- Subscribe to RSS Feed
- Mark Question as New
- Mark Question as Read
- Float this Question for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Obtaining Kerberos ticket for hdfs user throws an error
- Labels:
-
Apache Hadoop
Created ‎10-14-2016 02:54 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I need to create hdfs-auto-snapshot using the hdfs user. My environment is kerberos-authenticated, so, to do that I called the following command to obtain a kerberos ticket for the hdfs user:
kinit -V -kt /etc/security/keytabs/hdfs.headless.keytab hdfs
That command threw the following error:
Using default cache: /run/user/krb5cc/krb5cc_MyUserID Using principal: hdfs@MyRealm Using keytab: /etc/security/keytabs/hdfs.headless.keytab kinit: Password has expired while getting initial credentials
When I try to use sudo in the command to be
sudo kinit -V -kt /etc/security/keytabs/hdfs.headless.keytab hdfs
I get the following error
Using default cache: /run/user/krb5cc/krb5cc_0 Using principal: hdfs@MyRealm Using keytab: /etc/security/keytabs/hdfs.headless.keytab kinit: Keytab contains no suitable keys for hdfs@MyRealm while getting initial credentials
The reason I though I may need to use sudo is because the keytab file has permission "-r--r-----" and root is the owner.
Any idea how can I obtain a tgt for hdfs user so that I can use it later?
Created ‎10-14-2016 10:16 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think you are passing incorrect principal name while doing kinit.
Can you please do:
klist -ket /etc/security/keytabs/hdfs.headless.keytab
Sample output:
[root@ambarangerdap1 ~]# klist -ket /etc/security/keytabs/hdfs.headless.keytab Keytab name: FILE:/etc/security/keytabs/hdfs.headless.keytab KVNO Timestamp Principal ---- ----------------- -------------------------------------------------------- 1 09/25/16 07:17:02 hdfs-ambari-sme@SUPPORT.COM (arcfour-hmac) 1 09/25/16 07:17:02 hdfs-ambari-sme@SUPPORT.COM (des-cbc-md5) 1 09/25/16 07:17:02 hdfs-ambari-sme@SUPPORT.COM (des3-cbc-sha1) 1 09/25/16 07:17:02 hdfs-ambari-sme@SUPPORT.COM (aes128-cts-hmac-sha1-96) 1 09/25/16 07:17:02 hdfs-ambari-sme@SUPPORT.COM (aes256-cts-hmac-sha1-96)
Now from above output I can see that my hdfs principal is hdfs-ambari-sme@SUPPORT.COM
I would use below command
kinit -kt /etc/security/keytabs/hdfs.headless.keytab hdfs-ambari-sme
Please try this and let me know if this helps! HCC is always there to help you.
Happy Hadooping! 🙂
Created ‎10-14-2016 10:16 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think you are passing incorrect principal name while doing kinit.
Can you please do:
klist -ket /etc/security/keytabs/hdfs.headless.keytab
Sample output:
[root@ambarangerdap1 ~]# klist -ket /etc/security/keytabs/hdfs.headless.keytab Keytab name: FILE:/etc/security/keytabs/hdfs.headless.keytab KVNO Timestamp Principal ---- ----------------- -------------------------------------------------------- 1 09/25/16 07:17:02 hdfs-ambari-sme@SUPPORT.COM (arcfour-hmac) 1 09/25/16 07:17:02 hdfs-ambari-sme@SUPPORT.COM (des-cbc-md5) 1 09/25/16 07:17:02 hdfs-ambari-sme@SUPPORT.COM (des3-cbc-sha1) 1 09/25/16 07:17:02 hdfs-ambari-sme@SUPPORT.COM (aes128-cts-hmac-sha1-96) 1 09/25/16 07:17:02 hdfs-ambari-sme@SUPPORT.COM (aes256-cts-hmac-sha1-96)
Now from above output I can see that my hdfs principal is hdfs-ambari-sme@SUPPORT.COM
I would use below command
kinit -kt /etc/security/keytabs/hdfs.headless.keytab hdfs-ambari-sme
Please try this and let me know if this helps! HCC is always there to help you.
Happy Hadooping! 🙂
Created ‎10-16-2016 11:21 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You were right! I assumed by default that the user is hdfs while it had a different name in the keytab file. Thanks kuldeep!
Created ‎10-14-2016 10:32 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I agree with @Kuldeep Kulkarni regarding the principal name used for the HDFS Kerberos identity. However on top of that, you should su to the hdfs user to do this. The existence of the HDFS keytab file is not meant to be used by any other user.
Why is the owner of /etc/security/keytabs/hdfs.headless.keytab root? Does Ambari manage the Kerberos identities of your cluster or were the keytab files created and distributed manually? In any case the ACL on that file should be like
-r--r----- 1 hdfs hadoop 303 Oct 12 15:16 /etc/security/keytabs/hdfs.headless.keytab
Or ideally
-r-------- 1 hdfs hadoop 303 Oct 12 15:16 /etc/security/keytabs/hdfs.headless.keytab
However I think some Hadoop services may need access to this keytab file for now.
Created ‎10-16-2016 11:23 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think this file is generated by ambari. Probably that is why the owner is root.
