Enabling Kerberos in an ODP Cluster

apt-get install krb5-kdc krb5-admin-server krb5-config -y

krb5_newrealm

​

This script should be run on the master KDC/admin server to initialize

a Kerberos realm. It will ask you to type in a master key password.

This password will be used to generate a key that is stored in

/etc/krb5kdc/stash. You should try to remember this password, but it

is much more important that it be a strong password than that it be

remembered. However, if you lose the password and /etc/krb5kdc/stash,

you cannot decrypt your Kerberos database.

Loading random data

Initializing database '/var/lib/krb5kdc/principal' for realm 'myexample.com',

master key name 'K/M@myexample.com'

You will be prompted for the database Master Password.

It is important that you NOT FORGET this password.

Enter KDC database master key:

Re-enter KDC database master key to verify:

​

Now that your realm is set up you may wish to create an administrative

principal using the addprinc subcommand of the kadmin.local program.

Then, this principal can be added to /etc/krb5kdc/kadm5.acl so that

you can use the kadmin program on other computers. Kerberos admin

principals usually belong to a single user and end in /admin. For

example, if jruser is a Kerberos administrator, then in addition to

the normal jruser principal, a jruser/admin principal should be

created.

​

Don't forget to set up DNS information so your clients can find your

KDC and admin servers. Doing so is documented in the administration

guide.

vi /etc/krb5kdc/kadm5.acl

*/admin *

*/admin@ADSRE.COM *

kadmin.local -q "addprinc admin/admin@ADSRE.COM"

systemctl restart krb5-admin-server

systemctl status krb5-admin-server

apt-get install krb5-user -y

kinit <princ>

​

klist

yum install krb5-server krb5-libs krb5-workstation

vi /etc/krb5.conf 

kdb5_util create -s -P Welcome

systemctl start krb5kdc

systemctl start kadmin

systemctl status krb5kdc

systemctl status kadmin

systemctl enable krb5kdc

systemctl enable kadmin

kadmin.local -q “addprinc admin/admin@ADSRE.COM”

​

systemctl restart kadmin

vi /var/kerberos/krb5kdc/kadm5.acl

​

*/admin@ADSRE.COM       *

​

systemctl restart kadmin

hadoop.http.authentication.simple.anonymous.allowed = true

​

hadoop.http.authentication.type = simple

kadmin.local -q "add_principal -pw <ADMIN_PASSWORD> admin/<EXTERNAL_HOSTNAME>@<REALM>"