准备

主机名必须是FQDN形式，修改主机名为krb.bigdata.zxxk.com

hostnamectl set-hostname krb.bigdata.zxxk.com

/etc/hosts配置：

127.0.0.1 localhost 10.1.25.31 krb.bigdata.zxxk.com krb

部署

安装

yum install krb5-server krb5-libs krb5-workstation

配置

编辑 /etc/krb5.conf 文件，调整如下：

# Configuration snippets may be placed in this directory as well includedir /etc/krb5.conf.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] dns_lookup_realm = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true rdns = false pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt default_realm = BIGDATA.ZXXK.COM default_ccache_name = KEYRING:persistent:%{uid} [realms] # EXAMPLE.COM = { # kdc = kerberos.example.com # admin_server = kerberos.example.com # } BIGDATA.ZXXK.COM = { kdc = utility1.bigdata.zxxk.com admin_server = utility1.bigdata.zxxk.com } [domain_realm] # .example.com = EXAMPLE.COM # example.com = EXAMPLE.COM .bigdata.zxxk.com = BIGDATA.ZXXK.COM bigdata.zxxk.com = BIGDATA.ZXXK.COM

编辑 /var/kerberos/krb5kdc/kdc.conf 文件，调整如下：

[kdcdefaults] kdc_ports = 88 kdc_tcp_ports = 88 [realms] BIGDATA.ZXXK.COM = { kadmind_port = 749 max_life = 12h 0m 0s max_renewable_life = 7d 0h 0m 0s master_key_type = aes256-cts acl_file = /var/kerberos/krb5kdc/kadm5.acl dict_file = /usr/share/dict/words admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal } [logging] # By default, the KDC and kadmind will log output using # syslog. You can instead send log output to files like this: kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmin.log default = FILE:/var/log/krb5lib.log

创建KDC数据库

kdb5_util create -r BIGDATA.ZXXK.COM -s

创建管理员

执行kadmin.local进入管理交互程序，创建管理员如下：

addprinc admin/admin@BIGDATA.ZXXK.COM

启动Kerberos守护进程

systemctl start krb5kdc systemctl start kadmin systemctl enable krb5kdc systemctl enable kadmin

Kerberos client配置

yum install krb5-libs krb5-workstation

将server端的 /etc/krb5.conf 文件同步到client端。