第17章 配置客户端认证_max_prepared_transactions greater than

Using Kerberos Authentication

 

您可以控制​​使用Kerberos身份验证服务器访问Greenplum数据。

Greenplum的数据库支持通用安全服务应用程序使用Kerberos身份验证接口（GSSAPI）。 GSSAPI为支持它的系统​​自动认证（单点登录）。您指定的Greenplum数据引擎的用户需要在Greenplum的数据库配置文件pg_hba.conf中Kerberos身份验证（角色）。如果当一个角色尝试登录到Greenplum数据引擎Kerberos身份验证不可用的登录失败。

Kerberos提供安全，加密的认证服务。它不加密客户机和数据库之间交换数据，并提供无授权服务。要加密在网络上交换数据时，必须使用SSL连接。要访问Greenplum的数据库和对象，如模式和表管理授权，可以使用数据库中给Greenplum数据用户和角色在pg_hba.conf文件设置和权限。有关管理授权特权的信息，请参阅管理角色和权限。http://web.mit.edu/kerberos/

对于使用Kerberos与Greenplum的数据库要求

以下项目需要使用Kerberos的Greenplum数据库：

•               Kerberos KeyDistribution Center (KDC) server using the krb5-server library

•      Kerberos version 5 krb5-iibs and krb5-workstation packages installed on the Greenplum Databasemaster host

•               Greenplum Database version with support for Kerberos

•      System time on the Kerberos server and Greenplum Database masterhost must be synchronized. (Install Linux ntp package on both servers.)

•               Network connectivity between the Kerberos server and theGreenplum Database master

•        Java 1.7.0_17 or later isrequired to use Kerberos-authenticated JDBC on Red Hat Enterprise Linux 6.x

•        Java 1.6.0_21 or later is required to use Kerberos-authenticatedJDBC on Red Hat Enterprise Linux 4.x or 5.x

启用Kerberos验证了Greenplum数据引擎

完成以下任务来设置Kerberos身份验证与Greenplum数据：

1.    验证系统是否满足prequisites为使用Kerberos的Greenplum数据引擎。请参阅将Kerberos与Greenplum的数据库要求。.

2.    设置，或标识，Kerberos密钥分发中心（KDC）服务器用于身份验证。请参阅安装和配置Kerberos KDC服务器。

3.    在KDC服务器上的Kerberos数据库，在服务器上设置 Kerberos的realm and principals。对于Greenplum数据，principal主要是使用Kerberos身份验证Greenplum数据引擎的用户。

4.    创建的Kerberos密钥表为Greenplum的数据库文件。要访问Greenplum数据引擎，您可以创建只有Kerberos和Greenplum数据称为服务密钥。在Kerberos服务器，服务密钥存储在Kerberos数据库。

在Greenplum的master，服务密钥存储在key tables，这是被称为keytabs文件。服务密钥通常存储在keytab文件/etc/krb5.keytab的。此service key和服务密码等价，必须保持安全。使用该密钥加密的数据是只读数据。

5.              安装Kerberos客户端软件包和Greenplum数据主密钥表文件。

6.    创建使用密钥表文件中的Greenplum数据引擎主节点上gpadminKerberos票据。该票据包含了授权访问数据库Greenplum的Kerberos身份验证凭据。

通过对Greenplum数据引擎配置Kerberos身份验证，可以使用Kerberos进行PSQL和JDBC。

安装和配置Kerberos KDC服务器

步骤设置一个Kerberos密钥分发中心（KDC）服务器的Red Hat Enterprise Linux主机与Greenplum数据引擎的使用上。

1.              安装Kerberos服务器包：

sudo yum install krb5-libs krb5-serverkrb5-workstation

2.    编辑/etc/krb5.conf中的配置文件。下面的例子显示了一个默认的KRB.GREENPLUM.COM领域Kerberos服务器。

[logging]

default = FILE:/var/log/krb5libs.log

kdc = FILE:/var/log/krb5kdc.log

admin_server =FILE:/var/log/kadmind.log

[libdefaults]

default_realm = KRB.GREENPLUM.COM

dns_lookup_realm = false

dns_lookup_kdc = false

ticket_lifetime = 24h

renew_lifetime = 7d

forwardable = true

default_tgs_enctypes = aes128-ctsdes3-hmac-sha1 des-cbc-crc des-cbc-md5

default_tkt_enctypes = aes128-ctsdes3-hmac-sha1 des-cbc-crc des-cbc-md5

permitted_enctypes = aes128-ctsdes3-hmac-sha1 des-cbc-crc des-cbc-md5

[realms]

KRB.GREENPLUM.COM = {

kdc = kerberos-gpdb:88

admin_server = kerberos-gpdb:749

default_domain = kerberos-gpdb

}

[domain_realm]

.kerberos-gpdb = KRB.GREENPLUM.COM

kerberos-gpdb = KRB.GREENPLUM.COM

[appdefaults]

pam = {

debug = false

ticket_lifetime = 36000

renew_lifetime = 36000

forwardable = true

krb4_convert = false

}

 

在[realms]部分的KDC和ADMIN_SERVER键指定Kerberos服务器运行的主机（kerberos-gpdb）和端口。 IP号码来代替主机名的使用。

如果你的Kerberos服务器其他领域管理认证，你会增加而不是在[realms]中的KRB.GREENPLUM.COM境界和kdc.conf文件中的[domain-realm]部分。请参见有关kdc.conf文件信息Kerberos文档。

See the Kerberos documentation forinformation about the kdc.conf file.

3.              To create a Kerberos KDC database, run the kdb5_util.

kdb5_util create -s

该kdb5_util创建选项创建数据库来存储密钥受此KDC服务器管理的Kerberos realms。 -s选项创建一个存储文件。如果没有存储文件，每次KDC服务器启动时，它要求输入密码。

4.    管理用户与kadmin.local程序添加到KDC数据库。因为它本身不依赖于Kerberos身份验证，kadmin.local实用程序允许您最初的管理用户添加到本地Kerberos服务器。要以管理用户将用户添加到gpadmin KDC数据库，运行以下命令：

kadmin.local -q"addprinc gpadmin/admin"

大多数用户并不需要Kerberos服务器的管理权限。他们可以使用的kadmin来管理自己的主体（例如，要改变自己的密码）。有关的kadmin信息，请参阅Kerberos文档。For information about kadmin, see the Kerberos documentation.

5.              If needed, edit the /var/kerberos/krb5kdc/kadm5.acl file to grantthe appropriate permissions to gpadmin.

6.              Start the Kerberos daemons:

/sbin/servicekrb5kdc start /sbin/service kadmin start

7.              To start Kerberos automatically upon restart:

/sbin/chkconfigkrb5kdc on /sbin/chkconfig kadmin on

Create Greenplum Database Roles in theKDC Database

Add principalsto the Kerberos realm for Greenplum Database.

在交互模式下启动kadmin.local，然后添加两个principals到GreenplumDatabase Realm。

1.              Startkadmin.local in interactive mode:

kadmin.local

2.              Addprincipals:

kadmin.local:addprinc gpadmin/kerberos-gpdb@KRB.GREENPLUM.COM

kadmin.local: addprinc postgres/master.test.com@KRB.GREENPLUM.COM

 

The adprinccommands prompt for passwords for each principal. The first addprinc creates aGreenplum Database user as a principal, gpadmin/kerberos-gpdb. The secondaddprinc command creates the postgres process on the Greenplum Database masterhost as a principal in the Kerberos KDC. This principal is required when usingKerberos authentication with Greenplum Database.

3.    Create aKerberos keytab file with kadmin.local. The following example creates a keytabfile gpdb- kerberos.keytab in the current directory with authenticationinformation for the two principals.

kadmin.local:xst -k gpdb-kerberos.keytab

gpadmin/kerberos-gpdb@KRB.GREENPLUM.COM

postgres/master.test.com@KRB.GREENPLUM.COM

You will copythis file to the Greenplum Database master host.

4.              Exitkadmin.local interactive mode with the quit command:

kadmin.local:quit

Install and Configure the Kerberos Client

Steps toinstall the Kerberos client on the Greenplum Database master host.

Install theKerberos client libraries on the Greenplum Database master and configure theKerberos client.

1.               Install the Kerberos packages on the Greenplum Database master.

sudo yuminstall krb5-libs krb5-workstation

2.    Ensure that the /etc/krb5.conffile is the same as the one that is on the Kerberos server.

3.    Copy the gpdb-kerberos.keytab file that was generated on theKerberos server to the Greenplum Database master host.

4.    Remove any existing tickets with the Kerberos utility kdestroy.Run the utility as root.

sudo kdestroy

Use theKerberos utility kinit to request a ticket using the keytab file on theGreenplum Database master for gpadmin/kerberos-gpdb@KRB.GREENPLUM.COM. The -toption specifies the keytab file on the Greenplum Database master.

# kinit -k -tgpdb-kerberos.keytab gpadmin/kerberos-gpdb@KRB.GREENPLUM.COM

Use theKerberos utility klist to display the contents of the Kerberos ticket cache onthe Greenplum Database master. The following is an example:

# klist

Ticket cache: FILE:/tmp/krb5cc_108061

Default principal:gpadmin/kerberos-gpdb@KRB.GREENPLUM.COM

Valid starting Expires Serviceprincipal

03/28/13 14:50:26 03/29/13 14:50:26krbtgt/KRB.GREENPLUM.COM

@KRB.GREENPLUM.COM

renew until 03/28/13 14:50:26

 

Set up Greenplum Database with Kerberosfor PSQL

Configure aGreenplum Database to use Kerberos.

After you haveset up Kerberos on the Greenplum Database master, you can configure GreenplumDatabase to use Kerberos. For information on setting up the Greenplum Databasemaster, seeInstalland Configurethe Kerberos Client.

1.    Create aGreenplum Database administrator role in the database template1 for the Kerberos principal that isused as the database administrator. The following example usesgpamin/kerberos-gpdb.

psql template1-c 'create role "gpadmin/kerberos-gpdb" login superuser;'

The role youcreate in the database template1 will be available in any newGreenplum Database that you create.

2.    Modifypostgresql.conf to specify the location of the keytab file. 例如, adding this line to the postgresql.confspecifies the folder /home/gpadmin as the location of the keytab file gpdb-kerberos.keytab.

krb_server_keyfile= '/home/gpadmin/gpdb-kerberos.keytab'

3.    Modify theGreenplum Database file pg_hba.conf to enable Kerberos support. Then restartGreenplum Database (gpstop -ar). 例如, adding the following line topg_hba.conf adds GSSAPI and

Kerberossupport. The value for krb_reaim is the Kerberos realm that is used forauthentication to Greenplum Database.

host all all 0.0.0.0/0gss include_realm=0 krb_realm=KRB.GREENPLUM.COM

Forinformation about the pg_hba.conf file, see The pg_hba.conf file in the Postgres documentation.

4.               Create aticket using kinit and show the tickets in the Kerberos ticket cache withklist.

5.               As a test, login to the database as the gpadmin role with the Kerberos credentialsgpadmin/kerberos-

gpdb:

psql -U"gpadmin/kerberos-gpdb" -h master.test template1

A username mapcan be defined in the pg_ident.conf file and specified in the pg_hba.conf fileto simplify logging into Greenplum Database. 例如, this psqlcommand logs into the default Greenplum Database on mdw.proddb as the Kerberosprincipal adminuser/mdw.proddb:

$ psql -U"adminuser/mdw.proddb" -h mdw.proddb

If the defaultuser is adminuser, the pg_ident.conf file and the pg_hba.conf file can beconfigured so that the adminuser can log in to the"database as theKerberos principal adminuser/mdw.proddb without specifying the -U option:

$ psql -hmdw.proddb

The followingusername map is defined in the Greenplum Database file $master_data_directory/

pg_ident.conf:

The map can bespecified in the pg_hba.conf file as part of the line that enables Kerberossupport:

host all all 0.0.0.0/0krb5 include_realm=0 krb_realm=proddb map=mymap

For moreinformation about specifying username maps see Username maps in the Postgres documentation.

6.    If a Kerberosprincipal is not a Greenplum Database user, a message similar to the followingis displayed from the psql command line when the user attempts to log in to thedatabase:

psql:krb5_sendauth: Bad response

The principalmust be added as a Greenplum Database user.

Set up Greenplum Database with Kerberosfor JDBC

EnableKerberos-authenticated JDBC access to Greenplum Database.

You canconfigure Greenplum Database to use Kerberos to run user-defined Javafunctions.

1.    Ensure thatKerberos is installed and configured on the Greenplum Database master. SeeInstall and Configurethe Kerberos Client.

2.               Create thefile .java.login.config in the folder/home/gpadmin and add the following textto the file:

pgjdbc {

com.sun.security.auth.module.KrbLoginModulerequired

doNotPrompt=true

useTicketCache=true

debug=true

client=true;

};

3.    Create a Javaapplication that connects to Greenplum Database using Kerberos authentication.The following example database connection URL uses a PostgreSQL JDBC driver andspecifies parameters for Kerberos authentication:

jdbc:postgresql://mdw:5432/mytest?kerberosServerName=postgres

&jaasApplicationName=pgjdbc&user=gpadmin/kerberos-gpdb

The parameternames and values specified depend on how the Java application performs Kerberosauthentication.

Testthe Kerberos login by running a sample Java application from GreenplumDatabase.