[安全场景案例]

1 技术介绍 1

1.1 LDAP MirrorMode（MirrorMode in a Dual Data Center Configuration） 1

1.2 Kerberos原理 2

1.3 Hdp 3.1官方文档 2

2 场景案例 3

2.1 Webhdfs[默认simple（不开启kerberos）]： 3

2.1.1 Simple（REST API）: 3

2.1.2 Kerberos（REST API）： 3

2.1.3 Python客户端： 4

2.1.4 Java客户端： 5

2.2 HDFS 7

2.2.1 Java客户端： 7

2.3 Hive 8

2.3.1 Java客户端（HiveServer2）: 8

2.3.2 Python客户端: 10

2.3.2.1 Pyhs2方式 10

2.3.3 Beeline客户端（shell方式）： 13

2.4 Spark（仅支持Spark On Yarn）: 15

2.4.1 在spark-defaults.conf配置： 15

2.5 Hbase 15

2.5.1 Java客户端： 15

3 备注 19

3.1 常用的kerberos终端指令： 19

1 技术介绍

1.1 LDAP MirrorMode（MirrorMode in a Dual Data Center Configuration）

官网地址：http://www.openldap.org/doc/admin24/replication.html#MirrorMode

1.2 Kerberos原理

参考网址：

http://blog.csdn.net/wulantian/article/details/42418231

http://docs.oracle.com/cd/E26926_01/html/E25889/intro-1.html#scrolltoc

官网地址：http://web.mit.edu/kerberos/krb5-latest/doc/

1.3 Hdp 3.1官方文档

https://docs.hortonworks.com/HDPDocuments/HDP3/HDP-3.1.0/index.html

2 场景案例

2.1 Webhdfs[默认simple（不开启kerberos）]：

2.1.1 Simple（REST API）:

http://hadoop.apache.org/docs/r2.6.0/hadoop-project-dist/hadoop-hdfs/WebHDFS.html

请求NamNode Active节点,返回结果正常：

curl -s "http://namenode1:50070/webhdfs/v1/solr?op=LISTSTATUS",效果如下：

[root@host1 ~]# curl -s "http://namenode1:50070/webhdfs/v1/solr?op=LISTSTATUS"

{"FileStatuses":{"FileStatus":[

{"accessTime":0,"blockSize":0,"childrenNum":1,"fileId":141416,"group":"solr","length":0,"modificationTime":1535418675093,"owner":"solr","pathSuffix":"log_analytics_demo","permission":"755","replication":0,"storagePolicy":0,"type":"DIRECTORY"}, {"accessTime":0,"blockSize":0,"childrenNum":1,"fileId":141308,"group":"solr","length":0,"modificationTime":1535418656785,"owner":"solr","pathSuffix":"twitter_demo","permission":"755","replication":0,"storagePolicy":0,"type":"DIRECTORY"},

{"accessTime":0,"blockSize":0,"childrenNum":1,"fileId":141393,"group":"solr","length":0,"modificationTime":1535418670243,"owner":"solr","pathSuffix":"yelp_demo","permission":"755","replication":0,"storagePolicy":0,"type":"DIRECTORY"}]}}

请求NamNode StandBy节点，返回报错提示：

curl -s "http://namenode2:50070/webhdfs/v1/solr?op=LISTSTATUS",效果如下：

[root@host1 ~]# curl -s "http://namenode2:50070/webhdfs/v1/solr?op=LISTSTATUS" {"RemoteException":{"exception":"StandbyException","javaClassName":"org.apache.hadoop.ipc.StandbyException","message":"Operation category READ is not supported in state standby. Visit https://s.apache.org/sbnn-error"}}

2.1.2 Kerberos（REST API）：

先kinit 申请临时凭据，再curl执行REST请求，如下所示：

http://hadoop.apache.org/docs/stable/hadoop-project-dist/hadoop-hdfs/WebHDFS.html

[root@cdh-dev-01 ~]# kinit test

Password for test@huolala.cn:

[root@cdh-dev-01 ~]# klist

Ticket cache: FILE:/tmp/krb5cc_0

Default principal: test@huolala.cn

Valid starting Expires Service principal

05/16/2019 17:32:55 05/17/2019 17:32:55 krbtgt/huolala.cn@huolala.cn

renew until 05/23/2019 17:32:55

[root@cdh-dev-01 ~]# curl -i --negotiate -u : "http://cdh-dev-02:50070/webhdfs/v1/warehouse?op=LISTSTATUS"

HTTP/1.1 401 Authentication required

Date: Thu, 16 May 2019 09:33:12 GMT

Pragma: no-cache

X-FRAME-OPTIONS: SAMEORIGIN

WWW-Authenticate: Negotiate

Set-Cookie: hadoop.auth=; Path=/; HttpOnly

Cache-Control: must-revalidate,no-cache,no-store

Content-Type: text/html;charset=iso-8859-1

Content-Length: 280

HTTP/1.1 200 OK

Date: Thu, 16 May 2019 09:33:12 GMT

Cache-Control: no-cache

Expires: Thu, 16 May 2019 09:33:12 GMT

Date: Thu, 16 May 2019 09:33:12 GMT

Pragma: no-cache

X-FRAME-OPTIONS: SAMEORIGIN

WWW-Authenticate: Negotiate YGoGCSqGSIb3EgECAgIAb1swWaADAgEFoQMCAQ+iTTBLoAMCARKiRARCy6mdk1bA4u64abVSXVVB18O4vChX4KK5e6ukwWp700tLpipaj2Q7bOoW6CdVEbg9J0gxXS312/MdHalTW2Xy/K3n

Set-Cookie: hadoop.auth="u=test&p=test@huolala.cn&t=kerberos&e=1558035192811&s=Jpf871yL6qBWssmi1IJPVoALGQCFcx6hPvD2Ff9faV8="; Path=/; HttpOnly

Content-Type: application/json

Transfer-Encoding: chunked

{"FileStatuses":{"FileStatus":[

{"accessTime":0,"blockSize":0,"childrenNum":2,"fileId":17705,"group":"hdfs","length":0,"modificationTime":1556000535166,"owner":"hdfs","pathSuffix":"tablespace","permission":"755","replication":0,"storagePolicy":0,"type":"DIRECTORY"}

]}}

2.1.3 Python客户端：

https://github.com/pywebhdfs/pywebhdfs/issues/16

https://github.com/requests/requests-kerberos

https://github.com/pywebhdfs/pywebhdfs

2.1.4 Java客户端：

package org.training.kerberos;

//import java.io.*;

import org.apache.hadoop.conf.Configuration;

import org.apache.hadoop.fs.*;

import org.apache.hadoop.security.UserGroupInformation;

import java.net.URI;

public class WebHdfsKerberos {

public static void main(String[] args) throws Exception {

// TODO Auto-generated method stub

if (args.length != 4) {

System.out.println("please input: USER_NAME_KEY,KEYTAB_FILE_KEY,WEBHDFS_URL,HDFS_DIR");

System.exit(1);

}

System.setProperty("java.security.krb5.conf", "/etc/krb5.conf");

//System.setProperty("java.security.krb5.conf", "/Users/quyuehui/etc/krb5.conf");

//System.setProperty("sun.security.krb5.debug", "true");

String USER_NAME_KEY = args[0];

String KEYTAB_FILE_KEY = args[1];

String WEBHDFS_URL = args[2];

String DIR = args[3];

//String USER_NAME_KEY = "hdpclusterns1@huolala.cn";

//String KEYTAB_FILE_KEY = "/Users/quyuehui/etc/security/keytabs/smokeuser.headless.keytab";

//String WEBHDFS_URL = "webhdfs://hdpclusterns1";

//String DIR = "/tmp";

Configuration conf = new Configuration();

conf.addResource(new Path("/etc/hadoop/conf/core-site.xml"));

conf.addResource(new Path("/etc/hadoop/conf/hdfs-site.xml"));

//conf.addResource(new Path("/Users/quyuehui/etc/hadoop/conf/core-site.xml"));

//conf.addResource(new Path("/Users/quyuehui/etc/hadoop/conf/hdfs-site.xml"));

////conf.set("fs.defaultFS", "webhdfs://cdh-dev-02:50070");

////conf.set("fs.defaultFS", "webhdfs://hdpclusterns1/");

////conf.set("hadoop.security.authentication", "kerberos");

list_dir(conf, USER_NAME_KEY, KEYTAB_FILE_KEY, WEBHDFS_URL, DIR);

}

/**

* @Description:

* @Param: [conf, USER_NAME_KEY, KEYTAB_FILE_KEY, WEBHDFS_URL, DIR]

* @Return: void

*/

public static void list_dir(Configuration conf, String USER_NAME_KEY, String KEYTAB_FILE_KEY, String WEBHDFS_URL, String DIR) throws Exception {

System.out.println("hello，starting login " + USER_NAME_KEY + " from keytab: " + KEYTAB_FILE_KEY);

UserGroupInformation.setConfiguration(conf);

UserGroupInformation.loginUserFromKeytab(USER_NAME_KEY, KEYTAB_FILE_KEY);

//FileSystem fs = FileSystem.get(conf);

FileSystem fs = FileSystem.get(URI.create(WEBHDFS_URL), conf);

FileStatus[] fsStatus = fs.listStatus(new Path(DIR));

for (int i = 0; i < fsStatus.length; i++) {

System.out.println(fsStatus[i].getPath().toString());

}

//FileSystem fs = FileSystem.get(conf);

//if (fs.mkdirs(new Path("/tmp/testKerberos2")))

// System.out.print("Directory created...");

}

2.2 HDFS

2.2.1 Java客户端：

package org.training.kerberos;

//import java.io.*;

import java.net.URI;

import org.apache.hadoop.conf.Configuration;

import org.apache.hadoop.fs.*;

import org.apache.hadoop.security.UserGroupInformation;

public class HdfsKerberos {

public static void main(String[] args) throws Exception {

// TODO Auto-generated method stub

/**if (args.length != 4) {

System.out.println("please input: USER_NAME_KEY,KEYTAB_FILE_KEY,HDFS_URL,HDFS_DIR");

System.exit(1);

}

String user = args[0];

String keytab = args[1];

String hdfs_url = args[2];

String dir = args[3];

service_model_hdfs(user, keytab, hdfs_url, dir);*/

service_model_hdfs("hdpclusterns1@huolala.cn", "/Users/quyuehui/etc/security/keytabs/smokeuser.headless.keytab", "hdfs://hdpclusterns1","/");

}

/**

* @Description:

* @Param: [user, keytab, hdfs_url, dir]

* @Return: void

*/

public static void service_model_hdfs(String user, String keytab, String hdfs_url, String dir) throws Exception {

System.setProperty("java.security.krb5.conf", "/Users/quyuehui/etc/krb5.conf");

Configuration conf = new Configuration();

conf.addResource(new Path("/Users/quyuehui/etc/hadoop/conf/core-site.xml"));

conf.addResource(new Path("/Users/quyuehui/etc/hadoop/conf/hdfs-site.xml"));

list_dir(conf, user, keytab, hdfs_url, dir);

}

/**

* @Description:

* @Author: YueHui.Qu

* @Date: 2019-05-16 15:18

* @Param: [conf, hdfs_url, dir, user, keytab]

* @Return: void

*/

private static void list_dir(Configuration conf, String user, String keytab, String hdfs_url, String dir) throws Exception{

System.out.println("hello，starting login " + user + " from keytab: " + keytab);

UserGroupInformation.setConfiguration(conf);

UserGroupInformation.loginUserFromKeytab(user, keytab);

FileSystem fs = FileSystem.get(URI.create(hdfs_url), conf);

FileStatus[] fsStatus = fs.listStatus(new Path(dir));

for (int i = 0; i < fsStatus.length; i++) {

System.out.println(fsStatus[i].getPath().toString());

}

2.3 Hive

2.3.1 Java客户端（HiveServer2）:

package org.training.kerberos.Hive;

import org.apache.hadoop.conf.Configuration;

import org.apache.hadoop.security.UserGroupInformation;

import java.sql.Connection;

import java.sql.DriverManager;

import java.sql.PreparedStatement;

import java.sql.ResultSet;

public class TestHiveServer2 {

public static void main(String[] args) {

// TODO Auto-generated method stub

String key = args[0];

String keyPath = args[1];

String proxyName = args[2];

test_service_model_hs2(key, keyPath, proxyName);

}

/**

* ͨ

* @param key hdpclusterns1@huolala.cn

* @param keyPath /etc/security/keytabs/smokeuser.headless.keytab

*/

public static void test_service_model_hs2(String key, String keyPath,String proxyName) {

Connection con = null;

PreparedStatement ps = null;

ResultSet rs = null;

try {

String url = "jdbc:hive2://cdh-dev-02:10000/saledata;principal=" + key + "hive.server2.proxy.user=" + proxyName;

Configuration conf = new Configuration();

conf.set("hadoop.security.authentication", "Kerberos");

UserGroupInformation.setConfiguration(conf);

UserGroupInformation.loginUserFromKeytab(key, keyPath);

Class.forName("org.apache.hive.jdbc.HiveDriver");

con = DriverManager.getConnection(url);

ps = con.prepareStatement("select * from tbldate limit 100");

rs = ps.executeQuery();

int columns = rs.getMetaData().getColumnCount();

while (rs.next()) {

System.out.println(ps.getResultSet());

}

} catch (Exception e) {

e.printStackTrace();

} finally {

try {

if (rs != null)

rs.close();

if (ps != null)

ps.close();

if (con != null)

con.close();

} catch (Exception ex) {

ex.printStackTrace();

}

2.3.2 Python客户端:

2.3.2.1 Pyhs2方式

#!/usr/bin/env python

# -*- coding: utf-8 -*-

"""

@date:2014年12月25日

@installNote:yum install cyrus-sasl-plain cyrus-sasl-devel -y ; easy_install pyhs2

@projectAddress:https://github.com/BradRuderman/pyhs2

@warning:hive util with hive server2

@note:提交hive sql as demo,检测集群总体状态

"""

import pyhs2

import time

import StringIO

import pycurl

import json

def sendposttohttp(url,strdata):

b = StringIO.StringIO()

c = pycurl.Curl()

c.setopt(pycurl.URL, url)

#c.setopt(pycurl.POST, 1)

c.setopt(pycurl.WRITEFUNCTION, b.write) #设置写的回调，将输出定向到b.write中

c.setopt(pycurl.FOLLOWLOCATION, 1)

#c.setopt(pycurl.MAXREDIRS, 5) #最大重定向次数，可以预防重定向陷阱

c.setopt(pycurl.CONNECTTIMEOUT, 60) #设置链接超时

c.setopt(pycurl.POSTFIELDS, strdata)

try:

c.perform() #执行curl命令

except Exception as e:

print 'error:%s' % e

return b.getvalue()

class HiveClient:

def __init__(self, db_host, user, password, database, port, authMechanism, timeout):

"""

create connection to hive server2

"""

self.conn = pyhs2.connect(host=db_host,

port=port,

authMechanism=authMechanism,

user=user,

password=password,

database=database,

timeout=timeout

)

def query(self, sql):

"""

query

"""

with self.conn.cursor() as cursor:

#Show databases

#print cursor.getDatabases()

#Execute query

cursor.execute(sql)

#Return column info from query

#print cursor.getSchema()

#Fetch table results

#for i in cursor.fetch():

# for j in i:

# print j

#return cursor.fetch()

while (1):

row = cursor.fetchone()

if (row == None):

break

for i in row:

print i

#print cursor.fetchall()

def close(self):

"""

close connection

"""

self.conn.close()

def main():

"""

main process

"""

start_time=time.strftime("%Y-%m-%d %H:%M:%S",time.localtime()) #获取开始时间

alarm_url = "http://alarm.orion.com/alarm"

alarm_host = 'hd-services-1/192.168.17.43'

alarm_dict = {'systemId':1001,'notificationType':"PROBLEM",'sourceSystemDesc':"HADOOP_OVERALL_STATUS",'host':alarm_host,'alarmLevel':"CRITICAL",'monTime':start_time}

#应用程序连接HiveServer2需要在代码中，加入认证相关代码，具体示例，如下:

sql = """ select count(*) from saledata.tblstockdetail """

try:

#hive_client = HiveClient(db_host='127.0.0.1', port=10000, user='root', password='passwd',database='test', authMechanism='PLAIN',timeout=600000)

#java通过kerberos认证连接HiveServer2的方法，请参见:http://www.2cto.com/database/201505/396689.html

#python通过kerberos认证连接HiveServer2的方法，如下:

hive_client = HiveClient(db_host='172.17.32.139', port=10000, user='quyuehui@KERBEROS.COM', password='passwd',database='saledata', authMechanism='KERBEROS',timeout=600000)

hive_client.query(sql)

except Exception as e:

print "e:%s" % e

#alarm_dict['alarmInfo'] = str(e)

print alarm_dict

#print sendposttohttp(alarm_url,json.dumps(alarm_dict))

#finally:

# hive_client.close()

if __name__ == '__main__':

main()

2.3.3 Beeline客户端（shell方式）：

[test@cdh-dev-01 ~]$ kinit test

Password for test@huolala.cn:

[test@cdh-dev-01 ~]$ klist

Ticket cache: FILE:/tmp/krb5cc_10000000

Default principal: test@huolala.cn

Valid starting Expires Service principal

06/06/2019 10:53:16 06/07/2019 10:53:16 krbtgt/huolala.cn@huolala.cn

renew until 06/13/2019 10:53:16

[test@cdh-dev-01 ~]$ beeline -u "jdbc:hive2://cdh-dev-02:2181,cdh-dev-03:2181,cdh-dev-04:2181/default;password=root;principal=hive/_HOST@huolala.cn;serviceDiscoveryMode=zooKeeper;user=root;zooKeeperNamespace=hiveserver2"

SLF4J: Class path contains multiple SLF4J bindings.

SLF4J: Found binding in [jar:file:/usr/hdp/3.1.0.0-78/hive/lib/log4j-slf4j-impl-2.10.0.jar!/org/slf4j/impl/StaticLoggerBinder.class]

SLF4J: Found binding in [jar:file:/usr/hdp/3.1.0.0-78/hadoop/lib/slf4j-log4j12-1.7.25.jar!/org/slf4j/impl/StaticLoggerBinder.class]

SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation.

SLF4J: Actual binding is of type [org.apache.logging.slf4j.Log4jLoggerFactory]

Connecting to jdbc:hive2://cdh-dev-02:2181,cdh-dev-03:2181,cdh-dev-04:2181/default;password=root;principal=hive/_HOST@huolala.cn;serviceDiscoveryMode=zooKeeper;user=root;zooKeeperNamespace=hiveserver2

19/06/06 10:53:24 [main]: INFO jdbc.HiveConnection: Connected to cdh-dev-01:10000

Connected to: Apache Hive (version 3.1.0.3.1.0.0-78)

Driver: Hive JDBC (version 3.1.0.3.1.0.0-78)

Transaction isolation: TRANSACTION_REPEATABLE_READ

Beeline version 3.1.0.3.1.0.0-78 by Apache Hive

0: jdbc:hive2://cdh-dev-02:21> show databases;

INFO : Compiling command(queryId=hive_20190606105332_4cfbecb1-5c39-4453-9ead-4b32a74bd394): show databases

INFO : Semantic Analysis Completed (retrial = false)

INFO : Returning Hive schema: Schema(fieldSchemas:[FieldSchema(name:database_name, type:string, comment:from deserializer)], properties:null)

INFO : Completed compiling command(queryId=hive_20190606105332_4cfbecb1-5c39-4453-9ead-4b32a74bd394); Time taken: 0.023 seconds

INFO : Executing command(queryId=hive_20190606105332_4cfbecb1-5c39-4453-9ead-4b32a74bd394): show databases

INFO : Starting task [Stage-0:DDL] in serial mode

INFO : Completed executing command(queryId=hive_20190606105332_4cfbecb1-5c39-4453-9ead-4b32a74bd394); Time taken: 0.004 seconds

INFO : OK

+---------------------+

| database_name |

+---------------------+

| default |

| information_schema |

| sys |

| test |

+---------------------+

4 rows selected (0.104 seconds)

0: jdbc:hive2://cdh-dev-02:21>

2.4 Spark（仅支持Spark On Yarn）:

2.4.1 在spark-defaults.conf配置：

spark.yarn.keytab /opt/spark/conf/user.keytab

spark.yarn.principal spark@huolala.cn

2.5 Hbase

2.5.1 Java客户端：

package org.training.kerberos.Hbase;

import java.io.IOException;

import java.util.ArrayList;

import java.util.List;

import org.apache.hadoop.conf.Configuration;

import org.apache.hadoop.fs.Path;

import org.apache.hadoop.security.UserGroupInformation;

import org.apache.hadoop.hbase.HBaseConfiguration;

import org.apache.hadoop.hbase.KeyValue;

import org.apache.hadoop.hbase.client.HTable;

import org.apache.hadoop.hbase.client.Result;

import org.apache.hadoop.hbase.client.ResultScanner;

import org.apache.hadoop.hbase.client.Scan;

import org.apache.hadoop.hbase.client.Put;

import org.apache.hadoop.hbase.util.Bytes;

public class TestHbase {

public static void main(String[] args) throws Exception {

// TODO Auto-generated method stub

String user = args[0];

String keytab = args[1];

String hbaseTable = args[2];

String row = args[3];

String cf = args[4];

String column = args[5];

String value = args[6];

Configuration conf = authenticationConfig(user, keytab);

scanSpan(hbaseTable, conf);

put(hbaseTable,row, cf, column, value,conf);

}

/**

* @Description:

* @Author: YueHui.Qu

* @Date: 2019-06-06 11:30

* @Param: [user, keytab]

* @Return: org.apache.hadoop.conf.Configuration

*/

private static Configuration authenticationConfig(String user, String keytab) {

// 这个hbase.keytab也是从远程服务器上copy下来的, 里面存储的是密码相关信息

// 这样我们就不需要交互式输入密码了

System.out.println("start load hadoop and hbase config file. /opt/hbase and /opt/hadoop");

Configuration conf = HBaseConfiguration.create();

//此处load *-site.xml 是因为使用java cp 启动进程,因此额外加载配置,获得所需的必要环境。如果运行类似hadoop jar wordcount.jar com.example.wordcount 的mapreduce任务，则无需加载这些配置

conf.addResource(new Path("file:///opt/hadoop/etc/hadoop/core-site.xml"));

conf.addResource(new Path("file:///opt/hadoop/etc/hadoop/hdfs-site.xml"));

conf.addResource(new Path("file:///opt/hbase/conf/hbase-site.xml"));

System.out.println("end load hadoop and hbase config file");

System.out.println(conf.get("hbase.zookeeper.quorum"));

System.out.println(conf.get("hbase.zookeeper.property.clientPort"));

UserGroupInformation.setConfiguration(conf);

try {

UserGroupInformation.loginUserFromKeytab(user, keytab);

} catch (IOException e) {

// TODO Auto-generated catch block

e.printStackTrace();

}

return conf;

}

public static void scanSpan(String tableName, final Configuration conf) throws Exception {

HTable table = new HTable(conf, tableName);

System. out.println("tablename:" +new String(table.getTableName()));

Scan s = new Scan();

System. out.println("new scan");

ResultScanner rs = table.getScanner(s);

System. out.println("get ResultScanner");

for (Result r : rs) {

System. out.println(r.toString());

KeyValue[] kv = r. raw();

for (int i = 0; i < kv.length; i++) {

System. out.print(new String(kv[i].getRow()) + "");

System. out.print(new String(kv[i].getFamily()) + ":");

System. out.print(new String(kv[i].getQualifier() ) + "" );

System. out.print(kv[i].getTimestamp() + "" );

System. out.println(new String(kv[i].getValue() ));

}

public static void put(String tableName, String row, String cf, String column, String value, final Configuration conf) throws Exception {

try {

System. out.println("put start...");

HTable table = new HTable(conf, tableName);

List<Put> puts = new ArrayList<Put>();

Put put1 = new Put(Bytes.toBytes(row));

put1.add(Bytes.toBytes(cf), Bytes.toBytes(column), Bytes.toBytes(value));

put1.addImmutable(Bytes.toBytes(cf), Bytes.toBytes(column), Bytes.toBytes(value));

puts.add(put1);

table.put(put1);

System. out.println("put end ...");

} catch (Exception ex) {

ex.printStackTrace();

}

3 备注

3.1 常用的kerberos终端指令：

> kinit ldapadmin

系统会提示输入密码，如果一切正常，那么会安静的返回。实际上，你已经通过了kerberos的身份验证，且获得了一个Service TGT(Ticket-Granting Ticket). Service TGT的意义是，在一段时间内，你都可以用此TGT去请求某些service，比如ldap service，而不需要再次通过kerberos的认证。

> klist

这条命令会查看系统当前的ticket

> kdestory

这条命令会destroy掉系统当前cache的所有ticket

> kinit –k ldapadmin –t /tmp/user_ldapadmin.keytab

这里演示了你确实可以直接使用user的key，而不是口令来通过kerberos的验证。如果你在前面导出了user ldapadmin的key，可以验证一下。同时如果你运行kinit ldapadmin，那么即使输入了正确的password，系统仍然提示密码错误。

ITPub博客

hadoop kerberos场景案例

最新文章