question Re: Kerberos Checksum error in Support Questions

question Re: Kerberos Checksum error in Support Questions https://community.cloudera.com/t5/Support-Questions/Kerberos-Checksum-error/m-p/209236#M171192 @<A href="https://community.hortonworks.com/users/47312/baigmujeeb.html">M B</A>If you observe carefully, the encryption types in your krb5.conf have been commented out !!! The see the valid encryption types check your kdc.conf see below# cat /var/kerberos/krb5kdc/kdc.conf <PRE>[kdcdefaults] kdc_ports = 88 kdc_tcp_ports = 88 [realms] NANDOS.COM = { #master_key_type = aes256-cts acl_file = /var/kerberos/krb5kdc/kadm5.acl dict_file = /usr/share/dict/words admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal }</PRE>From the output, this is your original master key because the KVNO is 1 <PRE># kdb5_util list_mkeys Master keys for Principal: K/M@NANDOS.COM KVNO: 1, Enctype: aes256-cts-hmac-sha1-96, Active on: Thu Jan 01 01:00:00 CET 1970 * </PRE>Output looks correct <PRE># kadmin.local Authenticating as principal root/admin@NANDOS.COM with password. kadmin.local: getprinc hive/test.nandos.com@NANDOS.COM Principal: hive/test.nandos.com@NANDOS.COM Expiration date: [never] Last password change: Thu Aug 24 15:42:17 CEST 2017 Password expiration date: [none] Maximum ticket life: 1 day 00:00:00 Maximum renewable life: 0 days 00:00:00 Last modified: Thu Aug 24 15:42:17 CEST 2017 (root/admin@NANDOS.COM) Last successful authentication: [never] Last failed authentication: [never] Failed password attempts: 0 Number of keys: 8 Key: vno 1, aes256-cts-hmac-sha1-96 Key: vno 1, aes128-cts-hmac-sha1-96 Key: vno 1, des3-cbc-sha1 Key: vno 1, arcfour-hmac Key: vno 1, camellia256-cts-cmac Key: vno 1, camellia128-cts-cmac Key: vno 1, des-hmac-sha1 Key: vno 1, des-cbc-md5 MKey: vno 1 Attributes: Policy: [none] kadmin.local:</PRE>Can you do the following as hive user, <PRE>$ kdestroy</PRE>Check for the correct principal<PRE>$ klist -kt /etc/security/keytabs/hive.service.keytab</PRE>Then using the correct principal run kinit<PRE>$kinit -kt /etc/security/keytabs/hive.service.keytab hive/hdata1.xxxx.local@xxxx.LOCAL</PRE>Check the validity of the ticket <PRE>$klist </PRE>Try accessing <PRE>$ beeline</PRE>Connect with the correct principal<PRE>!connect jdbc:hive2://localhost:10000/default;principal=hive/hdata1.xxxx.local@xxxx.LOCAL;auth=kerberos</PRE>That should work please revert Mon, 27 Nov 2017 06:43:56 GMT Shelton 2017-11-27T06:43:56Z