Kerberos Setup in Linux
Install and configure a Kerberos KDC and its clients on Linux end to end: kdc.conf, krb5.conf, the KDC database, ACLs, the admin principal, keytabs and a test from both server and client.
- Kerberos
- Install & Configure Kerberos Server & Client in Linux
- Step 1: Install Kerberos Client
- Step2: Install Kerberos Server
- Step 3: Configure Kerberos
- Step 4: Create Kerberos KDC Database
- Step 5: ACL changes
- Step 6: Add Admin for KDC
- Step 7: Restart the Kerberos Admin & KDC Server
- Testing 1: Test Kerberos from Server
- Testing 2: Test Kerberos from the client machine
- References
TL;DR
- Kerberos is the authentication standard across the Hadoop ecosystem, so setting up a KDC is a prerequisite for securing HDFS, YARN, Hive and Spark.
- Install
krb5-workstationon every node andkrb5-serveron one, then configurekdc.conf(KDC behaviour) andkrb5.conf(client behaviour) to agree on the realm.kdb5_util create -sbuilds the principal database; the ACL file decides who may administer it;kadmin.localcreates the first admin.- Services authenticate with keytabs rather than passwords, which is why the last step is exporting one and testing
kinit -ktfrom a client machine.
Kerberos
Kerberos is a secure authentication method developed by MIT that allows two services located in a non-secured network to authenticate themselves in a secure way. Kerberos, which is based on a ticketing system, serves as both Authentication Server and as Ticket Granting Server (TGS).
Kerberos has become the standard authentication method within the Hadoop ecosystem. For this reason, most Big Data technologies have adopted it as their authentication method.
Install & Configure Kerberos Server & Client in Linux
Let’s see how we can install, setup and configure Kerberos in a Cluster.
We will install Kerberos Server in one machine and Kerberos client in rest of the machines.
Step 1: Install Kerberos Client
We need to install the Kerberos client on every node in the cluster.
sudo dnf install krb5-workstation krb5-libs
On RHEL 7 and older, yum replaces dnf. On Debian and Ubuntu the client
package is krb5-user instead.
Step2: Install Kerberos Server
The Kerberos server usually goes on the master node, though that is a convention rather than a rule; any server in the cluster will do.
sudo dnf install krb5-server
On Debian and Ubuntu the equivalents are krb5-kdc and krb5-admin-server, and
their configuration lives in a different directory, so follow the Ubuntu server
guide linked at the end for those paths.
Step 3: Configure Kerberos
The configuration lives in two files, one for the KDC and one for clients.
3.1 kdc.conf changes
Login Kerberos Server Installed machine
$ vi /var/kerberos/krb5kdc/kdc.conf
[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88
[realms]
EXAMPLE.COM = {
#master_key_type = aes256-cts
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
}
EXAMPLE.COM = {
renew_lifetime = 7d
}
In the above kdc.conf file we choosed realm is EXAMPLE.COM
3.2 krb5.conf changes
$ vi /etc/krb5.conf
{
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5libs.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_kdc = false
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
default_tgs_enctypes = aes256-cts aes128-cts des3-hmac-sha1 des-hmac-sha1 des-cbc-crc
default_tkt_enctypes = aes256-cts aes128-cts des3-hmac-sha1 des-hmac-sha1 des-cbc-crc
permitted_enctypes = aes256-cts aes128-cts des3-hmac-sha1 des-hmac-sha1 des-cbc-crc
udp_preference_limit = 1
kdc_timeout = 3000
[realms]
EXAMPLE.COM = {
kdc = node1.example.com
admin_server = node1.example.com
}
[domain_realm]
}
Step 4: Create Kerberos KDC Database
Create the KDC (Key Distribution Centre) database that the Kerberos server runs on.
$ kdb5_util -r EXAMPLE.COM create -s
It prompts for a master password. Note it down: every later KDC database operation, including a restart, needs it.
Step 5: ACL changes
$ vi /var/kerberos/krb5kdc/kadm5.acl
Set your realm name. For this walkthrough:
*/admin@EXAMPLE.COM *
Step 6: Add Admin for KDC
Note this Step MUST BE Executed only in the KDC Server machine – NOT in any Kerberos client machines.
$ kadmin.local
This will bring you to kadmin.local prompt. In that prompt, use the highlighted command. Note you have to use your own Realm name.
kadmin.local: addprinc root/admin@EXAMPLE.COM
To see list of all principals created –
kadmin.local : listprincs
Step 7: Restart the Kerberos Admin & KDC Server
Note these steps MUST be done in KDC Server machine.
Start both services and enable them so the KDC comes back after a reboot:
sudo systemctl enable --now krb5kdc
sudo systemctl enable --now kadmin
Confirm both came up before moving on:
systemctl status krb5kdc kadmin
We are done with the Setup. We will test it from Kerberos as well Client servers.
Testing 1: Test Kerberos from Server
Test the Kerberos installation. Use the below command –
Check if any Ticket exists
$ klist
If no tickets exist in the cache, create a new one
$ kinit root/admin
Check again if you have any ticket
$ klist
Hopefully now you can see tickets listed here.
If you want to destroy any ticket, use
$ kdestroy
Testing 2: Test Kerberos from the client machine
In previous step, we tested Kerberos from Kerberos server itself.
Now test from the client machine, which is where users actually authenticate before reaching a service on the network.
1. Create a non-admin user
Use a non-admin user. Run these on the KDC server to create one.
$ kadmin.local
In kadmin.local prompt use –
kadmin.local: addprinc rangareddy@EXAMPLE.COM
so we have created a normal user rangareddy.
2. Create a keytab file for the user
We will create a keytab file for the user rangareddy
$ kadmin.local
In kadmin.local prompt, use below
kadmin.local: xst -norandkey -k /tmp/rangareddy.keytab rangareddy@EXAMPLE.COM
It will create a keytab file rangareddy.keytab in /tmp directory for the rangareddy.
3. Test Kerberos from client machine
In previous step, we created the rangareddy.keytab file in KDC SERVER machine.
Copy the keytab file to the client machine.
Lets place it in /root/rangareddy.keytab in client machine.
Now in the client machine, open command prompt
Create a kerberos ticket
$ kinit -kt /root/rangareddy.keytab rangareddy@EXAMPLE.COM
Check if ticket created
$ klist
References
- MIT Kerberos documentation for
kdc.conf,krb5.confandkadminreference - Kerberos V5 System Administrator’s Guide for realm and database administration
- Hadoop in secure mode for how Hadoop services consume the keytabs created here
- Spark security for delegation tokens and
--principal/--keytabon a Kerberized cluster - Ubuntu server Kerberos guide for the Debian and Ubuntu package names and configuration paths
Found this useful?
These posts and tools are free. If one saved you an afternoon, you can buy me a coffee.