect import os connection_string = 'hdp296m1.XXX.XXX.com' conn = connect(host=connection_string, port=21050,auth_mechanism="GSSAPI",kerberos_service_name='testuser@Myrealm.COM',password='testuser') cursor = conn.cursor() cursor.execute('select count(*) form t_all_types_simple_t') print cursor.description results =

Kerberos authentication not working with spring security

由 巧了我就是萌 提交于 2019-12-25 07:13:22
问题 We are working on Kerberos login authentication, It was working fine but now we are getting the below exception while hitting the URL and its not redirecting to the home page. Suggest some solution would be much appreciated. 10:44:20,145 ERROR [org.springframework.boot.context.web.ErrorPageFilter] (http-/127.0.0.1:6900-3) Cannot forward to error page for request as the response has already been committed. As a result, the response may have the wrong status code. If your application is running

How to delegate the kerberos client credentials to the server?

由 扶醉桌前 提交于 2019-12-25 06:48:05
问题 It's possible to get a service ticket for the client (remote user) in the server side in order to use that ticket to authenticate against another backend? Scenario: User (IE) ==> AppServer (Websphere, under Linux) ==> Backend (webservice) We have SPNEGO auth running and working in the AppServer The AD user that runs the AppServer has the rights to do the delegation Thanks in advance ===================== UPDATE @Michael-O So ... this should be the step by step?? 1) Login the AppServer User

Spark can't connect to secure phoenix

由 ╄→гoц情女王★ 提交于 2019-12-25 04:21:42
问题 I am running a spark program on secured cluster which creates SqlContext for creating dataframe over phoenix table. When I run my program in local mode with --master option set to local[2] my program works completely fine, however when I try to run same program with master option set to yarn-client, I am getting below exception: Caused by: org.apache.hadoop.hbase.client.RetriesExhaustedException: Failed after attempts=5, exceptions: Fri Sep 16 12:14:10 IST 2016, RpcRetryingCaller

How to save Kerberos private credentials for use in other machines

由 一世执手 提交于 2019-12-25 03:54:40
问题 I am using JAAS to get Kerberos credentials. My config file look like this: SignedOnUserLoginContext { com.sun.security.auth.module.Krb5LoginModule required debug=true useTicketCache=true doNotPrompt=true; }; The code to get Kerberos credentials try { LoginContext lc = new LoginContext("SignedOnUserLoginContext"); lc.login(); Subject signedOnUserSubject = lc.getSubject(); Set<Object> privateCred = signedOnUserSubject.getPrivateCredentials(); for (Object privates : privateCred) { if (privates
订阅 kerberos