Changes between Version 5 and Version 6 of kerberos

Timestamp:

09/03/2012 02:54:08 PM (14 years ago)

Author:

liaojiaohe

Comment:

--

kerberos

@@ -20 +20 @@
 
 {{{
-[logging]
+logging]
  default = FILE:/var/log/krb5libs.log
  kdc = FILE:/var/log/krb5kdc.log
@@ -26 +26 @@
 
 [libdefaults]
- default_realm = PCONLINE
+ default_realm = LOCALDOMAIN
  dns_lookup_realm = false
  dns_lookup_kdc = false
@@ -33 +33 @@
 
 [realms]
- PCONLINE = {
+ LOCALDOMAIN = {
   kdc = hadooptest-11-63.pconline.ctc:88
   admin_server = hadooptest-11-63.pconline.ctc:749
-  default_domain = pconline.ctc
- }
+  default_domain = localdomain 
+}
 
 [domain_realm]
- .pconline.ctc = PCONLINE
- pconline.ctc = PCONLINE
+ .localdomain = LOCALDOMAIN
+ localdomain = LOCALDOMAIN
 
 [appdefaults]
@@ -63 +63 @@
  
 [realms]
- PCONLINE = {
+ LOCALDOMAIN = {
   acl_file = /usr/local/var/krb5kdc/kadm5.acl
   dict_file = /usr/share/dict/words
@@ -79 +79 @@
 
 {{{
-# /usr/local/sbin/kdb5_util create -r PCONLINE -s[[BR]]
+# /usr/local/sbin/kdb5_util create -r LOCALDOMAIN -s[[BR]]
 }}}
 
 4.在/usr/local/var/krb5kdc/目录下新建kadm5.acl文件，内容如下：
 
-*/admin@HADOOP.LOCALDOMAIN      *
+*/admin@LOCALDOMAIN      *
 
 
@@ -90 +90 @@
 
 # /usr/local/sbin/kadmin.local[[BR]]
-Enter password forprincipal "admin/admin@PCONLINE":[[BR]]
-kadmin.local: addprinc admin/admin@PCONLINE[[BR]]
-Re-enter password forprincipal "admin/admin@PCONLINE":[[BR]]
-Principal "admin/admin@PCONLINE"created.[[BR]]
+Enter password forprincipal "admin/admin@LOCALDOMAIN":[[BR]]
+kadmin.local: addprinc admin/admin@LOCALDOMAIN[[BR]]
+Re-enter password forprincipal "admin/admin@LOCALDOMAIN":[[BR]]
+Principal "admin/admin@LOCALDOMAIN"created.[[BR]]
 生成admin keytab文件：[[BR]]
 
@@ -111 +111 @@
 
 # /usr/local/sbin/kadmin.local[[BR]]
-Enter password forprincipal "hadoop/admin@PCOLINE":[[BR]]
-kadmin.local: addprinc hadoop/admin@PCOLINE[[BR]]
-Re-enter password forprincipal "hadoop/admin@PCOLINE":[[BR]]
-Principal "hadoop/admin@PCOLINE"created.[[BR]]
+Enter password forprincipal "hadoop/admin@LOCALDOMAIN":[[BR]]
+kadmin.local: addprinc hadoop/admin@LOCALDOMAIN[[BR]]
+Re-enter password forprincipal "hadoop/admin@LOCALDOMAIN":[[BR]]
+Principal "hadoop/admin@LOCALDOMAIN"created.[[BR]]
 
 
@@ -120 +120 @@
 
 /usr/local/bin/kadmin[[BR]]
-addprinc -randkey host/hadooptest-11-64@PCONLINE[[BR]]
-addprinc -randkey hadoop/hadooptest-11-64@PCONLINE[[BR]]
-addprinc -randkey hadoop/hadooptest-11-64.pconline.ctc@PCONLINE[[BR]]
-不知道为什么要两个，可能是没有DNS的原因，每台机器都要配
 
-ktadd -k /data/hadoop-1.0.3/conf/hadoop.keytab hadoop/hadooptest-11-64.pconline.ctc@PCONLINE host/hadooptest-11-64.pconline.ctc@PCONLINE hadoop/hadooptest-11-64@PCONLINE 
+addprinc -randkey host/hadooptest-11-64.pconline.ctc@LOCALDOMAIN[[BR]]
+addprinc -randkey hadoop/hadooptest-11-64.pconline.ctc@LOCALDOMAIN[[BR]]
+
+''这里遇到一个问题，我们的hadoop  core-site.xml使用的短名 hadooptest-11-64,要改为长名 hadooptest-11-64.pconline.ctc，不然kerberos里面会认为不同的实体[[BR]]''
+
+
+ktadd -k /data/hadoop-1.0.3/conf/hadoop.keytab hadoop/hadooptest-11-64.pconline.ctc@LOCALDOMAIN host/hadooptest-11-64.pconline.ctc@LOCALDOMAIN 
+
+10 修改配置文件，这些是固定的，网上很多地方有说, _HOST类似宏定义，有些地方读配置，有些地方读本机的长名[[BR]]