Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

Obtaining Kerberos ticket for hdfs user throws an error

avatar
Contributor

I need to create hdfs-auto-snapshot using the hdfs user. My environment is kerberos-authenticated, so, to do that I called the following command to obtain a kerberos ticket for the hdfs user:

kinit -V -kt /etc/security/keytabs/hdfs.headless.keytab hdfs

That command threw the following error:

Using default cache: /run/user/krb5cc/krb5cc_MyUserID
Using principal: hdfs@MyRealm
Using keytab: /etc/security/keytabs/hdfs.headless.keytab
kinit: Password has expired while getting initial credentials

When I try to use sudo in the command to be

sudo kinit -V -kt /etc/security/keytabs/hdfs.headless.keytab hdfs

I get the following error

Using default cache: /run/user/krb5cc/krb5cc_0
Using principal: hdfs@MyRealm
Using keytab: /etc/security/keytabs/hdfs.headless.keytab
kinit: Keytab contains no suitable keys for hdfs@MyRealm while getting initial credentials

The reason I though I may need to use sudo is because the keytab file has permission "-r--r-----" and root is the owner.

Any idea how can I obtain a tgt for hdfs user so that I can use it later?

1 ACCEPTED SOLUTION

avatar
Master Guru
hide-solution

This problem has been solved!

Want to get a detailed solution you have to login/registered on the community

Register/Login
4 REPLIES 4

avatar
Master Guru
hide-solution

This problem has been solved!

Want to get a detailed solution you have to login/registered on the community

Register/Login

avatar
Contributor

You were right! I assumed by default that the user is hdfs while it had a different name in the keytab file. Thanks kuldeep!

avatar

@Sarah Maadawy

I agree with @Kuldeep Kulkarni regarding the principal name used for the HDFS Kerberos identity. However on top of that, you should su to the hdfs user to do this. The existence of the HDFS keytab file is not meant to be used by any other user.

Why is the owner of /etc/security/keytabs/hdfs.headless.keytab root? Does Ambari manage the Kerberos identities of your cluster or were the keytab files created and distributed manually? In any case the ACL on that file should be like

-r--r----- 1 hdfs hadoop 303 Oct 12 15:16 /etc/security/keytabs/hdfs.headless.keytab

Or ideally

-r-------- 1 hdfs hadoop 303 Oct 12 15:16 /etc/security/keytabs/hdfs.headless.keytab

However I think some Hadoop services may need access to this keytab file for now.

avatar
Contributor

I think this file is generated by ambari. Probably that is why the owner is root.