Hadoop生態圈-使用FreeIPA安裝Kerberos和LDAP
Hadoop生態圈-使用FreeIPA安裝Kerberos和LDAP
html
做者：尹正傑前端
版權聲明：原創做品，謝絕轉載！不然將追究法律責任。java
有些大數據平臺只是簡單地經過防火牆來解決他們的網絡安全問題。十分不信的的是，防火牆有一個假設的前提，它總假設「破壞者」都來自於外部，這一般是一個很是糟糕的假設。大多數真正具備破壞性的計算機犯罪事件都是由內部人員進行的。防火牆也有一個明顯的缺點，由於它們限制了用戶使用Internet的方式。（畢竟，防火牆只是一個不那麼極端的例子，沒有什麼比沒有鏈接到網絡的計算機更安全 - 而且關機！）在許多地方，這些限制是不切實際和不可接受的。node
一.網絡安全框架協議Kerberos簡介python
1>.什麼是Kerberoslinux
Kerberos是一個網絡認證的框架協議，它的命名靈感來自於希臘神話中一隻三頭犬守護獸，寓意其擁有強大的保護能力。Kerberos協議經過強大密鑰系統爲Server（服務端）和Client（客戶端）應用程序之間提供強大的通訊加密和認證服務。在使用Kerberos協議認證的集羣中，Client不會直接和他的Server服務進行通訊認證，而是經過KDC（key Distribution Center）這樣一個獨立的服務來完成互相之間的認證。同時Kerberos 還能將服務之間的所有通訊進行加密以保證其隱私於完整性。web
Kerberos由麻省理工學院建立，做爲解決這些網絡安全問題的解決方案。Kerberos協議使用強加密技術，以便客戶端能夠經過不安全的網絡鏈接向服務器（反之亦然）證實其身份。在客戶端和服務器使用Kerberos證實其身份後，他們還能夠加密全部通訊，以確保在業務開展時的隱私和數據完整性。詳情請參考：https://web.mit.edu/kerberos/。算法
2>.Kerberos核心概念shell
Kerberos協議中有一些重要的概念，瞭解這些概念有助於咱們理解Kerberos的認證過程。apache
2.1>.KDC（Key Distribution Centor）：
KDC用於驗證各個模塊，是統一認證服務。
2.2>.Kerberos KDC Server：
KDC所在的服務器。
2.3>.Kerberos Client
任何一個須要經過KDC認證的機器（或模塊）。
2.4>.Principal
用於驗證一個用戶或者一個Service的惟一標識，至關於一個帳號，須要爲其設置密碼。
2.5>.Keytab
包含一個或多個Principal以及其密碼的文件，可用於用戶登陸。
2.6>.Relam
由KDC以及多個Kerberos Client組成的網絡。
2.7>.KDC Admin Account
KDC中擁有管理權限的用戶（例如添加，修改，刪除Principal）。
2.8>.Authentication Sever（AS）
用於初始化認證，並生成Ticket Granting Ticket（TGT）。
2.9>.Ticket Granting Server（TGS）
在TGT的基礎上生成Service Ticket。通常狀況下AS和TGS都在KDC的Server上。
3>.Kerberos的認證流程
Kerberos協議主要由Key分發中心（即KDC，全稱「Key Distribution Centor」），服務提供者（Server）和用戶（User）三部分組成，它的認證過程以下圖所示：
第 1 步：
client（一個User或者一個Service）會用Pricipal到Authentication Sever（AS）去認證，但願獲取訪問server的權限。
第 2 步：
kerberos獲得了這個消息，首先得判斷client是不是可信賴的，也就是白名單黑名單的說法。這就是AS服務完成的工做，經過在AD中存儲黑名單和白名單來區分client。成功後，返回AS返回TGT給client。
第 3 步：
這是隻有AS和這個Principal的使用者能夠識別該TGT。在拿到加密的TGT以後，client（User或者Service）會使用Principal的Key來解密TGT。並使用解密後的TGT繼續向kerberos請求，但願獲取訪問server的權限。
第 4 步：
kerberos又一次獲得了這個消息，這時候經過client（User或者Service）消息中的TGT（注意：此時的TGT是第三步中解密後的TGT，並非第二步的TGT喲！），判斷出了client擁有了這個權限，給了client訪問server的權限Server Ticket。
第 5～6 步：
client獲得但願訪問的Server Ticket後，終於能夠成功訪問該Server。須要注意的是，獲得的這個Server Ticket只是針對這臺Server，其餘server須要繼續向TGS申請（由於每臺服務器都有本身的Server Ticket喲！）。在Kerberos認證的集羣中，只有拿着這個Service Ticket才能夠訪問真正的Server從而實現本身的業務邏輯。
4>.Kerberos的優勢
分析整個Kerberos的認證過程以後，咱們來總結一下Kerberos都有哪些優勢：
4.1>.較高的Performance
雖然咱們一再地說Kerberos是一個涉及到3方的認證過程：Client、Server、KDC。可是一旦Client得到用過訪問某個Server的Ticket，該Server就能根據這個Ticket實現對Client的驗證，而無須KDC的再次參與。和傳統的基於Windows NT 4.0的每一個徹底依賴Trusted Third Party的NTLM比較，具備較大的性能提高。
4.2>.實現了雙向驗證（Mutual Authentication）
傳統的NTLM認證基於這樣一個前提：Client訪問的遠程的Service是可信的、無需對於進行驗證，因此NTLM未曾提供雙向驗證的功能。這顯然有點理想主義，爲此Kerberos彌補了這個不足：Client在訪問Server的資源以前，能夠要求對Server的身份執行認證。
4.3>.對Delegation的支持
Impersonation和Delegation是一個分佈式環境中兩個重要的功能。Impersonation容許Server在本地使用Logon 的Account執行某些操做，Delegation需用Server將logon的Account帶入到另過一個Context執行相應的操做。NTLM僅對Impersonation提供支持，而Kerberos經過一種雙向的、可傳遞的（Mutual 、Transitive）信任模式實現了對Delegation的支持。
4.4>.互操做性（Interoperability）
Kerberos最初由MIT獨創，如今已經成爲一行被普遍接受的標準。因此對於不一樣的平臺能夠進行普遍的互操做。
二.使用FreeIPA安裝Kerberos和LDAP
Kerberos協議只是一種協議標準的框架，而MIT Kerberos則是實現了該協議的認證服務，是Kerberos協議的物理載體。將它於Hadoop服務進行集成便可以很好地解決安全性不足的問題。除了須要安裝MIT Kerberos以外，咱們還須要安裝LDAP。Kerberos和LDAP服務這類基礎設施組件雖好，但他們手動安裝起來都十分的繁瑣。這種手動安裝的方式既低效又不利於管理。所以咱們能夠經過FreeIPA來安裝這些基礎組件。
FreeIPA是一個集成的安裝信息管理解決方案。它整合了LDAP，Kerberos，NTP，Bind，Apache和Tomcat等核心軟件包，從而造成來一個以LDAP爲數據存儲後端，Kerberos爲驗證前端，Bind爲主機識別，同時還提供統一的命令行管理工具和WEB管理界面的集成信息管理系統。FreeIPA創建在著名的開源組件和標準協議之上，具備易於管理，安裝和配置任務自動化的特色。FreeIPA是平臺基礎設施的一記強力組合拳，它就像大數據版本的XAMPP同樣，爲咱們在基礎設施安裝於管理上帶來了巨大的便利。FreeIPA它不只繼承了LDAP和Kerberos這兩個很是重要的組件，而且在這些服務之上還建立了一個CLI接口。經過這層接口咱們可以輕鬆地完成一系列動做，例如對Kerberos用戶的管理工做。值得注意的是，當咱們經過FreeIPA建立一個Kerberos用戶的同時，他還會自動建立一個相同的LADP用戶和Linux服務器用戶，這意味着什麼呢？這意味着從邏輯上來看，咱們建立了一個Kerberos用戶，而從物理上其實FreeIPA幫咱們建立了三個用戶，而且它可以保證這三個用戶事物的一致性。這是一項很是重要且了不得的特性，它在某種程度上幫咱們實現了用戶的統一。
FreeIPA服務分爲IPA-Server和IPA-Client兩個部分，IPA-Server包含了全部集成的組件以及Web UI管理控制檯，能夠說它是控制於驗證的中心服務。咱們須要單獨準備一臺服務器來安裝IPA-Server程序，這臺服務器不能屬於任何由Ambari管理的集羣節點（本篇博客我使用的節點「node100.yinzhengjie.com」來部署）。這是由於安裝IPA-Server的程序中，安裝程序會將其所在的服務器地址註冊到DNS服務中，而Ambari的集羣節點也會進行相同的註冊動做。若是一臺服務器同時安裝來IPA-Server並註冊成爲Ambari節點，就會形成名稱的衝突，致使在註冊DNS的過程當中失敗。IP-Server並註冊成爲Ambari節點，就會形成名稱的衝突，致使在註冊DNS的過程當中失敗。IPA-Client於IPA-Server則偏偏相反，Ambari管理的全部集羣節點服務器上都必須安裝IPA-Client。
XAMPP是徹底免費且易於安裝的Apache發行版，其中包含MariaDB、PHP和Perl。XAMPP開放源碼包的設置讓安裝和使用出奇容易。是開源基礎組件的一記強力組合拳。官網地址：https://www.apachefriends.org/zh_cn/index.html
舒適提示：在部署前建議直接關閉到selinux和firewalld服務，FreeIPA文檔參考連接爲：https://www.globo.tech/learning-center/install-freeipa-centos-7/。
1>.擴充密鑰長度
Kerberos須要使用256爲的AES加密算法，而JRE默認中的密鑰長度比較短，而且不足以支撐。因此咱們須要升級集羣中全部服務器節點JRE的安全策略，使其可以解除密鑰長度的限制。修改的方式是下載並替換JRE中的Unlimited JCEPolicy文件。以JDK1.8爲例，下載地址爲：https://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html。
將其解壓以後會獲得「local_policy.jar」和「US_export_policy.jar」兩個jar文件，將它們複製到每臺服務器JDK路徑下到「jre/lib/security」目錄下（例如拷貝到「/yinzhengjie/softwares/jdk/jre/lib/security/」，點擊下面的按鈕查看詳細的操做）便可完成安全策略的升級。
[root@node101 download]# ll total 12 -rw-r--r-- 1 root root 8409 Dec 12 13:58 jce_policy-8.zip [root@node101 download]# unzip jce_policy-8.zip Archive: jce_policy-8.zip creating: UnlimitedJCEPolicyJDK8/ inflating: UnlimitedJCEPolicyJDK8/local_policy.jar inflating: UnlimitedJCEPolicyJDK8/README.txt inflating: UnlimitedJCEPolicyJDK8/US_export_policy.jar [root@node101 download]# [root@node101 download]# ll total 16 -rw-r--r-- 1 root root 8409 Dec 12 13:58 jce_policy-8.zip drwxrwxr-x 2 root root 4096 Dec 21 2013 UnlimitedJCEPolicyJDK8 [root@node101 download]# [root@node101 UnlimitedJCEPolicyJDK8]# ll /yinzhengjie/softwares/jdk/jre/lib/security/ total 172 -rw-r--r--. 1 10 143 4054 Oct 6 20:52 blacklist -rw-r--r--. 1 10 143 1273 Oct 6 20:52 blacklisted.certs -rw-r--r--. 1 10 143 106896 Oct 6 20:52 cacerts -rw-r--r--. 1 10 143 2466 Oct 6 20:52 java.policy -rw-r--r--. 1 10 143 41516 Oct 6 20:52 java.security -rw-r--r--. 1 10 143 98 Oct 6 20:52 javaws.policy drwxr-xr-x. 4 10 143 4096 Oct 6 20:52 policy -rw-r--r--. 1 10 143 0 Oct 6 20:52 trusted.libraries [root@node101 UnlimitedJCEPolicyJDK8]# [root@node101 UnlimitedJCEPolicyJDK8]# scp local_policy.jar US_export_policy.jar /yinzhengjie/softwares/jdk/jre/lib/security/ [root@node101 UnlimitedJCEPolicyJDK8]# [root@node101 UnlimitedJCEPolicyJDK8]# ll /yinzhengjie/softwares/jdk/jre/lib/security/ total 180 -rw-r--r--. 1 10 143 4054 Oct 6 20:52 blacklist -rw-r--r--. 1 10 143 1273 Oct 6 20:52 blacklisted.certs -rw-r--r--. 1 10 143 106896 Oct 6 20:52 cacerts -rw-r--r--. 1 10 143 2466 Oct 6 20:52 java.policy -rw-r--r--. 1 10 143 41516 Oct 6 20:52 java.security -rw-r--r--. 1 10 143 98 Oct 6 20:52 javaws.policy -rw-r--r-- 1 root root 3035 Dec 12 14:03 local_policy.jar drwxr-xr-x. 4 10 143 4096 Oct 6 20:52 policy -rw-r--r--. 1 10 143 0 Oct 6 20:52 trusted.libraries -rw-r--r-- 1 root root 3023 Dec 12 14:03 US_export_policy.jar [root@node101 UnlimitedJCEPolicyJDK8]#
[root@node101 ~]# cat `which xrsync.sh ` #!/bin/bash #@author :yinzhengjie #blog:http://www.cnblogs.com/yinzhengjie #EMAIL:y1053419035@qq.com #判斷用戶是否傳參 if [ $# -lt 1 ];then echo "請輸入參數"; exit fi #獲取文件路徑 file=$@ #獲取子路徑 filename=`basename $file` #獲取父路徑 dirpath=`dirname $file` #獲取完整路徑 cd $dirpath fullpath=`pwd -P` #同步文件到DataNode for (( i=102;i<=103;i++ )) do #使終端變綠色 tput setaf 2 echo =========== node${i}.yinzhengjie.org.cn : $file =========== #使終端變回原來的顏色，即白灰色 tput setaf 7 #遠程執行命令 rsync -lr $filename `whoami`@node${i}.yinzhengjie.org.cn:$fullpath #判斷命令是否執行成功 if [ $? == 0 ];then echo "命令執行成功" fi done [root@node101 ~]#
[root@node101 ~]# cat `which xcall.sh` #!/bin/bash #@author :yinzhengjie #blog:http://www.cnblogs.com/yinzhengjie #EMAIL:y1053419035@qq.com #判斷用戶是否傳參 if [ $# -lt 1 ];then echo "請輸入參數" exit fi #獲取用戶輸入的命令 cmd=$@ for (( i=101;i<=103;i++ )) do #使終端變綠色 tput setaf 2 echo ============= node${i}.yinzhengjie.org.cn : $cmd ============ #使終端變回原來的顏色，即白灰色 tput setaf 7 #遠程執行命令 ssh node${i}.yinzhengjie.org.cn $cmd #判斷命令是否執行成功 if [ $? == 0 ];then echo "命令執行成功" fi done [root@node101 ~]#
[root@node101 ~]# cat /etc/hosts | grep yinzhengjie 172.30.1.100 node100.yinzhengjie.org.cn 172.30.1.101 node101.yinzhengjie.org.cn 172.30.1.102 node102.yinzhengjie.org.cn 172.30.1.103 node103.yinzhengjie.org.cn [root@node101 ~]# [root@node101 ~]# [root@node101 ~]# xrsync.sh /etc/hosts =========== node102.yinzhengjie.org.cn : /etc/hosts =========== 命令執行成功 =========== node103.yinzhengjie.org.cn : /etc/hosts =========== 命令執行成功 [root@node101 ~]#
[root@node101 ~]# [root@node101 ~]# xrsync.sh /yinzhengjie/softwares/jdk/jre/lib/security/ =========== node102.yinzhengjie.org.cn : /yinzhengjie/softwares/jdk/jre/lib/security/ =========== 命令執行成功 =========== node103.yinzhengjie.org.cn : /yinzhengjie/softwares/jdk/jre/lib/security/ =========== 命令執行成功 [root@node101 ~]#
[root@node101 ~]# xcall.sh cat /etc/hosts | grep yinzhengjie ============= node101.yinzhengjie.org.cn : cat /etc/hosts ============ 172.30.1.100 node100.yinzhengjie.org.cn 172.30.1.101 node101.yinzhengjie.org.cn 172.30.1.102 node102.yinzhengjie.org.cn 172.30.1.103 node103.yinzhengjie.org.cn ============= node102.yinzhengjie.org.cn : cat /etc/hosts ============ 172.30.1.100 node100.yinzhengjie.org.cn 172.30.1.101 node101.yinzhengjie.org.cn 172.30.1.102 node102.yinzhengjie.org.cn 172.30.1.103 node103.yinzhengjie.org.cn ============= node103.yinzhengjie.org.cn : cat /etc/hosts ============ 172.30.1.100 node100.yinzhengjie.org.cn 172.30.1.101 node101.yinzhengjie.org.cn 172.30.1.102 node102.yinzhengjie.org.cn 172.30.1.103 node103.yinzhengjie.org.cn [root@node101 ~]#
[root@node101 ~]# xcall.sh ls -l /yinzhengjie/softwares/jdk/jre/lib/security/ ============= node101.yinzhengjie.org.cn : ls -l /yinzhengjie/softwares/jdk/jre/lib/security/ ============ total 180 -rw-r--r--. 1 10 143 4054 Oct 6 20:52 blacklist -rw-r--r--. 1 10 143 1273 Oct 6 20:52 blacklisted.certs -rw-r--r--. 1 10 143 106896 Oct 6 20:52 cacerts -rw-r--r--. 1 10 143 2466 Oct 6 20:52 java.policy -rw-r--r--. 1 10 143 41516 Oct 6 20:52 java.security -rw-r--r--. 1 10 143 98 Oct 6 20:52 javaws.policy -rw-r--r-- 1 root root 3035 Dec 12 14:03 local_policy.jar drwxr-xr-x. 4 10 143 4096 Oct 6 20:52 policy -rw-r--r--. 1 10 143 0 Oct 6 20:52 trusted.libraries -rw-r--r-- 1 root root 3023 Dec 12 14:03 US_export_policy.jar 命令執行成功 ============= node102.yinzhengjie.org.cn : ls -l /yinzhengjie/softwares/jdk/jre/lib/security/ ============ total 180 -rw-r--r-- 1 root root 4054 Dec 12 14:09 blacklist -rw-r--r-- 1 root root 1273 Dec 12 14:09 blacklisted.certs -rw-r--r-- 1 root root 106896 Dec 12 14:09 cacerts -rw-r--r-- 1 root root 2466 Dec 12 14:09 java.policy -rw-r--r-- 1 root root 41516 Dec 12 14:09 java.security -rw-r--r-- 1 root root 98 Dec 12 14:09 javaws.policy -rw-r--r-- 1 root root 3035 Dec 12 14:09 local_policy.jar drwxr-xr-x. 4 root root 4096 Dec 5 16:23 policy -rw-r--r-- 1 root root 0 Dec 12 14:09 trusted.libraries -rw-r--r-- 1 root root 3023 Dec 12 14:09 US_export_policy.jar 命令執行成功 ============= node103.yinzhengjie.org.cn : ls -l /yinzhengjie/softwares/jdk/jre/lib/security/ ============ total 180 -rw-r--r-- 1 root root 4054 Dec 12 14:09 blacklist -rw-r--r-- 1 root root 1273 Dec 12 14:09 blacklisted.certs -rw-r--r-- 1 root root 106896 Dec 12 14:09 cacerts -rw-r--r-- 1 root root 2466 Dec 12 14:09 java.policy -rw-r--r-- 1 root root 41516 Dec 12 14:09 java.security -rw-r--r-- 1 root root 98 Dec 12 14:09 javaws.policy -rw-r--r-- 1 root root 3035 Dec 12 14:09 local_policy.jar drwxr-xr-x. 4 root root 4096 Dec 5 16:23 policy -rw-r--r-- 1 root root 0 Dec 12 14:09 trusted.libraries -rw-r--r-- 1 root root 3023 Dec 12 14:09 US_export_policy.jar 命令執行成功 [root@node101 ~]#
[root@node101 ~]# scp jce_policy-8.zip jdk-8u191-linux-x64.tar.gz node100.yinzhengjie.org.cn:~ root@node100.yinzhengjie.org.cn's password: jce_policy-8.zip 100% 8409 8.2KB/s 00:00 jdk-8u191-linux-x64.tar.gz 100% 183MB 182.9MB/s 00:01 [root@node101 ~]#
[root@node100 ~]# yum -y install unzip zip Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: mirrors.huaweicloud.com * extras: mirrors.huaweicloud.com * updates: mirrors.huaweicloud.com Resolving Dependencies --> Running transaction check ---> Package unzip.x86_64 0:6.0-19.el7 will be installed ---> Package zip.x86_64 0:3.0-11.el7 will be installed --> Finished Dependency Resolution Dependencies Resolved ================================================================================================================================= Package Arch Version Repository Size ================================================================================================================================= Installing: unzip x86_64 6.0-19.el7 base 170 k zip x86_64 3.0-11.el7 base 260 k Transaction Summary ================================================================================================================================= Install 2 Packages Total download size: 430 k Installed size: 1.1 M Downloading packages: (1/2): unzip-6.0-19.el7.x86_64.rpm | 170 kB 00:00:00 (2/2): zip-3.0-11.el7.x86_64.rpm | 260 kB 00:00:01 --------------------------------------------------------------------------------------------------------------------------------- Total 238 kB/s | 430 kB 00:00:01 Running transaction check Running transaction test Transaction test succeeded Running transaction Installing : zip-3.0-11.el7.x86_64 1/2 Installing : unzip-6.0-19.el7.x86_64 2/2 Verifying : unzip-6.0-19.el7.x86_64 1/2 Verifying : zip-3.0-11.el7.x86_64 2/2 Installed: unzip.x86_64 0:6.0-19.el7 zip.x86_64 0:3.0-11.el7 Complete! [root@node100 ~]#
[root@node100 ~]# mkdir -pv /yinzhengjie/softwares/ mkdir: created directory ‘/yinzhengjie’ mkdir: created directory ‘/yinzhengjie/softwares/’ [root@node100 ~]# [root@node100 ~]# [root@node100 ~]# ll total 187276 -rw-r--r--. 1 root root 8409 Dec 12 01:23 jce_policy-8.zip -rw-r--r--. 1 root root 191753373 Dec 12 01:23 jdk-8u191-linux-x64.tar.gz [root@node100 ~]# [root@node100 ~]# tar -zxf jdk-8u191-linux-x64.tar.gz -C /yinzhengjie/softwares/ [root@node100 ~]# ln -s /yinzhengjie/softwares/jdk1.8.0_191/ /yinzhengjie/softwares/jdk [root@node100 ~]# [root@node100 ~]# unzip jce_policy-8.zip Archive: jce_policy-8.zip creating: UnlimitedJCEPolicyJDK8/ inflating: UnlimitedJCEPolicyJDK8/local_policy.jar inflating: UnlimitedJCEPolicyJDK8/README.txt inflating: UnlimitedJCEPolicyJDK8/US_export_policy.jar [root@node100 ~]# [root@node100 ~]# cd UnlimitedJCEPolicyJDK8/ [root@node100 UnlimitedJCEPolicyJDK8]# cp local_policy.jar US_export_policy.jar /yinzhengjie/softwares/jdk/jre/lib/security/ [root@node100 UnlimitedJCEPolicyJDK8]# [root@node100 UnlimitedJCEPolicyJDK8]# ll /yinzhengjie/softwares/jdk/jre/lib/security/ total 180 -rw-r--r--. 1 10 143 4054 Oct 6 08:52 blacklist -rw-r--r--. 1 10 143 1273 Oct 6 08:52 blacklisted.certs -rw-r--r--. 1 10 143 106896 Oct 6 08:52 cacerts -rw-r--r--. 1 10 143 2466 Oct 6 08:52 java.policy -rw-r--r--. 1 10 143 41516 Oct 6 08:52 java.security -rw-r--r--. 1 10 143 98 Oct 6 08:52 javaws.policy -rw-r--r--. 1 root root 3035 Dec 12 01:31 local_policy.jar drwxr-xr-x. 4 10 143 4096 Oct 6 08:52 policy -rw-r--r--. 1 10 143 0 Oct 6 08:52 trusted.libraries -rw-r--r--. 1 root root 3023 Dec 12 01:31 US_export_policy.jar [root@node100 UnlimitedJCEPolicyJDK8]# [root@node100 UnlimitedJCEPolicyJDK8]# cd [root@node100 ~]# [root@node100 ~]# vi /etc/profile [root@node100 ~]# [root@node100 ~]# tail -3 /etc/profile #ADD JAVA_PATH JAVA_HOME=/yinzhengjie/softwares/jdk PATH=$PATH:$JAVA_HOME/bin [root@node100 ~]# [root@node100 ~]# source /etc/profile [root@node100 ~]# java -version java version "1.8.0_191" Java(TM) SE Runtime Environment (build 1.8.0_191-b12) Java HotSpot(TM) 64-Bit Server VM (build 25.191-b12, mixed mode) [root@node100 ~]#
2>.安裝IPA-Server
在安裝新軟件包以前，最好確保服務器是最新的。做爲root用戶，使用帶有-y標誌的yum更新CentOS 7服務器，以免提示爲yes，以下所示：
[root@node100 ~]# hostname node100.yinzhengjie.com [root@node100 ~]# [root@node100 ~]# ip a | grep global | awk '{print $2}' | awk -F "/" '{print $1}' 172.30.1.100 [root@node100 ~]# [root@node100 ~]# yum -y update
在咱們安裝FreeIPA以前，咱們必須採起一些基本步驟來配置咱們的機器準備就緒。若是還沒有安裝，請使用如下命令安裝咱們的安裝所需的軟件包依賴項：
[root@node100 ~]# yum -y install bind-dyndb-ldap ipa-server-dns sssd-client sssd-common sssd-common-pac sssd-ldap sssd-proxy python-sssdconfig authconfig authconfig-gtk
咱們還須要確保咱們的服務器主機名能夠解析爲有效的IP地址，以便可以安裝和訪問FreeIPA。出於本教程的目的，咱們將使用「172.30.1.100」做爲咱們服務器的IP地址，使用「
node100.yinzhengjie.com」做爲咱們的URL。固然咱們也能夠手動配置一下DNS地址。執行如下命令，替換爲您本身的IP和URL以及DNS服務器：
[root@node100 ~]# echo 172.30.1.100 node100.yinzhengjie.com node100 >>/etc/hosts [root@node100 ~]# [root@node100 ~]# cat /etc/hostname node100.yinzhengjie.com [root@node100 ~]# [root@node100 ~]# cat /etc/resolv.conf | grep nameserver nameserver 127.0.0.1 nameserver 8.8.8.8 [root@node100 ~]#
如今咱們準備安裝實際的FreeIPA服務器了。再次使用yum安裝必要的包。不要忘記全部命令必須以root用戶身份完成：
[root@node100 ~]# yum -y install ipa-server Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: mirrors.huaweicloud.com * extras: mirrors.aliyun.com * updates: mirrors.huaweicloud.com Package ipa-server-4.6.4-10.el7.centos.x86_64 already installed and latest version #看來在上面安裝依賴包的時候已經默認把它也給安裝啦！ Nothing to do [root@node100 ~]#
3>.配置IPA-Server
安裝成功以後，就能執行「ipa-server」相關的shell命令了，FreeIPA的設置過程可能須要很長時間才能完成，具體取決於服務器規格。經過「ipa-server-install --setup-dns」命令開始安裝過程：
[root@node100 ~]# ipa-server-install --setup-dns The log file for this installation can be found in /var/log/ipaserver-install.log #這裏告訴了咱們日誌的存放位置。 ============================================================================== This program will set up the IPA Server. This includes: * Configure a stand-alone CA (dogtag) for certificate management * Configure the Network Time Daemon (ntpd) * Create and configure an instance of Directory Server * Create and configure a Kerberos Key Distribution Center (KDC) * Configure Apache (httpd) * Configure DNS (bind) * Configure the KDC to enable PKINIT To accept the default shown in brackets, press the Enter key. WARNING: conflicting time&date synchronization service 'chronyd' will be disabled in favor of ntpd Enter the fully qualified domain name of the computer on which you're setting up server software. Using the form <hostname>.<domainname> Example: master.example.com. Server host name [node100.yinzhengjie.com]: #指定名稱，默認是當前的主機的FQDN Warning: skipping DNS resolution of host node100.yinzhengjie.com The domain name has been determined based on the host name. Please confirm the domain name [yinzhengjie.com]: #指定域名，默認是將FQDN的主機名去掉後的字符串看成域名 The kerberos protocol requires a Realm name to be defined. This is typically the domain name converted to uppercase. Please provide a realm name [YINZHENGJIE.COM]: #指定realm，就是將域名的字母大寫 Certain directory server operations require an administrative user. This user is referred to as the Directory Manager and has full access to the Directory for system management tasks and will be added to the instance of directory server created for IPA. The password must be at least 8 characters long. Directory Manager password: #這裏須要設置LDAP的管理員密碼，密碼長度至少爲8個字符串。 Password (confirm): #這裏須要重複上述的密碼，若是你兩次輸入的密碼不一致，會持續讓你重置密碼的喲！ The IPA server requires an administrative user, named 'admin'. This user is a regular system account used for IPA server administration. IPA admin password: #指定IPA管理員的密碼，這個密碼切記要妥善保存，由於後續會屢次使用它。 Password (confirm): Checking DNS domain yinzhengjie.com., please wait ... Please provide the IP address to be used for this host name: 172.30.1.100 #指定當前主機的IP地址便可！ Enter an additional IP address, or press Enter to skip: Do you want to configure DNS forwarders? [yes]: #這裏默認便可，默認爲yes，我們直接回車，下面不少選項都都可用默認回車，若是有須要修改的我會提示你們的！ Following DNS servers are configured in /etc/resolv.conf: 172.30.1.1, 8.8.8.8 Do you want to configure these servers as DNS forwarders? [yes]: All DNS servers from /etc/resolv.conf were added. You can enter additional addresses now: Enter an IP address for a DNS forwarder, or press Enter to skip: Checking DNS forwarders, please wait ... DNS server 172.30.1.1: answer to query '. SOA' is missing DNSSEC signatures (no RRSIG data) Please fix forwarder configuration to enable DNSSEC support. (For BIND 9 add directive "dnssec-enable yes;" to "options {}") WARNING: DNSSEC validation will be disabled Do you want to search for missing reverse zones? [yes]: Do you want to create reverse zone for IP 172.30.1.100 [yes]: Please specify the reverse zone name [1.30.172.in-addr.arpa.]: Using reverse zone(s) 1.30.172.in-addr.arpa. The IPA Master Server will be configured with: Hostname: node100.yinzhengjie.com IP address(es): 172.30.1.100 Domain name: yinzhengjie.com Realm name: YINZHENGJIE.COM BIND DNS server will be configured to serve IPA domain with: Forwarders: 172.30.1.1, 8.8.8.8 Forward policy: only Reverse zone(s): 1.30.172.in-addr.arpa. Continue to configure the system with these values? [no]: yes #輸入「yes」繼續配置系統 The following operations may take some minutes to complete. Please wait until the prompt is returned. Adding [172.30.1.100 node100.yinzhengjie.com] to your /etc/hosts file Configuring NTP daemon (ntpd) [1/4]: stopping ntpd [2/4]: writing configuration [3/4]: configuring ntpd to start on boot [4/4]: starting ntpd Done configuring NTP daemon (ntpd). Configuring directory server (dirsrv). Estimated time: 30 seconds [1/44]: creating directory server instance [2/44]: enabling ldapi [3/44]: configure autobind for root [4/44]: stopping directory server [5/44]: updating configuration in dse.ldif [6/44]: starting directory server [7/44]: adding default schema [8/44]: enabling memberof plugin [9/44]: enabling winsync plugin [10/44]: configuring replication version plugin [11/44]: enabling IPA enrollment plugin [12/44]: configuring uniqueness plugin [13/44]: configuring uuid plugin [14/44]: configuring modrdn plugin [15/44]: configuring DNS plugin [16/44]: enabling entryUSN plugin [17/44]: configuring lockout plugin [18/44]: configuring topology plugin [19/44]: creating indices [20/44]: enabling referential integrity plugin [21/44]: configuring certmap.conf [22/44]: configure new location for managed entries [23/44]: configure dirsrv ccache [24/44]: enabling SASL mapping fallback [25/44]: restarting directory server [26/44]: adding sasl mappings to the directory [27/44]: adding default layout [28/44]: adding delegation layout [29/44]: creating container for managed entries [30/44]: configuring user private groups [31/44]: configuring netgroups from hostgroups [32/44]: creating default Sudo bind user [33/44]: creating default Auto Member layout [34/44]: adding range check plugin [35/44]: creating default HBAC rule allow_all [36/44]: adding entries for topology management [37/44]: initializing group membership [38/44]: adding master entry [39/44]: initializing domain level [40/44]: configuring Posix uid/gid generation [41/44]: adding replication acis [42/44]: activating sidgen plugin [43/44]: activating extdom plugin [44/44]: configuring directory to start on boot Done configuring directory server (dirsrv). Configuring Kerberos KDC (krb5kdc) [1/10]: adding kerberos container to the directory [2/10]: configuring KDC [3/10]: initialize kerberos container WARNING: Your system is running out of entropy, you may experience long delays [4/10]: adding default ACIs [5/10]: creating a keytab for the directory [6/10]: creating a keytab for the machine [7/10]: adding the password extension to the directory [8/10]: creating anonymous principal [9/10]: starting the KDC [10/10]: configuring KDC to start on boot Done configuring Kerberos KDC (krb5kdc). Configuring kadmin [1/2]: starting kadmin [2/2]: configuring kadmin to start on boot Done configuring kadmin. Configuring ipa-custodia [1/5]: Making sure custodia container exists [2/5]: Generating ipa-custodia config file [3/5]: Generating ipa-custodia keys [4/5]: starting ipa-custodia [5/5]: configuring ipa-custodia to start on boot Done configuring ipa-custodia. Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes [1/28]: configuring certificate server instance [2/28]: exporting Dogtag certificate store pin [3/28]: stopping certificate server instance to update CS.cfg [4/28]: backing up CS.cfg [5/28]: disabling nonces [6/28]: set up CRL publishing [7/28]: enable PKIX certificate path discovery and validation [8/28]: starting certificate server instance [9/28]: configure certmonger for renewals [10/28]: requesting RA certificate from CA [11/28]: setting audit signing renewal to 2 years [12/28]: restarting certificate server [13/28]: publishing the CA certificate [14/28]: adding RA agent as a trusted user [15/28]: authorizing RA to modify profiles [16/28]: authorizing RA to manage lightweight CAs [17/28]: Ensure lightweight CAs container exists [18/28]: configure certificate renewals [19/28]: configure Server-Cert certificate renewal [20/28]: Configure HTTP to proxy connections [21/28]: restarting certificate server [22/28]: updating IPA configuration [23/28]: enabling CA instance [24/28]: migrating certificate profiles to LDAP [25/28]: importing IPA certificate profiles [26/28]: adding default CA ACL [27/28]: adding 'ipa' CA entry [28/28]: configuring certmonger renewal for lightweight CAs Done configuring certificate server (pki-tomcatd). Configuring directory server (dirsrv) [1/3]: configuring TLS for DS instance [2/3]: adding CA certificate entry [3/3]: restarting directory server Done configuring directory server (dirsrv). Configuring ipa-otpd [1/2]: starting ipa-otpd [2/2]: configuring ipa-otpd to start on boot Done configuring ipa-otpd. Configuring the web interface (httpd) [1/22]: stopping httpd [2/22]: setting mod_nss port to 443 [3/22]: setting mod_nss cipher suite [4/22]: setting mod_nss protocol list to TLSv1.0 - TLSv1.2 [5/22]: setting mod_nss password file [6/22]: enabling mod_nss renegotiate [7/22]: disabling mod_nss OCSP [8/22]: adding URL rewriting rules [9/22]: configuring httpd [10/22]: setting up httpd keytab [11/22]: configuring Gssproxy [12/22]: setting up ssl [13/22]: configure certmonger for renewals [14/22]: importing CA certificates from LDAP [15/22]: publish CA cert [16/22]: clean up any existing httpd ccaches [17/22]: configuring SELinux for httpd [18/22]: create KDC proxy config [19/22]: enable KDC proxy [20/22]: starting httpd [21/22]: configuring httpd to start on boot [22/22]: enabling oddjobd Done configuring the web interface (httpd). Configuring Kerberos KDC (krb5kdc) [1/1]: installing X509 Certificate for PKINIT Done configuring Kerberos KDC (krb5kdc). Applying LDAP updates Upgrading IPA:. Estimated time: 1 minute 30 seconds [1/10]: stopping directory server [2/10]: saving configuration [3/10]: disabling listeners [4/10]: enabling DS global lock [5/10]: disabling Schema Compat [6/10]: starting directory server [7/10]: upgrading server [8/10]: stopping directory server [9/10]: restoring configuration [10/10]: starting directory server Done. Restarting the KDC Configuring DNS (named) [1/12]: generating rndc key file WARNING: Your system is running out of entropy, you may experience long delays [2/12]: adding DNS container [3/12]: setting up our zone [4/12]: setting up reverse zone [5/12]: setting up our own record [6/12]: setting up records for other masters [7/12]: adding NS record to the zones [8/12]: setting up kerberos principal [9/12]: setting up named.conf [10/12]: setting up server configuration [11/12]: configuring named to start on boot [12/12]: changing resolv.conf to point to ourselves Done configuring DNS (named). Restarting the web server to pick up resolv.conf changes Configuring DNS key synchronization service (ipa-dnskeysyncd) [1/7]: checking status [2/7]: setting up bind-dyndb-ldap working directory [3/7]: setting up kerberos principal [4/7]: setting up SoftHSM [5/7]: adding DNSSEC containers [6/7]: creating replica keys [7/7]: configuring ipa-dnskeysyncd to start on boot Done configuring DNS key synchronization service (ipa-dnskeysyncd). Restarting ipa-dnskeysyncd Restarting named Updating DNS system records Configuring client side components Using existing certificate '/etc/ipa/ca.crt'. Client hostname: node100.yinzhengjie.com Realm: YINZHENGJIE.COM DNS Domain: yinzhengjie.com IPA Server: node100.yinzhengjie.com BaseDN: dc=yinzhengjie,dc=com Skipping synchronizing time with NTP server. New SSSD config will be created Configured sudoers in /etc/nsswitch.conf Configured /etc/sssd/sssd.conf trying https://node100.yinzhengjie.com/ipa/json [try 1]: Forwarding 'schema' to json server 'https://node100.yinzhengjie.com/ipa/json' trying https://node100.yinzhengjie.com/ipa/session/json [try 1]: Forwarding 'ping' to json server 'https://node100.yinzhengjie.com/ipa/session/json' [try 1]: Forwarding 'ca_is_enabled' to json server 'https://node100.yinzhengjie.com/ipa/session/json' Systemwide CA database updated. Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub [try 1]: Forwarding 'host_mod' to json server 'https://node100.yinzhengjie.com/ipa/session/json' SSSD enabled Configured /etc/openldap/ldap.conf Configured /etc/ssh/ssh_config Configured /etc/ssh/sshd_config Configuring yinzhengjie.com as NIS domain. Client configuration complete. The ipa-client-install command was successful ============================================================================== Setup complete Next steps: 1. You must make sure these network ports are open: TCP Ports: * 80, 443: HTTP/HTTPS * 389, 636: LDAP/LDAPS * 88, 464: kerberos * 53: bind UDP Ports: * 88, 464: kerberos * 53: bind * 123: ntp 2. You can now obtain a kerberos ticket using the command: 'kinit admin' This ticket will allow you to use the IPA tools (e.g., ipa user-add) and the web user interface. Be sure to back up the CA certificates stored in /root/cacert.p12 These files are required to create replicas. The password for these files is the Directory Manager password [root@node100 ~]#
安裝過程當中，我踩過一些坑，我就不在這裏一一舉例了，若是你沒有遇到錯誤，跟我上面的輸出一致的話，那再好不過了。若是你也遇到了一些列問題的話，能夠參考我踩過的坑，但願對你有幫助吧。參考連接：「http://www.javashuo.com/article/p-pjitfija-du.html」。
4>.測試安裝程序
通過一系列的安裝於設置以後，IPA-Server就安裝好了。如今能夠進入IPA-Server附帶的Web UI管理界面控制檯一探究竟。打開瀏覽器，輸入：「https://node100.yinzhengjie.com/ipa/ui/」，輸入你自定義的freeIPA的管理員密碼。
登陸成功後，你可能會看到以下圖所示的界面：
三.IPA-Server 管理控制檯功能介紹
FreeIPA在整合了LDAP和Kerberos等衆多核心軟件包等同時，也提供了Web UI管理控制檯，接下來咱們會介紹它都提供了那些功能。
1>.用戶管理
登入系統以後經過「身份」分類下都「用戶」菜單可以進入到用戶管理頁面，經過用戶列表能查看到系統內的全部Kerberos用戶，能夠發現通過剛纔安裝的過程當中，系統已經建立了一個admin管理員用戶，以下圖所示。除此以外，這裏還提供用戶的建立，修改和刪除功能。單擊Add按鈕打開建立用戶的窗口，只須要填寫必填項以後就能新建一個Kerberos用戶。注意，在建立Kerberos用戶的過程當中FreeIPA還會幫咱們同時建立一個徹底一致（包括用戶名和密碼）的LDAP用戶和Linux用戶（全部的註冊服務器都會建立），並能保證用戶數據事物一致性。
2>.主機管理
在「身份」分類下單擊「主機」菜單可以進入到主機管理頁面，經過主機列表能夠查看到全部向IPA-Server註冊過的服務器。除此以外，這裏也提供主機的註冊和刪除功能。單擊Add 按鈕打開註冊主機的窗口，只需填寫必填項以後就能註冊一個新的主機，以下圖所示。注意，在建立主機的過程當中FreeIPA同時也會將這臺主機的信息註冊到他的DNS服務之中。
3>.服務管理
經過「身份」分類下的「服務」菜單可以進入到服務管理頁面，這裏可以維護全部經過IPA-Server建立的服務。能夠看到通過剛纔安裝IPA-Server的過程後，FreeIPA已經建立了DNS，HTTP和LDAP等多個服務，以下圖所示：
4>.密碼策略
經過「策略」分類下的「密碼策略」菜單可以進入到密碼策略設置頁面，這裏可以維護全局的密碼策略配置，例如密碼的最小長度，失效時間和容許的錯誤密碼登錄次數等等，以下圖所示：
四.IPA CLI 功能介紹
FreeIPA除了Web UI控制檯以外，FreeIPA還提供了另一種利器，那就是它的CLI接口。經過CLI接口咱們便可完成對IPA對管理工做。IPA的CLI登陸分爲遠程和本地兩種模式，
遠程登陸經過ipa命令進行，執行此命令須要服務器安裝ipa-admintools工具，遠程登陸的方式適用於擁有IPA管理權限但沒有IPA-Server服務器登錄權限的使用場景；
而本地登陸則經過「kadmin.local」命令進行，此命令只能在IPA-Server所在的服務器上執行，本地登陸的方式適用於直接擁有IPA-Server登陸權限的使用場景。接下來咱們會分別介紹這兩種登陸方式以及如何經過CLI建立用戶。
1>.使用遠程登陸（操做節點：node101.yinzhengjie.org.cn）
若要使用遠程登陸管理IPA-Server的話，那得安裝IPA-Admin管理工具
[root@node101 ~]# hostname node101.yinzhengjie.org.cn [root@node101 ~]# [root@node101 ~]# hostname -i 172.30.1.101 [root@node101 ~]# [root@node101 ~]# yum -y install ipa-admintools #安裝ipa-admintools管理工具。
[root@node100 ~]# hostname node100.yinzhengjie.com [root@node100 ~]# [root@node100 ~]# hostname -i 172.30.1.100 [root@node100 ~]# [root@node100 ~]# cat /etc/hosts | grep yinzhengjie 172.30.1.100 node100.yinzhengjie.com node100 172.30.1.101 node101.yinzhengjie.org.cn 172.30.1.102 node102.yinzhengjie.org.cn 172.30.1.103 node103.yinzhengjie.org.cn [root@node100 ~]# [root@node100 ~]# scp /etc/krb5.conf node101.yinzhengjie.org.cn:/etc/ The authenticity of host 'node101.yinzhengjie.org.cn (<no hostip for proxy command>)' can't be established. ECDSA key fingerprint is SHA256:SDslkKHyBt925hWfb2K7C+lKWcQ6PTSN3B+G5fetFQ0. ECDSA key fingerprint is MD5:e5:24:dc:52:ee:e6:ed:83:de:45:39:a8:c4:14:27:e7. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'node101.yinzhengjie.org.cn' (ECDSA) to the list of known hosts. root@node101.yinzhengjie.org.cn's password: krb5.conf 100% 1022 1.6MB/s 00:00 [root@node100 ~]#
[root@node101 ~]# cat /etc/krb5.conf # Configuration snippets may be placed in this directory as well includedir /etc/krb5.conf.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] dns_lookup_realm = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true rdns = false default_realm = YINZHENGJIE.COM #default_ccache_name = KEYRING:persistent:%{uid} [realms] YINZHENGJIE.COM = { kdc = node100.yinzhengjie.com:88 admin_server = node100.yinzhengjie.com:749 } [domain_realm] .yinzhengjie.com = YINZHENGJIE.COM yinzhengjie.com = YINZHENGJIE.COM [root@node101 ~]#
[root@node101 ~]# ipa-client-install --domain=YINZHENGJIE.COM --server=node100.yinzhengjie.com --realm=YINZHENGJIE.COM --principal=admin@YINZHENGJIE.COM --enable-dns-updates WARNING: ntpd time&date synchronization service will not be configured as conflicting service (chronyd) is enabled Use --force-ntpd option to disable it and force configuration of ntpd Autodiscovery of servers for failover cannot work with this configuration. If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure. Proceed with fixed values and no DNS discovery? [no]: yes Client hostname: node101.yinzhengjie.org.cn Realm: YINZHENGJIE.COM DNS Domain: yinzhengjie.com IPA Server: node100.yinzhengjie.com BaseDN: dc=yinzhengjie,dc=com Continue to configure the system with these values? [no]: yes Skipping synchronizing time with NTP server. Password for admin@YINZHENGJIE.COM: Successfully retrieved CA cert Subject: CN=Certificate Authority,O=YINZHENGJIE.COM Issuer: CN=Certificate Authority,O=YINZHENGJIE.COM Valid From: 2018-12-12 11:15:53 Valid Until: 2038-12-12 11:15:53 Enrolled in IPA realm YINZHENGJIE.COM Created /etc/ipa/default.conf New SSSD config will be created Configured sudoers in /etc/nsswitch.conf Configured /etc/sssd/sssd.conf Configured /etc/krb5.conf for IPA realm YINZHENGJIE.COM trying https://node100.yinzhengjie.com/ipa/json [try 1]: Forwarding 'schema' to json server 'https://node100.yinzhengjie.com/ipa/json' trying https://node100.yinzhengjie.com/ipa/session/json [try 1]: Forwarding 'ping' to json server 'https://node100.yinzhengjie.com/ipa/session/json' [try 1]: Forwarding 'ca_is_enabled' to json server 'https://node100.yinzhengjie.com/ipa/session/json' Systemwide CA database updated. Hostname (node101.yinzhengjie.org.cn) does not have A/AAAA record. Failed to update DNS records. Missing A/AAAA record(s) for host node101.yinzhengjie.org.cn: 172.30.1.101. Missing reverse record(s) for address(es): 172.30.1.101. Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub [try 1]: Forwarding 'host_mod' to json server 'https://node100.yinzhengjie.com/ipa/session/json' Could not update DNS SSHFP records. SSSD enabled Configured /etc/openldap/ldap.conf Configured /etc/ssh/ssh_config Configured /etc/ssh/sshd_config Configuring yinzhengjie.com as NIS domain. Client configuration complete. The ipa-client-install command was successful [root@node101 ~]#
經過SSH登入安裝了ipa-admintools工具的服務器，使用kinit命令登入Kerberos管理員用戶（安裝IPA-Server時設置的管理員密碼）。
[root@node101 ~]# kinit admin Password for admin@YINZHENGJIE.COM: [root@node101 ~]# [root@node101 ~]# klist Ticket cache: KEYRING:persistent:0:0 Default principal: admin@YINZHENGJIE.COM Valid starting Expires Service principal 12/13/2018 16:51:08 12/14/2018 16:51:06 krbtgt/YINZHENGJIE.COM@YINZHENGJIE.COM [root@node101 ~]#
[root@node101 ~]# ipa -h Usage: ipa [global-options] COMMAND [command-options] Manage an IPA domain Options: --version show program's version number and exit -h, --help Show this help message and exit -e KEY=VAL Set environment variable KEY to VAL -c FILE Load configuration from FILE. -d, --debug Produce full debuging output --delegate Delegate the TGT to the IPA server -v, --verbose Produce more verbose output. A second -v displays the XML-RPC request -a, --prompt-all Prompt for ALL values (even if optional) -n, --no-prompt Prompt for NO values (even if required) -f, --no-fallback Only use the server configured in /etc/ipa/default.conf See "ipa help topics" for available help topics. See "ipa help <TOPIC>" for more information on a specific topic. See "ipa help commands" for the full list of commands. See "ipa <COMMAND> --help" for more information on a specific command. [root@node101 ~]#
Kerberos認證成功以後，如今使用ipa user-add建立一個「yinzhengjie-Kerberos」的用戶，與命令一塊兒順帶傳入用戶的first和last名稱，以下所示：
[root@node101 ~]# ipa user-add yinzhengjie-kerberos --first=yinzhengjie-kerberos --last=yinzhengjie-kerberos --password #咱們這裏添加一個yinzhengjie-Kerberos的用戶。 Password: #這裏須要爲「yinzhengjie-Kerberos」用戶輸入其密碼 Enter Password again to verify: --------------------------------- Added user "yinzhengjie-kerberos" --------------------------------- User login: yinzhengjie-kerberos First name: yinzhengjie-kerberos Last name: yinzhengjie-kerberos Full name: yinzhengjie-kerberos yinzhengjie-kerberos Display name: yinzhengjie-kerberos yinzhengjie-kerberos Initials: yy Home directory: /home/yinzhengjie-kerberos GECOS: yinzhengjie-kerberos yinzhengjie-kerberos Login shell: /bin/sh Principal name: yinzhengjie-kerberos@YINZHENGJIE.COM Principal alias: yinzhengjie-kerberos@YINZHENGJIE.COM User password expiration: 20181213102930Z Email address: yinzhengjie-kerberos@yinzhengjie.com UID: 238000001 GID: 238000001 Password: True Member of groups: ipausers Kerberos keys available: True [root@node101 ~]#
用戶建立好了以後，再次使用kinit命令登陸剛剛建好的用戶。能夠發現系統會提示密碼過時，須要修改密碼。這是由於默認的密碼策略會要求新建的用戶在第一次登陸的時候進行修改密碼操做，修改密碼成功後就完成了登陸，經過klist命令能夠看到用戶以及登陸成功啦！具體操做步驟以下：
[root@node101 ~]# klist Ticket cache: KEYRING:persistent:0:0 Default principal: admin@YINZHENGJIE.COM Valid starting Expires Service principal 12/13/2018 18:29:22 12/14/2018 16:51:06 HTTP/node100.yinzhengjie.com@YINZHENGJIE.COM 12/13/2018 18:27:07 12/14/2018 16:51:06 host/node101.yinzhengjie.org.cn@YINZHENGJIE.COM 12/13/2018 16:51:08 12/14/2018 16:51:06 krbtgt/YINZHENGJIE.COM@YINZHENGJIE.COM [root@node101 ~]# [root@node101 ~]# [root@node101 ~]# kinit yinzhengjie-kerberos Password for yinzhengjie-kerberos@YINZHENGJIE.COM: Password expired. You must change it now. Enter new password: Enter it again: [root@node101 ~]# [root@node101 ~]# [root@node101 ~]# klist Ticket cache: KEYRING:persistent:0:krb_ccache_pKnvRro Default principal: yinzhengjie-kerberos@YINZHENGJIE.COM Valid starting Expires Service principal 12/13/2018 18:37:35 12/14/2018 18:37:35 krbtgt/YINZHENGJIE.COM@YINZHENGJIE.COM [root@node101 ~]#
爲了驗證用戶，還能夠進入IPA的Web UI控制檯，能夠發現用戶管理頁面也能查詢到剛剛新建的「yinzhnegjie-kerberos」用戶了，以下圖所示：
2>.使用本地登陸方式（操做節點：node100.yinzhengjie.com。）
使用SSH登陸IPA-Server所在的服務器，使用kinit命令登入Kerberos管理員用戶。
[root@node100 ~]# hostname #這臺機器是用來部署IPA-Server的服務器。 node100.yinzhengjie.com [root@node100 ~]# [root@node100 ~]# hostname -i #IPA-Server對應的IP地址。 172.30.1.100 [root@node100 ~]# [root@node100 ~]# kinit admin #使用Kerberos的管理員admin用戶進行登陸，須要輸入登陸密碼，這個密碼是你在部署IPA-Server時指定的！輸入密碼成功後，若沒有任何輸說明你登陸成功了，沒有輸出就是最好的結果。如有輸出多是你登陸失敗啦！ Password for admin@YINZHENGJIE.COM: [root@node100 ~]# [root@node100 ~]# klist #登陸成功以後，可使用klist命令查看當前登陸會話信息，信息顯示當前登陸的admin用戶。 Ticket cache: KEYRING:persistent:0:0 Default principal: admin@YINZHENGJIE.COM #注意，這個admin是當前登陸的用戶，那個「@」是分隔符，而「YINZHENGJIE.COM」是我們配置IPA-Server時指定的域名 Valid starting Expires Service principal 12/13/2018 01:29:53 12/14/2018 01:29:50 krbtgt/YINZHENGJIE.COM@YINZHENGJIE.COM [root@node100 ~]#
登陸成功以後，接着使用kadmin.local命令進入本地管理員模式：
[root@node100 ~]# kadmin.local #進入本地管理員模式 Authenticating as principal admin/admin@YINZHENGJIE.COM with password. kadmin.local: kadmin.local: ? #輸入「？」能夠查看命令列表。 Available kadmin.local requests: add_principal, addprinc, ank Add principal delete_principal, delprinc Delete principal modify_principal, modprinc Modify principal rename_principal, renprinc Rename principal change_password, cpw Change password get_principal, getprinc Get principal list_principals, listprincs, get_principals, getprincs List principals add_policy, addpol Add policy modify_policy, modpol Modify policy delete_policy, delpol Delete policy get_policy, getpol Get policy list_policies, listpols, get_policies, getpols List policies get_privs, getprivs Get privileges ktadd, xst Add entry(s) to a keytab ktremove, ktrem Remove entry(s) from a keytab lock Lock database exclusively (use with extreme caution!) unlock Release exclusive database lock purgekeys Purge previously retained old keys from a principal get_strings, getstrs Show string attributes on a principal set_string, setstr Set a string attribute on a principal del_string, delstr Delete a string attribute on a principal list_requests, lr, ? List available requests. quit, exit, q Exit program. kadmin.local:
除了使用密碼登陸以外，Kerberos還容許用keytab密碼文件登陸。接下來這個案例爲我們以前使用遠程登陸IPA-Server服務器建立的「yinzhengjie-Kerberos」用戶建立它的keytab文件，並使用建立出來的keytab文件進行無密碼登陸。
kadmin.local: listprincs admin@YINZHENGJIE.COM K/M@YINZHENGJIE.COM krbtgt/YINZHENGJIE.COM@YINZHENGJIE.COM kadmin/node100.yinzhengjie.com@YINZHENGJIE.COM kadmin/admin@YINZHENGJIE.COM kadmin/changepw@YINZHENGJIE.COM kiprop/node100.yinzhengjie.com@YINZHENGJIE.COM ldap/node100.yinzhengjie.com@YINZHENGJIE.COM host/node100.yinzhengjie.com@YINZHENGJIE.COM WELLKNOWN/ANONYMOUS@YINZHENGJIE.COM dogtag/node100.yinzhengjie.com@YINZHENGJIE.COM HTTP/node100.yinzhengjie.com@YINZHENGJIE.COM DNS/node100.yinzhengjie.com@YINZHENGJIE.COM ipa-dnskeysyncd/node100.yinzhengjie.com@YINZHENGJIE.COM host/node101.yinzhengjie.org.cn@YINZHENGJIE.COM yinzhengjie-kerberos@YINZHENGJIE.COM kadmin.local:
[root@node100 ~]# kadmin.local Authenticating as principal admin/admin@YINZHENGJIE.COM with password. kadmin.local: listprincs admin@YINZHENGJIE.COM K/M@YINZHENGJIE.COM krbtgt/YINZHENGJIE.COM@YINZHENGJIE.COM kadmin/node100.yinzhengjie.com@YINZHENGJIE.COM kadmin/admin@YINZHENGJIE.COM kadmin/changepw@YINZHENGJIE.COM kiprop/node100.yinzhengjie.com@YINZHENGJIE.COM ldap/node100.yinzhengjie.com@YINZHENGJIE.COM host/node100.yinzhengjie.com@YINZHENGJIE.COM WELLKNOWN/ANONYMOUS@YINZHENGJIE.COM dogtag/node100.yinzhengjie.com@YINZHENGJIE.COM HTTP/node100.yinzhengjie.com@YINZHENGJIE.COM DNS/node100.yinzhengjie.com@YINZHENGJIE.COM ipa-dnskeysyncd/node100.yinzhengjie.com@YINZHENGJIE.COM host/node101.yinzhengjie.org.cn@YINZHENGJIE.COM yinzhengjie-kerberos@YINZHENGJIE.COM kadmin.local: kadmin.local: xst -k /home/yinzhengjie/yinzhengjie.keytab yinzhengjie-kerberos@YINZHENGJIE.COM Entry for principal yinzhengjie-kerberos@YINZHENGJIE.COM with kvno 5, encryption type aes256-cts-hmac-sha1-96 added to keytab WRFILE:/home/yinzhengjie/yinzhengjie.keytab. Entry for principal yinzhengjie-kerberos@YINZHENGJIE.COM with kvno 5, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:/home/yinzhengjie/yinzhengjie.keytab. Entry for principal yinzhengjie-kerberos@YINZHENGJIE.COM with kvno 5, encryption type des3-cbc-sha1 added to keytab WRFILE:/home/yinzhengjie/yinzhengjie.keytab. Entry for principal yinzhengjie-kerberos@YINZHENGJIE.COM with kvno 5, encryption type arcfour-hmac added to keytab WRFILE:/home/yinzhengjie/yinzhengjie.keytab. Entry for principal yinzhengjie-kerberos@YINZHENGJIE.COM with kvno 5, encryption type camellia128-cts-cmac added to keytab WRFILE:/home/yinzhengjie/yinzhengjie.keytab. Entry for principal yinzhengjie-kerberos@YINZHENGJIE.COM with kvno 5, encryption type camellia256-cts-cmac added to keytab WRFILE:/home/yinzhengjie/yinzhengjie.keytab. kadmin.local: kadmin.local: quit [root@node100 ~]#
[root@node100 ~]# klist Ticket cache: KEYRING:persistent:0:0 Default principal: admin@YINZHENGJIE.COM Valid starting Expires Service principal 12/13/2018 05:50:44 12/14/2018 05:50:43 krbtgt/YINZHENGJIE.COM@YINZHENGJIE.COM [root@node100 ~]# [root@node100 ~]# ll /home/yinzhengjie/yinzhengjie.keytab -rw------- 1 root root 510 Dec 13 05:51 /home/yinzhengjie/yinzhengjie.keytab [root@node100 ~]# [root@node100 ~]# kinit -kt /home/yinzhengjie/yinzhengjie.keytab yinzhengjie-kerberos [root@node100 ~]# [root@node100 ~]# klist Ticket cache: KEYRING:persistent:0:krb_ccache_VY3GwmU Default principal: yinzhengjie-kerberos@YINZHENGJIE.COM Valid starting Expires Service principal 12/13/2018 05:53:33 12/14/2018 05:53:33 krbtgt/YINZHENGJIE.COM@YINZHENGJIE.COM [root@node100 ~]#
怎麼樣？是否是很神奇？和使用密碼同樣，使用keytab密碼文件也能完成登陸動做，而且使用這種方式更加安全。接下來咱們介紹一些蟾宮的kadmin.local命令，若是你是作大數據相關運維的工做人員，你應該很熟悉使用這些命令，我這裏只是走馬觀花式的提一下知識點：
addprinc： 新增一個用戶。
modprinc： 修改用戶信息。
listprincs： 查詢全部的用戶。
xst： 生成用戶的keytab文件。
cpw： 重置用戶密碼。
相關文章
- 1. Hadoop生態圈
- 2. hadoop生態圈
- 3. hadoop 生態圈
- 4. HADOOP生態圈
- 5. Hadoop配置LDAP集成Kerberos
- 6. Hadoop生態圈hive應用
- 7. Hadoop ecosystem 生態圈
- 8. Hadoop與Hadoop生態圈
- 9. Zeppelin集成Ldap(FreeIPA)
- 10. Spark SQL 筆記(2)——Spark 生態圈和 Hadoop 生態圈對比
- 更多相關文章...
- • Redis基本安裝和使用 - Redis教程
- • Wireshark下載安裝和使用教程 - TCP/IP教程
- • Composer 安裝與使用
- • 使用阿里雲OSS+CDN部署前端頁面與加速靜態資源
相關標籤/搜索
每日一句
-
每一个你不满意的现在，都有一个你没有努力的曾经。
最新文章
歡迎關注本站公眾號,獲取更多信息
相關文章