question Re: Kerberos Setup on HDP 2.6 in Support Questions

Kerberos Setup on HDP 2.6

ryanoberoi9999 — Mon, 22 May 2017 13:45:58 GMT

Hi,

I want to setup kerberos on HDP 2.6. i have never done this before. Can anyone share the step by step commands/procedure on how to go about it? i am totally new to kerberos. i am using Centos.

Re: Kerberos Setup on HDP 2.6

jsensharma — Mon, 22 May 2017 14:02:01 GMT

@Rishabh Oberoi

Please refer to the following doc to know how to install KDC: http://docs.hortonworks.com/HDPDocuments/Ambari-2.5.0.3/bk_ambari-security/content/optional_install_a_new_mit_kdc.html

Then you can refer to the ambari Doc to know how to setup kerberos: https://docs.hortonworks.com/HDPDocuments/Ambari-2.5.0.3/bk_ambari-security/content/set_up_kerberos_for_ambari_server.html

Re: Kerberos Setup on HDP 2.6

sgowda — Mon, 22 May 2017 14:04:31 GMT

Hello @Rishabh Oberoi

Please refer to below link

http://docs.hortonworks.com/HDPDocuments/Ambari-2.5.0.3/bk_ambari-security/content/ch_configuring_amb_hdp_for_kerberos.html

Re: Kerberos Setup on HDP 2.6

jsensharma — Mon, 22 May 2017 14:04:57 GMT

@Rishabh Oberoi

For the step by Step instructions the Following Hortonorks Article and Youtube Video will be more useful:

https://community.hortonworks.com/articles/82536/configuring-ambari-and-hadoop-for-kerberos-using-a.html

Hortonworks HDP 2.5 Kerberos with Active Directory as the KDC : https://www.youtube.com/watch?v=-HMyEpDJeGg&feature=youtu.be

Re: Kerberos Setup on HDP 2.6

gvishal — Wed, 09 Aug 2017 21:15:14 GMT

Hello Team, Just wondering if we have an updated documentation for kerberos setup on HDP 2.6. I am mainly interested in the checks we should be doing before starting kerberos setup using Ambari. The challenge using Ambari for kerberos setup is that if it gets stuck then getting cluster back is a nightmare. Even the 'skip' button on Ambari becomes unavailable many times. The cluster all services green on Ambari may not be complete confirmation that cluster is in the good state to start the kerberos installation.

with Manual installation, atleast we know the steps followed and rollback may be a bit easier. Thanks

Re: Kerberos Setup on HDP 2.6

Shelton — Wed, 09 Aug 2017 21:47:46 GMT

Assumption

REALM=GOLD.COM
REALM Password =welcome1
KDC_HOST =KDC_SERVER_FQDN

Install kerberos package

yum install -y krb5-server krb5-libs krb5-workstation

Edit Server Configuration Files

The configuration files for the server are located in the directory /var/kerberos/krb5kdc edit the 2 files

kdc.conf
kadm5.acl
The conf file is the server configuration and the acl file, well the ACL. The ACL grants all privileges to anyone one with the admin role. Change the Kerberos GOLD.COM realm

cd /var/kerberos/krb5kdc/
vi kadm5.acl replace the REALM after the @ with the below

*/admin@GOLD.COM      *

Edit the kdc.conf

    [kdcdefaults]
    kdc_ports = 88
    kdc_tcp_ports = 88

    [realms]
    GOLD.COM = {
    #master_key_type = aes256-cts
    acl_file = /var/kerberos/krb5kdc/kadm5.acl
    dict_file = /usr/share/dict/words
    admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
    supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
    }

Edit the Client Configuration

Update the krb.conf on the KDC server copy this file to all the host in the cluster in the below directory /etc/krb5.conf

vi /etc/krb5.conf

# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/

[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
default_realm = GOLD.COM
default_ccache_name = KEYRING:persistent:%{uid}

[realms]
GOLD.COM = {
kdc = KDC_SERVER_FQDN
admin_server = KDC_SERVER_FQDN
}

[domain_realm]
.gold.com = GOLD.COM
gold.com = GOLD.COM

Create the DC database

When creating the KDC database we will need an entropy pool of random data

sudo kdb5_util create -s -r GOLD.COM 

Loading random data 

Initializing database '/var/kerberos/krb5kdc/principal' for realm 'GOLD.COM', 

master key name 'K/M@GOLD.COM' 

You will be prompted for the database Master Password. It is important that you NOT FORGET this password.Enter KDC database master key: welcome1 

Re-enter KDC database master key to verify: welcome1

Start and Enable Kerberos

Start and enable the two services ensure you run status command to validate that kadmin is running

# sudo systemctl start krb5kdc kadmin
# sudo systemctl enable krb5kdc kadmin
Created symlink from /etc/systemd/system/multi-user.target.wants/krb5kdc.service to /usr/lib/systemd/system/krb5kdc.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/kadmin.service to /usr/lib/systemd/system/kadmin.service.

Check the Principals

# sudo kadmin.local
Authenticating as principal root/admin@GOLD.COM with password.
kadmin.local:  listprincs
K/M@GOLD.COM
kadmin/admin@GOLD.COM
kadmin/changepw@GOLD.COM
kadmin/KDC_SERVER_FQDN@GOLD.COM
kiprop/KDC_SERVER_FQDN@GOLD.COM
krbtgt/UPUTEST.CH@UPUTEST.CH
kadmin.local:

Must create a root principal for kerberization

kadmin.local:  addprinc root/admin
WARNING: no policy specified for root/admin@GOLD.COM; defaulting to no policy
Enter password for principal "root/admin@GOLD.COM":
Re-enter password for principal "root/admin@GOLD.COM":
Principal "root/admin@GOLD.COM" created.

Install kerberos Client package

on tall the hosts in the cluster install the client

yum install -y krb5-libs krb5-workstation

This will deliver the necessary files copy the krb5.conf from the KDC server to all the client hosts

Invoke kerberos tool in Ambari

When running the kerberization tool in Ambari use

root/admin@GOLD.COM password welcome1

Follow the instructions take care that you installed JCE on the KDC server

Re: Kerberos Setup on HDP 2.6

gvishal — Thu, 10 Aug 2017 09:15:19 GMT

Hello Geoffrey, Just wondering if you have similar instructions unkerberoize the cluster in case we fail to successfully setup the keberos.

Thanks for the instructions and help.

Re: Kerberos Setup on HDP 2.6

Shelton — Thu, 10 Aug 2017 14:53:00 GMT

@Vishal Gupta

Unfortunately the only proper method is going through the Ambari UI.

Make sure you have the KDC credential and ensure the KDc server is accessible and running.

Log in to Ambari Web and Browse to Admin > Kerberos.
Click Disable Kerberos to launch the wizard.
Complete the wizard.
Restart all the HDP components

Official doc

Hope that helps

Re: Kerberos Setup on HDP 2.6

gvishal — Thu, 10 Aug 2017 19:51:51 GMT

Hello Geoffrey, I agree. The challenge we face last time is that cluster unkerberization via Ambari get stuck and then doing it manually using the link https://stackoverflow.com/questions/29744821/how-to-disable-hadoop-kerberos help a bit but not completely. We now have to re-initialize the whole cluster and this time, using Ambari it gets setup successfully. Looks like it is important to have a pre-kerberozation check list to make sure that the cluster is in proper state before start of this exercise. Thanks for your time and sharing the knowhow. Appreciate it. Best Regards,

Re: Kerberos Setup on HDP 2.6

Shelton — Thu, 10 Aug 2017 20:14:10 GMT

@Vishal Gupta

Experience is the best teacher, its always good to follow the official documentation I have never failed to to kerberize because I stick to the document. The setup of the KDC and KDC clients is key to successfully kerberize and unkerberize a HDP cluster. Remember to document always 🙂
If my helped you then,you can accept and close this thread.

Re: Kerberos Setup on HDP 2.6

Shelton — Thu, 10 Aug 2017 20:15:31 GMT

@Vishal Gupta

Re: Kerberos Setup on HDP 2.6

Former Member — Wed, 20 Jun 2018 04:33:28 GMT

Ambari doesn't have mechanism to install KDC and deploy kerberos set up like cloudera manager ?

Appreciate if someone provide glimpse on this ?

Re: Kerberos Setup on HDP 2.6

Shelton — Wed, 20 Jun 2018 05:23:34 GMT

@Vishal Gupta

I don't think Cloudera Manager does install the KDC and the client automatically. Whether you are using Cloudera or Hortonworks you will first need to have a working KDC server(krb5-server) and Kerberos clients (krb5-workstation, krb5-libs) and realm setup in both cases you will either use the CM or Ambari Kerberos wizard.

Having said that I provided a walkthrough to help you set up Kerberos on HDP, and consequent questions should be opened as new threads this revived quest dates from August 2017! 🙂

It will be great if you can marked this HCC thread as Answered by clicking on the "Accept" Button. That way other HCC users can quickly find the solution when they encounter the same issue.

HTH

Re: Kerberos Setup on HDP 2.6

muditcse — Sat, 23 Jun 2018 22:46:54 GMT

@Geoffrey Shelton OkotCan my KDC server and AD be same?I donot fine HDP documentation straightforward with clear instructions for enabling kerberos with AD.

Re: Kerberos Setup on HDP 2.6

alex_goron — Fri, 26 Oct 2018 21:42:41 GMT

@Geoffrey Shelton Okot , the official documentation does not list the steps of installing kerberos clients and propagating krb5.conf to all the nodes. Does this mean Ambari tool will propagate krb5.conf and install krb5-workstation for me? I know using Cloudera Manager I have to set up clients as well which makes absolutely perfect sense. I just wanted to know for sure before I execute the wizard.

Re: Kerberos Setup on HDP 2.6

Shelton — Fri, 26 Oct 2018 23:26:15 GMT

@Alex Goron

Unfortunately, Ambari also doesn't push the krb5.conf, you need the install the Kerberos client on all the client nodes this will deliver the krb5.conf which you will need to modify using the correct REALM name and KDC hostname

Server install

yum install krb5-server krb5-libs krb5-workstation

KDC server package:

krb5-server
Admin package: krb5-libs

Client install

yum install  krb5-workstation

Client package:

krb5-workstation

Configuration Files:

/var/kerberos/krb5kdc/kdc.conf {Present ONLY on server}
/var/kerberos/krb5kdc/kadm5.acl {Present ONLY on server}
/etc/krb5.conf {Present both server/client}

After editing the above files then you can run the Ambari Kerberos tool it should run successfully

Re: Kerberos Setup on HDP 2.6

alex_goron — Sat, 27 Oct 2018 01:54:35 GMT

Thanks a lot @Geoffrey Shelton Okot! Makes perfect sense to me.

Re: Kerberos Setup on HDP 2.6

Shelton — Sat, 27 Oct 2018 04:34:27 GMT

@Alex Goron

Great then if that answered your question then can you take some time and "Accept" so that other members can reference it.

Re: Kerberos Setup on HDP 2.6

alex_goron — Sat, 27 Oct 2018 05:55:55 GMT

@Geoffrey Shelton Okot , I would love to do so, but I can not see that "Accept" button ...

Alex

Re: Kerberos Setup on HDP 2.6

Shelton — Sun, 18 Aug 2019 09:01:42 GMT

@Alex Goron

Here you go