Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

Kerberos Setup on HDP 2.6

avatar

Hi,

I want to setup kerberos on HDP 2.6. i have never done this before. Can anyone share the step by step commands/procedure on how to go about it? i am totally new to kerberos. i am using Centos.

1 ACCEPTED SOLUTION

avatar
Master Mentor
hide-solution

This problem has been solved!

Want to get a detailed solution you have to login/registered on the community

Register/Login
22 REPLIES 22

avatar
Master Mentor

@Vishal Gupta

Experience is the best teacher, its always good to follow the official documentation I have never failed to to kerberize because I stick to the document. The setup of the KDC and KDC clients is key to successfully kerberize and unkerberize a HDP cluster. Remember to document always 🙂
If my helped you then,you can accept and close this thread.

avatar

Ambari doesn't have mechanism to install KDC and deploy kerberos set up like cloudera manager ?

Appreciate if someone provide glimpse on this ?

avatar
Master Mentor

@Vishal Gupta

I don't think Cloudera Manager does install the KDC and the client automatically. Whether you are using Cloudera or Hortonworks you will first need to have a working KDC server(krb5-server) and Kerberos clients (krb5-workstation, krb5-libs) and realm setup in both cases you will either use the CM or Ambari Kerberos wizard.

Having said that I provided a walkthrough to help you set up Kerberos on HDP, and consequent questions should be opened as new threads this revived quest dates from August 2017! 🙂

It will be great if you can marked this HCC thread as Answered by clicking on the "Accept" Button. That way other HCC users can quickly find the solution when they encounter the same issue.

HTH

avatar
Explorer

@Geoffrey Shelton OkotCan my KDC server and AD be same?I donot fine HDP documentation straightforward with clear instructions for enabling kerberos with AD.

avatar
Contributor

@Geoffrey Shelton Okot , the official documentation does not list the steps of installing kerberos clients and propagating krb5.conf to all the nodes. Does this mean Ambari tool will propagate krb5.conf and install krb5-workstation for me? I know using Cloudera Manager I have to set up clients as well which makes absolutely perfect sense. I just wanted to know for sure before I execute the wizard.

avatar
Master Mentor

@Alex Goron

Unfortunately, Ambari also doesn't push the krb5.conf, you need the install the Kerberos client on all the client nodes this will deliver the krb5.conf which you will need to modify using the correct REALM name and KDC hostname

Server install

yum install krb5-server krb5-libs krb5-workstation

KDC server package:

krb5-server
Admin package: krb5-libs 

Client install

yum install  krb5-workstation

Client package:

krb5-workstation


Configuration Files:

/var/kerberos/krb5kdc/kdc.conf {Present ONLY on server}
/var/kerberos/krb5kdc/kadm5.acl {Present ONLY on server}
/etc/krb5.conf {Present both server/client}

After editing the above files then you can run the Ambari Kerberos tool it should run successfully



avatar
Contributor

Thanks a lot @Geoffrey Shelton Okot! Makes perfect sense to me.

avatar
Master Mentor

@Alex Goron

Great then if that answered your question then can you take some time and "Accept" so that other members can reference it.

avatar
Contributor

@Geoffrey Shelton Okot , I would love to do so, but I can not see that "Accept" button ...

Alex

avatar
Master Mentor

@Alex Goron

Here you go

93025-accept.jpg