kerberos+ladp+hadoop-ha 安全认证部署配置

 

随着hadoop集群里的数据量越来越大,各业务数据都集中了里面,自然要为各业务都要提供数据支持,又希望各业务数据是相对独立安全的,这最时候就需要做安全认证了

hadoop ha 测试集群部署规划
hadoop ha 各服务器角色如下:
 192.168.36.135 hadoopnn135.hadoop.com
192.168.36.137 hadoopsn137.hadoop.com
192.168.36.134 dn01134.hadoop.com
192.168.36.136 dn02136.hadoop.com

说明: 相关测试是在centos 6.3操作系统上完成的,hadoop 集群安装用的cdh5.2版本的源

 hadoopnn135.hadoop.com server端部署 krb5-server krb5-libs krb5-auth-dialog krb5-workstation  
 hadoopsn137.hadoop.com,dn01134.hadoop.com,dn02136.hadoop.com client部署krb5-devel krb5-workstation
kerberos server 和 client端安装
server端安装
yum install krb5-server krb5-libs krb5-auth-dialog krb5-workstation   -y
client端安装
yum install krb5-devel krb5-workstation -y
hadoop ha和 kerberos ladp 配置整合
修改配置前,需先停止运行的hadoop ha集群里的相关服务
for i in /etc/init.d/hadoop-*; do $i stop; done for i in /etc/init.d/impala*; do $i stop; done for i in /etc/init.d/zookeeper-*; do $i stop; done for i in /etc/init.d/hive-*; do $i stop; done /root/cmd.sh "/etc/init.d/hadoop-hdfs-datanode stop" /root/cmd.sh "/etc/init.d/hadoop-hdfs-zkfc stop" /root/cmd.sh "/etc/init.d/hadoop-hdfs-journalnode stop" /root/cmd.sh "/etc/init.d/zookeeper-server stop" /root/cmd.sh "/etc/init.d/impala-server stop" /root/cmd.sh "/etc/init.d/hadoop-yarn-resourcemanager stop" /root/cmd.sh "/etc/init.d/hadoop-yarn-nodemanager stop" 
在集群中所有节点的 core-site.xml 文件中添加下面的配置:
<property>
  <name>hadoop.security.authentication</name>
  <value>kerberos</value>
</property>

<property>
  <name>hadoop.security.authorization</name>
  <value>true</value>
</property>
在集群中所有节点的 hdfs-site.xml 文件中添加下面的配置:
<property>
  <name>dfs.block.access.token.enable</name>
  <value>true</value>
</property>
<property>  
  <name>dfs.datanode.data.dir.perm</name>  
  <value>700</value>  
</property>
<property>
  <name>dfs.namenode.keytab.file</name>
  <value>/etc/hadoop/conf/hdfs.keytab</value>
</property>
<property>
  <name>dfs.namenode.kerberos.principal</name>
  <value>hdfs/_HOST@JAVACHEN.COM</value>
</property>
<property>
  <name>dfs.namenode.kerberos.https.principal</name>
  <value>HTTP/_HOST@JAVACHEN.COM</value>
</property>
<property>
  <name>dfs.datanode.address</name>
  <value>0.0.0.0:1004</value>
</property>
<property>
  <name>dfs.datanode.http.address</name>
  <value>0.0.0.0:1006</value>
</property>
<property>
  <name>dfs.datanode.keytab.file</name>
  <value>/etc/hadoop/conf/hdfs.keytab</value>
</property>
<property>
  <name>dfs.datanode.kerberos.principal</name>
  <value>hdfs/_HOST@JAVACHEN.COM</value>
</property>
<property>
  <name>dfs.datanode.kerberos.https.principal</name>
  <value>HTTP/_HOST@JAVACHEN.COM</value>
</property>
如果你像开启 SSL,请添加:
<property>
  <name>dfs.http.policy</name>
  <value>HTTPS_ONLY</value>
</property>
HDFS 配置了 QJM HA,则需要添加(另外,你还要在 zookeeper 上配置 kerberos):
<property>
  <name>dfs.journalnode.keytab.file</name>
  <value>/etc/hadoop/conf/hdfs.keytab</value>
</property>
<property>
  <name>dfs.journalnode.kerberos.principal</name>
  <value>hdfs/_HOST@JAVACHEN.COM</value>
</property>
<property>
  <name>dfs.journalnode.kerberos.internal.spnego.principal</name>
  <value>HTTP/_HOST@JAVACHEN.COM</value>
</property>
如果想配置 WebHDFS 启用授权验证,则添加:
<property>
  <name>dfs.webhdfs.enabled</name>
  <value>true</value>
</property>

<property>
  <name>dfs.web.authentication.kerberos.principal</name>
  <value>HTTP/_HOST@JAVACHEN.COM</value>
</property>

<property>
  <name>dfs.web.authentication.kerberos.keytab</name>
  <value>/etc/hadoop/conf/hdfs.keytab</value>
</property>
配置中有几点要注意的:
1. dfs.datanode.address表示 data transceiver RPC server 所绑定的 hostname 或 IP 地址,如果开启 security,端口号必须小于 1024(privileged port),否则的话启动 datanode 时候会报 Cannot start secure cluster without privileged resources 错误
2. principal 中的 instance 部分可以使用 _HOST 标记,系统会自动替换它为全称域名
3. 如果开启了 security, hadoop 会对 hdfs block data(由 dfs.data.dir 指定)做 permission check,方式用户的代码不是调用hdfs api而是直接本地读block data,这样就绕过了kerberos和文件权限验证,管理员可以通过设置 dfs.datanode.data.dir.perm 来修改 datanode 文件权限,这里我们设置为700
datanode启动失败
报错如下:
 Cannot start secure DataNode without configuring either privileged resources
 解决办法 参考了http://www.tuicool.com/articles/RRbIv2
 下载jsvc安装包 wget http://www.apache.org/dist/commons/daemon/source/commons-daemon-1.0.15-src.tar.gz
 
 tar zxvf commons-daemon-1.0.15-src.tar.gz; cd 
  
    原文作者:shantuwqk
    原文地址: https://www.cnblogs.com/shantu/p/4589855.html
    本文转自网络文章,转载此文章仅为分享知识,如有侵权,请联系博主进行删除。
点赞