安全模式下配置Hadoop身份验证

在安全模式下配置Hadoop身份验证需要完成以下步骤：

1. 生成Kerberos认证相关的密钥和凭据：

kdb5_util create -s ktadd -k /etc/security/keytabs/nn.service.keytab nn/hostname@REALM ktadd -k /etc/security/keytabs/dn.service.keytab dn/hostname@REALM ktadd -k /etc/security/keytabs/jhs.service.keytab jhs/hostname@REALM ktadd -k /etc/security/keytabs/rm.service.keytab rm/hostname@REALM ktadd -k /etc/security/keytabs/nm.service.keytab nm/hostname@REALM ktadd -k /etc/security/keytabs/spnego.service.keytab HTTP/hostname@REALM 

2. 配置Kerberos客户端：

vi /etc/krb5.conf [libdefaults] default_realm = REALM dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 86400 renew_lifetime = 604800 forwardable = true default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5 default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5 permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5 udp_preference_limit = 1 [realms] REALM = { kdc = kdc-hostname:88 admin_server = kdc-hostname:749 } [domain_realm] .hostname = REALM hostname = REALM 

3. 配置Hadoop客户端：

vi $HADOOP_HOME/etc/hadoop/core-site.xml <configuration> <property> <name>hadoop.security.authentication</name> <value>kerberos</value> </property> <property> <name>hadoop.security.authorization</name> <value>true</value> </property> <property> <name>hadoop.security.auth_to_local</name> <value>RULE:[2:$1@$0](.*@REALM)s/@.*//DEFAULT/</value> </property> </configuration> vi $HADOOP_HOME/etc/hadoop/hdfs-site.xml <configuration> <property> <name>dfs.namenode.kerberos.principal</name> <value>nn/hostname@REALM</value> </property> <property> <name>dfs.namenode.keytab.file</name> <value>/etc/security/keytabs/nn.service.keytab</value> </property> <property> <name>dfs.datanode.kerberos.principal</name> <value>dn/hostname@REALM</value> </property> <property> <name>dfs.datanode.keytab.file</name> <value>/etc/security/keytabs/dn.service.keytab</value> </property> </configuration> vi $HADOOP_HOME/etc/hadoop/yarn-site.xml <configuration> <property> <name>yarn.resourcemanager.keytab</name> <value>/etc/security/keytabs/rm.service.keytab</value> </property> <property> <name>yarn.resourcemanager.principal</name> <value>rm/hostname@REALM</value> </property> <property> <name>yarn.nodemanager.keytab</name> <value>/etc/security/keytabs/nm.service.keytab</value> </property> <property> <name>yarn.nodemanager.principal</name> <value>nm/hostname@REALM</value> </property> </configuration> vi $HADOOP_HOME/etc/hadoop/mapred-site.xml <configuration> <property> <name>mapreduce.jobhistory.keytab</name> <value>/etc/security/keytabs/jhs.service.keytab</value> </property> <property> <name>mapreduce.jobhistory.principal</name> <value>jhs/hostname@REALM</value> </property> </configuration> 

4. 启动Kerberos并检查是否成功：

kadmin.local start