Hbase安装kerberos及远程登录配置

1. 安装ZK, 单机多实例配置及启动

· 创建data目录, 创建datalog目录

· 1040 mkdir data

1041 cd data/

1043 mkdir slave1

1044 mkdir slave2

1045 mkdir slave3

1046 cd ..

1047 mkdir datalog

1048 cd datalog/

1049 mkdir slave1

1051 mkdir slave2

1052 mkdir slave3

· 配置zoo.cfg,拷贝配置文件，生成三个配置文件：zoo-slave1.cfg:（另外两个 zoo-slave2.cfg 和zoo-slave3.cfg）。

· Zoo-slave1.cfg:

· tickTime=2000

initLimit=10

syncLimit=5

dataDir=/opt/zookeeper-3.4.8/data/slave1

clientPort=2181

dataLogDir=/opt/zookeeper-3.4.8/datalog/slave1

server.1=mj1:2889:3889

server.2= mj1:2890:3890

server.3= mj1:2891:3891

zoo-slave2.cfg:

tickTime=2000

initLimit=10

syncLimit=5

dataDir=/opt/zookeeper-3.4.8/data/slave2

clientPort=2182

dataLogDir=/opt/zookeeper-3.4.8/datalog/slave2

server.1= mj1:2889:3889

server.2= mj1:2890:3890

server.3= mj1:2891:3891

zoo-slave3.cfg:

tickTime=2000

initLimit=10

syncLimit=5

dataDir=/opt/zookeeper-3.4.8/data/slave3

clientPort=2183

dataLogDir=/opt/zookeeper-3.4.8/datalog/slave3

server.1= mj1:2889:3889

server.2= mj1:2890:3890

server.3= mj1:2891:3891

· 如何区分到底是第几个实例呢，就要有个id文件，名字必须是myid

[root@gateway data]# echo "1" > slave1/myid

[root@gateway data]# echo "2" > slave2/myid

[root@gateway data]# echo "3" > slave3/myid

· 启动

bin/zkServer.sh start zoo-slave1.cfg

bin/zkServer.sh start zoo-slave2.cfg

bin/zkServer.sh start zoo-slave3.cfg

bin/zkServer.sh status zoo-slave1.cfg

bin/zkCli.sh

2. ZK + kerberos

· KDC:

kadmin.local: addprinc -randkey zookeeper/[email protected]

kadmin.local: addprinc -randkey [email protected]

kadmin.local: xst -k zookeeper.keytab zookeeper/[email protected]

kadmin.local: xst -norandkey -k zkcli.keytab [email protected]

· zoo-slave1.cfg,zoo-slave2.cfg,zoo-slave3.cfg:

authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider

jaasLoginRenew=3600000

· /opt/zookeeper-3.4.8/conf/jaas.conf

Server {

com.sun.security.auth.module.Krb5LoginModule required

useKeyTab=true

keyTab="/opt/zookeeper-3.4.8/conf/zookeeper.keytab"

storeKey=true

useTicketCache=false

principal="zookeeper/mj1@YOUR.DOMAIN_NAME";

};

Client {

com.sun.security.auth.module.Krb5LoginModule required

useKeyTab=true

keyTab="/opt/zookeeper-3.4.8/conf/zkcli.keytab"

storeKey=true

useTicketCache=false

principal="zkcli@YOUR.DOMAIN_NAME";

};

· /opt/zookeeper-3.4.8/conf/java.env

export JVMFLAGS="-Djava.security.auth.login.config=/opt/zookeeper-3.4.8/conf/jaas.conf"

3. HBASE

· Hbase-site.xml:

<name>hbase.rootdir</name>

<value>hdfs://mj1:9000/hbase</value>

</property>

<name>hbase.cluster.distributed</name>

</property>

<name>hbase.tmp.dir</name>

<value>/opt/hbase-1.2.1/tmp</value>

</property>

<name>hbase.zookeeper.quorum</name>

</property>

<name>hbase.zookeeper.property.clientPort</name>

</property>

<name>hbase.zookeeper.property.dataDir</name>

<value>/opt/zookeeper-3.4.6</value>

</property>

<name>hbase.security.authorization</name>

</property>

<!--<property>

<name>hbase.coprocessor.master.classes</name>

<value>org.apache.ranger.authorization.hbase.RangerAuthorizationCoprocessor</value>

</property>

<name>hbase.coprocessor.region.classes</name>

<value>org.apache.ranger.authorization.hbase.RangerAuthorizationCoprocessor</value>

</property>-->

<name>hbase.security.authentication</name>

<value>kerberos</value>

</property>

<name>hbase.regionserver.kerberos.principal</name>

<value>hbase/mj1@YOUR.DOMAIN_NAME</value>

</property>

<name>hbase.regionserver.keytab.file</name>

<value>/opt/hbase-1.2.1/conf/hbase.keytab</value>

</property>

<name>hbase.master.kerberos.principal</name>

<value>hbase/mj1@YOUR.DOMAIN_NAME</value>

</property>

<name>hbase.master.keytab.file</name>

<value>/opt/hbase-1.2.1/conf/hbase.keytab</value>

</property>

</configuration>

· hbase conf目录创建jaas.conf，文件内容和zk配置一致

Client {

com.sun.security.auth.module.Krb5LoginModule required

useKeyTab=true

keyTab="/opt/zookeeper-3.4.8/conf/zkcli.keytab"

storeKey=true

useTicketCache=false

principal="zkcli@YOUR.DOMAIN_NAME";

};

· hbase-env.sh添加

export HBASE_OPTS="$HBASE_OPTS -Djava.security.auth.login.config=/opt/hbase-1.2.1/conf/jaas.conf"

export HBASE_MANAGES_ZK=false

· zoo.cfg添加下两行

kerberos.removeHostFromPrincipal=true

kerberos.removeRealmFromPrincipal=true

· 重启zk和Hbase

若要在client端登录远程的Hbase，则还需要修改如下配置：

/opt/hadoop-2.7.2/etc/hadoop/core-site.xml:

添加如下配置：

<name>hadoop.proxyuser.hbase.hosts</name>

</property>

<name>hadoop.proxyuser.hbase.groups</name>

</property>

其中，name中的hbase为client端登录远程hbase时所用的kerberos的principal。

Client端需要的配置文件内容如下：

<name>hbase.zookeeper.quorum</name>

</property>

<name>hbase.zookeeper.property.clientPort</name>

</property>

<name>hbase.security.authorization</name>

</property>

<name>hbase.security.authentication</name>

<value>kerberos</value>

</property>

<!--<property>

<name>hbase.zookeeper.client.kerberos.principal</name>

<value>client/mj1@YOUR.DOMAIN_NAME</value>

</property>

<name>hbase.zookeeper.client.keytab.file</name>

<value>/opt/hbase-1.2.1/back_conf/client.keytab</value>

</property>-->

<name>hbase.regionserver.kerberos.principal</name>

<value>hbase/mj1@YOUR.DOMAIN_NAME</value>

</property>

<name>hbase.master.kerberos.principal</name>

<value>hbase/mj1@YOUR.DOMAIN_NAME</value>

</property>

</configuration>

在client端，kinit –kt hbase.keytab hbase/mj1@YOUR.DOMAIN_NAME,使得client以hbase用户的身份去和zookeeper连接，以hbase用户的身份去和master和regionserver交互。

配置错误集结：

Org.apache.hadoop.ipc.RemoteException:User:rootis not allowed to impersonate root;

解决方法：参照上述对hadoop中core-site.xml的添加配置项。

注意:在hbase安装了kerberos之后，若以zkcli@YOUR.DOMAIN_NAME的身份登录hbase，在zookeeper上的/hbase目录下创建znode节点的时候，所创建的节点的权限会变为

'world,'anyone
: r
'sasl,'zkcli
: cdrwa

所以，要是继续在/hbase目录下创建节点，则访问节点的时候会报错：Authentication is not valid

若是使用zkcli命令行创建节点，则用如下命令create / znode1 sasl:zkcli@YOUR.DOMAIN_NAME

Hbase安装kerberos及远程登录配置

猜你喜欢