Kerberos How to kerberize a Hadoop Cluster

Most Hadoop clusters adopt Kerberos as the authentication protocol

Installing the KDC

• Starting Kerberos authentication requires the installation of the KDC server and the necessary software. The command to install the KDC can be executed on any machine.

Yum-y Install krb5-server krb5-lib krb5-auth-dialog krb5-workstation

• Next, install the Kerberos client and the command on the other nodes in the cluster

Yum-y Install Krb5-lib Krb5-auth-dialog krb5-workstation

• Edit the Realms,ad configured by the KDC (Active Directory)

The krb5.conf file contains the address of the KDCs, admin server, which is the default configuration for the current realm and Kerberos applications, which maps the hostname to Kerberos realms. Krb5.conf generally in/etc/krb5.conf

[Logging] Default= file:/var/log/Krb5libs.log KDC= file:/var/log/Krb5kdc.log Admin_server= file:/var/log/Kadmind.log[libdefaults] Default_realm=hadoop.com Dns_lookup_realm=falseDNS_LOOKUP_KDC=falseTicket_lifetime=24h Renew_lifetime=7d forwardable=true[Realms] hadoop.com={KDC=node1.hadoop.com Admin_server=node1.hadoop.com} Ad.com={KDC=windc.ad.com Admin_server=windc.ad.com} [Domain_realm]. hadoop.com=hadoop.com hadoop.com=hadoop.com. ad.com=ad.com ad.com=Ad.com[capaths] ad.com={hadoop.com= . }

Realms: Hadoop_com under the KDC, Admin_server is the host address of the KDC we installed, AD. Under COM is the Domain Controller host address.

Domain_realm: Provides conversion of domain name or host name to Kerberos realms name. Both must be lowercase.

capaths: Cross-realm authentication, a database is required between different realms to create authentication paths. This section defines the storage.

• Edit kdc.conf, default in/var/kerberos/krb5kdc/kdc.conf. Contains KDC configuration information, including the default value when Kerberos tickets is issued.

[Realms]   = {  = aes256-cts  =/var/kerberos/krb5kdc/kadm5.acl  =/usr/share/dict/  Words  =/var/kerberos/krb5kdc/kadm5.keytab  = Aes256-cts:normal aes128-cts:normal Des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-Crc:normal}

Kerberos How to kerberize a Hadoop Cluster