All posts

Kerberos Setup in Linux

Install and configure a Kerberos KDC and its clients on Linux end to end: kdc.conf, krb5.conf, the KDC database, ACLs, the admin principal, keytabs and a test from both server and client.

Updated Sep 11, 2026 6 min read Linux

TL;DR

  • Kerberos is the authentication standard across the Hadoop ecosystem, so setting up a KDC is a prerequisite for securing HDFS, YARN, Hive and Spark.
  • Install krb5-workstation on every node and krb5-server on one, then configure kdc.conf (KDC behaviour) and krb5.conf (client behaviour) to agree on the realm.
  • kdb5_util create -s builds the principal database; the ACL file decides who may administer it; kadmin.local creates the first admin.
  • Services authenticate with keytabs rather than passwords, which is why the last step is exporting one and testing kinit -kt from a client machine.

Kerberos

Kerberos is a secure authentication method developed by MIT that allows two services located in a non-secured network to authenticate themselves in a secure way. Kerberos, which is based on a ticketing system, serves as both Authentication Server and as Ticket Granting Server (TGS).

Kerberos has become the standard authentication method within the Hadoop ecosystem. For this reason, most Big Data technologies have adopted it as their authentication method.

Install & Configure Kerberos Server & Client in Linux

Let’s see how we can install, setup and configure Kerberos in a Cluster.

We will install Kerberos Server in one machine and Kerberos client in rest of the machines.

Step 1: Install Kerberos Client

We need to install the Kerberos client on every node in the cluster.

sudo dnf install krb5-workstation krb5-libs

On RHEL 7 and older, yum replaces dnf. On Debian and Ubuntu the client package is krb5-user instead.

Step2: Install Kerberos Server

The Kerberos server usually goes on the master node, though that is a convention rather than a rule; any server in the cluster will do.

sudo dnf install krb5-server

On Debian and Ubuntu the equivalents are krb5-kdc and krb5-admin-server, and their configuration lives in a different directory, so follow the Ubuntu server guide linked at the end for those paths.

Step 3: Configure Kerberos

The configuration lives in two files, one for the KDC and one for clients.

3.1 kdc.conf changes

Login Kerberos Server Installed machine

$ vi /var/kerberos/krb5kdc/kdc.conf

[kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88

[realms]
 EXAMPLE.COM = {
  #master_key_type = aes256-cts
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
 }
 EXAMPLE.COM = {
   renew_lifetime = 7d
 }

In the above kdc.conf file we choosed realm is EXAMPLE.COM

3.2 krb5.conf changes

$ vi /etc/krb5.conf

{
    [logging]
        default = FILE:/var/log/krb5libs.log
        kdc = FILE:/var/log/krb5libs.log
        admin_server = FILE:/var/log/kadmind.log

    [libdefaults]
        default_realm = EXAMPLE.COM
        dns_lookup_kdc = false
        dns_lookup_realm = false
        ticket_lifetime = 24h
        renew_lifetime = 7d
        forwardable = true
        default_tgs_enctypes = aes256-cts aes128-cts des3-hmac-sha1 des-hmac-sha1 des-cbc-crc
        default_tkt_enctypes = aes256-cts aes128-cts des3-hmac-sha1 des-hmac-sha1 des-cbc-crc
        permitted_enctypes = aes256-cts aes128-cts des3-hmac-sha1 des-hmac-sha1 des-cbc-crc
        udp_preference_limit = 1
        kdc_timeout = 3000
    [realms]
        EXAMPLE.COM = {
            kdc = node1.example.com
            admin_server = node1.example.com
        }
    [domain_realm]
}

Step 4: Create Kerberos KDC Database

Create the KDC (Key Distribution Centre) database that the Kerberos server runs on.

$ kdb5_util -r EXAMPLE.COM create -s

It prompts for a master password. Note it down: every later KDC database operation, including a restart, needs it.

Step 5: ACL changes

$ vi /var/kerberos/krb5kdc/kadm5.acl

Set your realm name. For this walkthrough:

*/admin@EXAMPLE.COM *

Step 6: Add Admin for KDC

Note this Step MUST BE Executed only in the KDC Server machine – NOT in any Kerberos client machines.

$ kadmin.local

This will bring you to kadmin.local prompt. In that prompt, use the highlighted command. Note you have to use your own Realm name.

kadmin.local: addprinc   root/admin@EXAMPLE.COM

To see list of all principals created –

kadmin.local : listprincs

Step 7: Restart the Kerberos Admin & KDC Server

Note these steps MUST be done in KDC Server machine.

Start both services and enable them so the KDC comes back after a reboot:

sudo systemctl enable --now krb5kdc
sudo systemctl enable --now kadmin

Confirm both came up before moving on:

systemctl status krb5kdc kadmin

We are done with the Setup. We will test it from Kerberos as well Client servers.

Testing 1: Test Kerberos from Server

Test the Kerberos installation. Use the below command –

Check if any Ticket exists

$ klist

If no tickets exist in the cache, create a new one

$ kinit root/admin

Check again if you have any ticket

$ klist

Hopefully now you can see tickets listed here.

If you want to destroy any ticket, use

$ kdestroy

Testing 2: Test Kerberos from the client machine

In previous step, we tested Kerberos from Kerberos server itself.

Now test from the client machine, which is where users actually authenticate before reaching a service on the network.

1. Create a non-admin user

Use a non-admin user. Run these on the KDC server to create one.

$ kadmin.local

In kadmin.local prompt use –

kadmin.local: addprinc rangareddy@EXAMPLE.COM

so we have created a normal user rangareddy.

2. Create a keytab file for the user

We will create a keytab file for the user rangareddy

$ kadmin.local

In kadmin.local prompt, use below

kadmin.local: xst -norandkey -k /tmp/rangareddy.keytab rangareddy@EXAMPLE.COM

It will create a keytab file rangareddy.keytab in /tmp directory for the rangareddy.

3. Test Kerberos from client machine

In previous step, we created the rangareddy.keytab file in KDC SERVER machine.

Copy the keytab file to the client machine.

Lets place it in /root/rangareddy.keytab in client machine.

Now in the client machine, open command prompt

Create a kerberos ticket

$ kinit -kt /root/rangareddy.keytab rangareddy@EXAMPLE.COM

Check if ticket created

$ klist

References

Found this useful?

These posts and tools are free. If one saved you an afternoon, you can buy me a coffee.

Buy me a coffee