1. # krb服务器
  2. yum -y install krb5-server openldap-clients 
  3. # 客户端
  4. yum -y install krb5-devel krb5-workstation

配置krb5.conf

/etc/krb5.conf

  1. # Configuration snippets may be placed in this directory as well
  2. includedir /etc/krb5.conf.d/
  4. [logging]
  5.  default = FILE:/var/log/krb5libs.log
  6.  kdc = FILE:/var/log/krb5kdc.log
  7.  admin_server = FILE:/var/log/kadmind.log
  9. [libdefaults]
  10.  default_realm = FOO.COM
  11.  dns_lookup_realm = false
  12.  ticket_lifetime = 24h
  13.  renew_lifetime = 7d
  14.  forwardable = true
  15.  rdns = false
  16.  pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
  17.  default_ccache_name = KEYRING:persistent:%{uid}
  19. [realms]
  20.  DTSTACK.COM = {
  21.   kdc = host1
  22.   admin_server = host1
  23.  }
  25. [domain_realm]
  26.  .foo.com = FOO.COM
  27.  foo.com = FOO.COM

*分发krb5.conf至所有client： 这部CDH会帮着做，所以可以跳过

  1. pscp -h slaves krb5.conf /tmp
  2. pssh -h slaves "cp /tmp/krb5.conf /etc"

配置kdc.conf

/var/kerberos/krb5kdc/kdc.conf

  1. [kdcdefaults]
  2.  kdc_ports = 88
  3.  kdc_tcp_ports = 88
  5. [realms]
  6.  FOO.COM = {
  7.   #master_key_type = aes256-cts
  8.   acl_file = /var/kerberos/krb5kdc/kadm5.acl
  9.   dict_file = /usr/share/dict/words
  10.   admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  11.   supported_enctypes = aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
  12.   max_life = 25h
  13.   max_renewable_life = 8d
  14.  }

参考

https://blog.csdn.net/u011026329/article/details/79167884

JCE问题

Encryption type AES256CTS mode with HMAC SHA1-96 is not supported/enabled

  1. locate 'jre/lib/security' | grep 'lib/security$'
  3. /usr/java/jdk1.7.0_67-cloudera/jre/lib/security
  5. pscp UnlimitedJCEPolicy/*.jar /usr/java/jdk1.7.0_67-cloudera/jre/lib/security

https://stackoverflow.com/questions/12956037/gssexception-encryption-type-aes256cts-mode-with-hmac-sha1-96-is-not-suppo#comment83616975_12956037