[root@manager80 ~]# kdb5_util create -s -r BIGDATA Loading random data Initializing database '/var/kerberos/krb5kdc/principal' for realm 'BIGDATA', master key name 'K/M@BIGDATA' You will be prompted for the database Master Password. It is important that you NOT FORGET this password. Enter KDC database master key: -- 输入密码，可与 MySQL 数据库密码相同 Re-enter KDC database master key to verify: -- 再次输入密码
[root@manager80 krb5kdc]# kadmin.local -q "addprinc admin/admin@BIGDATA" Authenticating as principal root/admin@BIGDATA with password. WARNING: no policy specified for admin/admin@BIGDATA; defaulting to no policy Enter password for principal "admin/admin@BIGDATA": -- 输入密码，可与 root 密码一致 Re-enter password for principal "admin/admin@BIGDATA": -- 再次输入密码 Principal "admin/admin@BIGDATA" created.
[root@manager80 ~]# kdb5_util create -s -r BIGDATA Loading random data Initializing database '/var/kerberos/krb5kdc/principal' for realm 'BIGDATA', master key name 'K/M@BIGDATA' You will be prompted for the database Master Password. It is important that you NOT FORGET this password. Enter KDC database master key: -- 输入密码 Re-enter KDC database master key to verify: -- 再次输入密码
查看生成的文件
1 2 3 4 5 6 7 8 9
[root@manager80 ~]# cd /var/kerberos/krb5kdc/ [root@manager80 krb5kdc]# ll total 24 -rw-------. 1 root root 18 Oct 3 14:27 kadm5.acl -rw-------. 1 root root 512 Oct 3 14:26 kdc.conf -rw-------. 1 root root 8192 Oct 3 14:38 principal -rw-------. 1 root root 8192 Oct 3 14:38 principal.kadm5 -rw-------. 1 root root 0 Oct 3 14:38 principal.kadm5.lock -rw-------. 1 root root 0 Oct 3 14:38 principal.ok
也可以直接使用 -P 加密码的方式创建数据库。
1 2 3 4
[root@master81 ~]# kdb5_util create -s -r BIGDATA -P Bigdata123 Loading random data Initializing database '/var/kerberos/krb5kdc/principal' for realm 'BIGDATA', master key name 'K/M@BIGDATA'
此命令中 Bigdata123 为密码。
查看 KDC 备节点生成的文件。
1 2 3 4 5 6 7 8 9
[root@master81 ~]# cd /var/kerberos/krb5kdc/ [root@master81 krb5kdc]# ll total 24 -rw-------. 1 root root 18 Oct 3 14:32 kadm5.acl -rw-------. 1 root root 512 Oct 3 14:32 kdc.conf -rw-------. 1 root root 8192 Oct 3 14:41 principal -rw-------. 1 root root 8192 Oct 3 14:41 principal.kadm5 -rw-------. 1 root root 0 Oct 3 14:41 principal.kadm5.lock -rw-------. 1 root root 0 Oct 3 14:41 principal.ok
[root@manager80 krb5kdc]# kadmin.local -q "addprinc -pw admin admin/admin" Authenticating as principal root/admin@BIGDATA with password. WARNING: no policy specified for admin/admin@BIGDATA; defaulting to no policy Principal "admin/admin@BIGDATA" created.
[root@manager80 ~]# kadmin.local Authenticating as principal admin/admin@BIGDATA with password. kadmin.local: ? Available kadmin.local requests:
add_principal, addprinc, ank Add principal delete_principal, delprinc Delete principal modify_principal, modprinc Modify principal rename_principal, renprinc Rename principal change_password, cpw Change password get_principal, getprinc Get principal list_principals, listprincs, get_principals, getprincs List principals add_policy, addpol Add policy modify_policy, modpol Modify policy delete_policy, delpol Delete policy get_policy, getpol Get policy list_policies, listpols, get_policies, getpols List policies get_privs, getprivs Get privileges ktadd, xst Add entry(s) to a keytab ktremove, ktrem Remove entry(s) from a keytab lock Lock database exclusively (use with extreme caution!) unlock Release exclusive database lock purgekeys Purge previously retained old keys from a principal get_strings, getstrs Show string attributes on a principal set_string, setstr Set a string attribute on a principal del_string, delstr Delete a string attribute on a principal list_requests, lr, ? List available requests. quit, exit, q Exit program.
kadmin.local: addprinc test/localhost WARNING: no policy specified for test/localhost@BIGDATA; defaulting to no policy Enter password for principal "test/localhost@BIGDATA": -- 输入密码 Re-enter password for principal "test/localhost@BIGDATA": -- 再次输入密码 Principal "test/localhost@BIGDATA" created.
Valid starting Expires Service principal 10/04/2021 10:24:44 10/05/2021 10:24:44 krbtgt/BIGDATA@BIGDATA renew until 10/11/2021 10:24:44
change_password
修改 principal 的密码。
1 2 3 4
kadmin.local: change_password test/localhost@BIGDATA Enter password for principal "test/localhost@BIGDATA": -- 输入新的密码 Re-enter password for principal "test/localhost@BIGDATA": -- 重新输入新的密码 Password for "test/localhost@BIGDATA" changed.
delprinc
删除 principal。
1 2 3 4
kadmin.local: delprinc test/localhost Are you sure you want to delete the principal "test/localhost@BIGDATA"? (yes/no): yes Principal "test/localhost@BIGDATA" deleted. Make sure that you have removed this principal from all ACLs before reusing.
options: -V verbose -l lifetime -s start time -r renewable lifetime -f forwardable -F not forwardable -p proxiable -P not proxiable -n anonymous -a include addresses -A do not include addresses -v validate -R renew -C canonicalize -E client is enterprise principal name -k use keytab -i use default client keytab (with -k) -t filename of keytab to use -c Kerberos 5 cache name -S service -T armor credential cache -X <attribute>[=<value>]
使用密码认证
直接输入 kinit principal，然后根据提示输入密码进行认证。
1 2
[root@manager80 ~]# kinit admin/admin Password for admin/admin@BIGDATA: -- 输入密码
[hdfs@manager80 keytabs]$ kdestroy [hdfs@manager80 keytabs]$ klist klist: No credentials cache found (filename: /tmp/krb5cc_1007)
ktutil
ktutil 是操作 keytab 文件的工具集。
1 2 3 4 5 6 7 8 9 10 11 12 13 14
[root@manager80 ~]# ktutil ktutil: ? Available ktutil requests:
clear_list, clear Clear the current keylist. read_kt, rkt Read a krb5 keytab into the current keylist. read_st, rst Read a krb4 srvtab into the current keylist. write_kt, wkt Write the current keylist to a krb5 keytab. write_st, wst Write the current keylist to a krb4 srvtab. add_entry, addent Add an entry to the current keylist. delete_entry, delent Delete an entry from the current keylist. list, l List the current keylist. list_requests, lr, ? List available requests. quit, exit, q Exit program.