Kerberos操作指南

1.Kerberos常用命令

1.1. 登录管理KDC服务器，登录后台

kadmin.local

 

2. 查看用户列表

listprincs

 

3.修改帐号密码(可修改忘记密码)

[root@dounine ~]# kadmin.local
Authenticating as principal root/admin@EXAMPLE.COM with password.
kadmin.local:  change_password admin/admin@EXAMPLE.COM
Enter password for principal "admin/admin@EXAMPLE.COM": 123456
Re-enter password for principal "admin/admin@EXAMPLE.COM": 123456
Password for "admin/admin@EXAMPLE.COM" changed.

 

4.创建用户

[root@dounine ~]# kadmin.local
Authenticating as principal root/admin@EXAMPLE.COM with password.
kadmin.local:  add_principal test1
WARNING: no policy specified for test1@EXAMPLE.COM; defaulting to no policy
Enter password for principal "test1@EXAMPLE.COM": 123456
Re-enter password for principal "test1@EXAMPLE.COM": 123456
Principal "test1@EXAMPLE.COM" created.

 

5.删除用户

[root@dounine ~]# kadmin.local
Authenticating as principal root/admin@EXAMPLE.COM with password.
kadmin.local:  delete_principal test1
Are you sure you want to delete the principal "test1@EXAMPLE.COM"? (yes/no): yes
Principal "test1@EXAMPLE.COM" deleted.
Make sure that you have removed this principal from all ACLs before reusing.

 

6. 只导出用户keytab文件(并且不要修改密码)

root@dounine ~]# kadmin.local
Authenticating as principal root/admin@EXAMPLE.COM with password.
kadmin.local:  xst -k admin.keytab -norandkey admin/admin@EXAMPLE.COM
Entry for principal admin/admin@EXAMPLE.COM with kvno 6, encryption type aes256-cts-hmac-sha1-96 added to keytab WRFILE:admin.keytab.
Entry for principal admin/admin@EXAMPLE.COM with kvno 6, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:admin.keytab.
Entry for principal admin/admin@EXAMPLE.COM with kvno 6, encryption type des3-cbc-sha1 added to keytab WRFILE:admin.keytab.
Entry for principal admin/admin@EXAMPLE.COM with kvno 6, encryption type arcfour-hmac added to keytab WRFILE:admin.keytab.
Entry for principal admin/admin@EXAMPLE.COM with kvno 6, encryption type camellia256-cts-cmac added to keytab WRFILE:admin.keytab.
Entry for principal admin/admin@EXAMPLE.COM with kvno 6, encryption type camellia128-cts-cmac added to keytab WRFILE:admin.keytab.
Entry for principal admin/admin@EXAMPLE.COM with kvno 6, encryption type des-hmac-sha1 added to keytab WRFILE:admin.keytab.
Entry for principal admin/admin@EXAMPLE.COM with kvno 6, encryption type des-cbc-md5 added to keytab WRFILE:admin.keytab.
kadmin.local:  exit

 

7. 使用Keytab验证是否可以登录（无错误输出即可）

kinit -kt /etc/security/keytabs/admin.keytab admin/admin@EXAMPLE.COM

 

8.查看Keytab文件中的账号列表

[root@dounine ~]# klist -ket hbase.headless.keytab

Keytab name: FILE:hbase.headless.keytab
KVNO Timestamp           Principal
---- ------------------- ------------------------------------------------------
   7 2018-07-30T10:19:16 hbase-flink@demo.com (des-cbc-md5) 
   7 2018-07-30T10:19:16 hbase-flink@demo.com (aes128-cts-hmac-sha1-96) 
   7 2018-07-30T10:19:16 hbase-flink@demo.com (aes256-cts-hmac-sha1-96) 
   7 2018-07-30T10:19:16 hbase-flink@demo.com (des3-cbc-sha1) 
   7 2018-07-30T10:19:16 hbase-flink@demo.com (arcfour-hmac)

 

2. Kerberos 常用命令总结

# 进入kadmin
kadmin.local / kadmin
 
# 创建数据库
kdb5_util create -r JENKIN.COM -s
 
# 启动kdc服务
service krb5kdc start
 
# 启动kadmin服务
service kadmin start
 
# 修改当前密码
kpasswd
 
# 测试keytab可用性 / 通过keytab文件认证登录
kinit -kt /etc/security/keytabs/root.keytab root/cdh-master.hadoop.cn@HADOOP.CN
 
# 查看keytab
klist -e -k -t /etc/krb5.keytab
 
# 清除缓存
kdestroy
 
 
# kadmin 模式下
# 生成随机key的principal
addprinc -randkey root/master.hadoop.cn@HADOOP.CN
 
# 生成指定key的principal
Addprinc -pw **** admin/admin@JENKIN.COM
 
# 查看principal
listprincs
 
# 修改admin/admin的密码
cpw -pw xxxx admin/admin
 
# 添加/删除principle
addprinc/delprinc admin/admin
 
# 直接生成到keytab
ktadd -k /etc/krb5.keytab host/master1@JENKIN.COM　
 
# 设置密码策略(policy)
addpol -maxlife "90 days" -minlife "75 days" -minlength 8 -minclasses 3 -maxfailure 10 -history 10 user
 
# 添加带有密码策略的用户
addprinc -policy user hello/admin@HADOOP.COM
 
# 修改用户的密码策略
modprinc -policy user1 hello/admin@HADOOP.COM
 
# 删除密码策略
delpol [-force] user
 
# 修改密码策略
modpol -maxlife "90 days" -minlife "75 days" -minlength 8 -minclasses 3 -maxfailure 10 user

 

3. 卸载 krb5-server

sudo yum remove krb5-server
sudo yum remove krb5-libs
sudo yum remove  krb5-workstation
rm -rf/var/kerberos/
rm/etc/krb5.conf
rm -rf/usr/lib64/krb5