zookeeper + kerberos

https://cwiki.apache.org/confluence/display/ZOOKEEPER/Server-Server+mutual+authentication  官网

 

https://article.itxueyuan.com/ylgo9Q

sessionRequireClientSASLAuth=true #客户端必须 SASL 认证

principal="zk-server/pxc1@ABC.COM";   #这里不同的主机上，需修改为本机的主机名

export SERVER_JVMFLAGS="-Djava.security.auth.login.config=/home/hadoop/app/apache-zookeeper-3.6.3-bin/conf/jaas.conf -Djava.security.krb5.conf=/home/hadoop/app/apache-zookeeper-3.6.3-bin/conf/krb5.conf"
export CLIENT_JVMFLAGS="${CLIENT_JVMFLAGS} -Djava.security.auth.login.config=/home/hadoop/app/apache-zookeeper-3.6.3-bin/conf/jaas.conf -Djava.security.krb5.conf=/home/hadoop/app/apache-zookeeper-3.6.3-bin/conf/krb5.conf -Dzookeeper.server.principal=zk-server/pxc1@ABC.COM" #这里不同的主机上，需修改为本机的主机名

 

 

https://blog.csdn.net/zhanglong_4444/article/details/118893733

主要用于问题定位&联调,

kdc服务日志 : 默认 /var/log/krb5kdc.log
server端日志: 默认 在${ZOOKEEPER_HOME}\bin\zookeeper.out文件中.
client端日志: 直接是在控制台输出的. 如果想看kerberos相关的信息, 查看 [2.5章节] 设置JVM参数 -Dsun.security.krb5.debug=true

 

 

https://www.jianshu.com/p/23c08900f44e(这个文档估计能解决问题)

 

修改zoo.cfg配置

authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider
jaasLoginRenew=3600000
kerberos.removeHostFromPrincipal=true
sasl.enabled.mechanisms=GSSAPI

requireClientAuthScheme=sasl

 

 

修改环境变量

 

bin/zkServer.sh