Created on 10-09-2019 09:39 AM - last edited on 10-09-2019 09:47 AM by lwang
I am trying to enable Kerberos on Ambari 2.6.2.2 on CentOS 7. Below are the errors
***********************
500 status code received on POST method for API: /api/v1/clusters/hdp265/requests
Error message: An internal system exception occurred: Failed to execute the command: Broken pipe
***********************************
Below is my krb5.conf file
nano /etc/krb5.conf
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
default_realm = HADOOPSECURITY.COM
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
# EXAMPLE.COM = {
# kdc = kerberos.example.com
# admin_server = kerberos.example.com
# }
HADOOPSECURITY.COM = {
kdc = p1.bigdata.com
admin_server = p1.bigdata.com
}
[domain_realm]
.p1.bigdata.com = HADOOPSECURITY.COM
p1.bigdata.com = HADOOPSECURITY.COM
************************************
nano /var/kerberos/krb5kdc/kadm5.acl
*/admin@HADOOPSECURITY.COM *
Created 10-10-2019 09:41 AM
Finally, it worked when I added admin/admin into /var/kerberos/krb5kdc/kadm5.acl file. Here I have added admin/admin and root/admin as well... just created the root user.
Created 10-10-2019 10:24 AM
Great, it worked but you should recognize even if you had modified the /var/kerberos/krb5kdc/kadm5.acl still krb5.conf was wrong and your Ambari UI was wrong so you still wouldn't have resolved it 🙂
Happy hadooping
Created 10-10-2019 11:58 AM
Thanks for your help Shelton. I have one other question... trying to enable Kerberos in other server but it is saying not reachable. Using similar configuration... server name different. What would be be the issue? btw. it is on HDP 3.1(Ambari 2.7) on CentOS 7 server. What could be the reason to not able to reach the KDC?