赞
踩
KDC节点上需要安装krb5-server、krb5-libs、krb5-auth-dialog、krb5-workstation服务,Client单独部署在其他节点
yum install krb5-server krb5-libs krb5-auth-dialog krb5-workstation -y
Client节点上部署krb5-devel、krb5-workstation服务
yum install krb5-devel krb5-workstation -y
修改其中的realm,把默认的EXAMPLE.COM修改为自己要定义的值,也可以不修改。
default_realm:默认的realm。设置为realm。如ZHUZI.COM # Configuration snippets may be placed in this directory as well includedir /etc/krb5.conf.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] dns_lookup_realm = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true rdns = false pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt default_realm = EXAMPLE.COM default_ccache_name = KEYRING:persistent:%{uid} [realms] EXAMPLE.COM = { kdc = nyyjh1 admin_server = nyyjh1 } [domain_realm] # .example.com = EXAMPLE.COM # example.com = EXAMPLE.COM
kdc:代表要kdc的位置。添加格式是机器名
admin_server:代表admin的位置。格式是机器名
default_domain:代表默认的域名。(设置Master主机所对应的域名,如master162.ispeco.com)
[kdcdefaults]
- kdc_ports = 88
- kdc_tcp_ports = 88
-
- [realms]
- EXAMPLE.COM = {
- #master_key_type = aes256-cts
- acl_file = /var/kerberos/krb5kdc/kadm5.acl
- dict_file = /usr/share/dict/words
- admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
- supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
- }
*/admin@EXAMPLE.COM *
1. krb5.conf (Master、Worker节点均需配置,且文件内容必须相同)
2. kdc.conf (仅配置Master节点,如果没有,需自建)
3. kadm5.acl (Master节点配置)
创建Kerberos数据库,需要设置管理员密码,创建成功后会在/var/Kerberos/krb5kdc/下生成一系列文件,
如果重新创建,需要先删除/var/kerberos/krb5kdc下面principal相关文件。
- cd /var/kerberos/krb5kdc/
- rm principal* -rf
需在Master节点的root用户下执行以下命令新建数据库:
- kdb5_util create -s -r EXAMPLE.COM
- service krb5kdc start
- service kadmin start
在Master节点的root用户下分别执行以下命令:
- kadmin.local
- addprinc admin/admin@EXAMPLE.COM
Copyright © 2003-2013 www.wpsshop.cn 版权所有,并保留所有权利。