question how does ambari set password while creating keytab for the service user like hdfs , hbase , hive ..etc in Support Questions

how does ambari set password while creating keytab for the service user like hdfs , hbase , hive ..etc

amol_08 — Mon, 01 Oct 2018 19:09:13 GMT

when we kerberized cluster from ambari we see keytabs are generated automatically for the user , we do not provide any password but ambari does , I want to know how does ambari does this .

for e.g if I have user for whom i want to generate keytab I will do the following steps :

kadmin.local: addprinc user1@TEST.COM

WARNING:no policy specified for user1@TEST.COM; defaulting to no policy

Enter password for principal "user1@TEST.COM": // here we are providing the password but when ambari does the same for the service user like hdfs what password does it set and how it does the same ? is there some script in the server which enables the same.

Re-enter password for principal "user1@TEST.COM":

Principal"user1@TEST.COM" created.

Re: how does ambari set password while creating keytab for the service user like hdfs , hbase , hive ..etc

Shelton — Mon, 01 Oct 2018 20:39:52 GMT

@Anurag Mishra

When you are kerberizing the cluster through Ambari you MUST first provide an admin principal and password which you created after creating your KDC databases

# kdb5_util create -s

You are then required to create an admin principal and password

# kadmin.local -q "addprinc admin/admin"

The warning

You will be prompted for the database Master Password.

It is important that you NOT FORGET this password.

Enter KDC database master key:

Re-enter KDC database master key to verify:

This the input requested when kerberizing through Ambari it will ask for

root/admin@{REALM} /password

Only after passing the correct values on the Enable Kerberos UI that you can proceed to generate successfully the keytabs. So to answer your question the Ambari picks your decrypts your admin password against the KDC private key and the allows you to generate the keytabs.

Hortonworks Kerberos document

See attached screenshot illustration

HTH

Re: how does ambari set password while creating keytab for the service user like hdfs , hbase , hive ..etc

amol_08 — Mon, 01 Oct 2018 21:26:30 GMT

Geoffrey Shelton Okot

Thanks for the reply !!!

but i was interested in knowing what password ambari use for the service like hdfs , hbase etc . Providing the admin password allows amabri to generate keytabs for the service user but internally it would be using some password at service level .

Re: how does ambari set password while creating keytab for the service user like hdfs , hbase , hive ..etc

sandyy006 — Tue, 02 Oct 2018 13:05:14 GMT

AFAIK, A random password is set for all the principals (hdfs , hbase , hive ..etc) .

Re: how does ambari set password while creating keytab for the service user like hdfs , hbase , hive ..etc

Shelton — Tue, 02 Oct 2018 17:06:04 GMT

@Anurag Mishra

The passwords generated randomly and encrypted using the supported encryption algorithms like fingerprints which are checked against the KDC databases for validity when you run the kinit.

HTH

Re: how does ambari set password while creating keytab for the service user like hdfs , hbase , hive ..etc

Shelton — Wed, 03 Oct 2018 14:05:16 GMT

@Anurag Mishra

If the response answered your question can you take time an login and "Accept" the answer and close the thread so other members can use it as a solution