Obtaining Kerberos ticket for hdfs user throws an error

[#1]

I need to create hdfs-auto-snapshot using the hdfs user. My environment is kerberos-authenticated, so, to do that I called the following command to obtain a kerberos ticket for the hdfs user:

kinit -V -kt /etc/security/keytabs/hdfs.headless.keytab hdfs

That command threw the following error:

Using default cache: /run/user/krb5cc/krb5cc_MyUserID
Using principal: hdfs@MyRealm
Using keytab: /etc/security/keytabs/hdfs.headless.keytab
kinit: Password has expired while getting initial credentials

When I try to use sudo in the command to be

sudo kinit -V -kt /etc/security/keytabs/hdfs.headless.keytab hdfs

I get the following error

Using default cache: /run/user/krb5cc/krb5cc_0
Using principal: hdfs@MyRealm
Using keytab: /etc/security/keytabs/hdfs.headless.keytab
kinit: Keytab contains no suitable keys for hdfs@MyRealm while getting initial credentials

The reason I though I may need to use sudo is because the keytab file has permission "-r--r-----" and root is the owner.

Any idea how can I obtain a tgt for hdfs user so that I can use it later?

[#2 · Accepted solution]

@Sarah Maadawy

I think you are passing incorrect principal name while doing kinit.

Can you please do:

klist -ket /etc/security/keytabs/hdfs.headless.keytab

Sample output:

[root@ambarangerdap1 ~]# klist -ket /etc/security/keytabs/hdfs.headless.keytab
Keytab name: FILE:/etc/security/keytabs/hdfs.headless.keytab
KVNO Timestamp         Principal
---- ----------------- --------------------------------------------------------
   1 09/25/16 07:17:02 hdfs-ambari-sme@SUPPORT.COM (arcfour-hmac)
   1 09/25/16 07:17:02 hdfs-ambari-sme@SUPPORT.COM (des-cbc-md5)
   1 09/25/16 07:17:02 hdfs-ambari-sme@SUPPORT.COM (des3-cbc-sha1)
   1 09/25/16 07:17:02 hdfs-ambari-sme@SUPPORT.COM (aes128-cts-hmac-sha1-96)
   1 09/25/16 07:17:02 hdfs-ambari-sme@SUPPORT.COM (aes256-cts-hmac-sha1-96)

Now from above output I can see that my hdfs principal is hdfs-ambari-sme@SUPPORT.COM

I would use below command

kinit -kt /etc/security/keytabs/hdfs.headless.keytab hdfs-ambari-sme

Please try this and let me know if this helps! HCC is always there to help you.

Happy Hadooping! 🙂

[#3]

You were right! I assumed by default that the user is hdfs while it had a different name in the keytab file. Thanks kuldeep!

[#4]

@Sarah Maadawy

I agree with @Kuldeep Kulkarni regarding the principal name used for the HDFS Kerberos identity. However on top of that, you should su to the hdfs user to do this. The existence of the HDFS keytab file is not meant to be used by any other user.

Why is the owner of /etc/security/keytabs/hdfs.headless.keytab root? Does Ambari manage the Kerberos identities of your cluster or were the keytab files created and distributed manually? In any case the ACL on that file should be like

-r--r----- 1 hdfs hadoop 303 Oct 12 15:16 /etc/security/keytabs/hdfs.headless.keytab

Or ideally

-r-------- 1 hdfs hadoop 303 Oct 12 15:16 /etc/security/keytabs/hdfs.headless.keytab

However I think some Hadoop services may need access to this keytab file for now.

[#5]

I think this file is generated by ambari. Probably that is why the owner is root.