Skip to content
This repository was archived by the owner on Jul 23, 2024. It is now read-only.

Commit 501b7d5

Browse files
Lisa Owendyozie
Lisa Owen
authored and
dyozie
committed
add support for active directory KDC server (closes #132)
1 parent bce28fa commit 501b7d5

File tree

5 files changed

+815
-659
lines changed

5 files changed

+815
-659
lines changed

‎book/master_middleman/source/subnavs/apache-hawq-nav.erb‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -158,8 +158,19 @@
158158
<li>
159159
<a href="/docs/userguide/2.2.0.0-incubating/clientaccess/ldap.html">Using LDAP Authentication with TLS/SSL</a>
160160
</li>
161-
<li>
161+
<li class="has_submenu">
162162
<a href="/docs/userguide/2.2.0.0-incubating/clientaccess/kerberos.html">Using Kerberos Authentication</a>
163+
<ul>
164+
<li>
165+
<a href="/docs/userguide/2.2.0.0-incubating/clientaccess/kerberos-securehdfs.html">Configuring HAWQ/PXF for Secure HDFS</a>
166+
</li>
167+
<li>
168+
<a href="/docs/userguide/2.2.0.0-incubating/clientaccess/kerberos-userauth.html">Configuring Kerberos User Authentication for HAWQ</a>
169+
</li>
170+
<li>
171+
<a href="/docs/userguide/2.2.0.0-incubating/clientaccess/kerberos-mitkdc.html">Example - Setting up an MIT KDC Server</a>
172+
</li>
173+
</ul>
163174
</li>
164175
<li>
165176
<a href="/docs/userguide/2.2.0.0-incubating/clientaccess/disable-kerberos.html">Disabling Kerberos Security</a>

‎markdown/clientaccess/kerberos-mitkdc.html.md.erb‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
---
2+
title: Example - Setting up an MIT KDC Server
3+
---
4+
5+
<!--
6+
Licensed to the Apache Software Foundation (ASF) under one
7+
or more contributor license agreements. See the NOTICE file
8+
distributed with this work for additional information
9+
regarding copyright ownership. The ASF licenses this file
10+
to you under the Apache License, Version 2.0 (the
11+
"License"); you may not use this file except in compliance
12+
with the License. You may obtain a copy of the License at
13+
14+
http://www.apache.org/licenses/LICENSE-2.0
15+
16+
Unless required by applicable law or agreed to in writing,
17+
software distributed under the License is distributed on an
18+
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
19+
KIND, either express or implied. See the License for the
20+
specific language governing permissions and limitations
21+
under the License.
22+
-->
23+
24+
Follow this procedure to install and configure a Kerberos KDC server on a Red Hat Enterprise Linux host. The KDC server resides on the host named \<kdc-server\>.
25+
26+
1. Log in to the Kerberos KDC Server system as a superuser:
27+
28+
``` shell
29+
$ ssh root@<kdc-server>
30+
root@kdc-server$
31+
```
32+
33+
2. Install the Kerberos server packages:
34+
35+
``` shell
36+
root@kdc-server$ yum install krb5-libs krb5-server krb5-workstation
37+
```
38+
39+
3. Define the Kerberos realm for your cluster by editting the `/etc/krb5.conf` configuration file. The following example configures a Kerberos server with a realm named `REALM.DOMAIN` residing on a host named `hawq-kdc`.
40+
41+
```
42+
[logging]
43+
 default = FILE:/var/log/krb5libs.log
44+
 kdc = FILE:/var/log/krb5kdc.log
45+
 admin_server = FILE:/var/log/kadmind.log
46+
47+
[libdefaults]
48+
 default_realm = REALM.DOMAIN
49+
 dns_lookup_realm = false
50+
 dns_lookup_kdc = false
51+
 ticket_lifetime = 24h
52+
 renew_lifetime = 7d
53+
 forwardable = true
54+
 default_tgs_enctypes = aes128-cts des3-hmac-sha1 des-cbc-crc des-cbc-md5
55+
 default_tkt_enctypes = aes128-cts des3-hmac-sha1 des-cbc-crc des-cbc-md5
56+
 permitted_enctypes = aes128-cts des3-hmac-sha1 des-cbc-crc des-cbc-md5
57+
58+
[realms]
59+
 REALM.DOMAIN = {
60+
  kdc = hawq-kdc:88
61+
  admin_server = hawq-kdc:749
62+
  default_domain = hawq-kdc
63+
}
64+
65+
[domain_realm]
66+
 .hawq-kdc = REALM.DOMAIN
67+
 hawq-kdc = REALM.DOMAIN
68+
69+
[appdefaults]
70+
 pam = {
71+
    debug = false
72+
    ticket_lifetime = 36000
73+
    renew_lifetime = 36000
74+
    forwardable = true
75+
    krb4_convert = false
76+
}
77+
```
78+
79+
The `kdc` and `admin_server` keys in the `[realms]` section specify the host \(`hawq-kdc`\) and port on which the Kerberos server is running. You can use an IP address in place of a host name.
80+
81+
If your Kerberos server manages authentication for other realms, you would instead add the `REALM.DOMAINM` realm in the `[realms]` and `[domain_realm]` sections of the `krb5.conf` file. See the [Kerberos documentation](http://web.mit.edu/kerberos/krb5-latest/doc/) for detailed information about the `krb5.conf` configuration file.
82+
83+
4. Note the Kerberos KDC server host name or IP address and the name of the realm in which your cluster resides. You will need this information in later procedures.
84+
5. Create a Kerberos KDC database by running the `kdb5_util` command:
85+
86+
```
87+
root@kdc-server$ kdb5_util create -s
88+
```
89+
90+
The `kdb5_util create` command creates the database in which the keys for the Kerberos realms managed by this KDC server are stored. The `-s` option instructs the command to create a stash file. Without the stash file, the KDC server will request a password every time it starts.
91+
92+
6. Add an administrative user to the Kerberos KDC database with the `kadmin.local` utility. Because it does not itself depend on Kerberos authentication, the `kadmin.local` utility allows you to add an initial administrative user to the local Kerberos server. To add the user `admin` as an administrative user to the KDC database, run the following command:
93+
94+
```
95+
root@kdc-server$ kadmin.local -q "addprinc admin/admin"
96+
```
97+
98+
Most users do not need administrative access to the Kerberos server. They can use `kadmin` to manage their own principals \(for example, to change their own password\). For information about `kadmin`, see the [Kerberos documentation](http://web.mit.edu/kerberos/krb5-latest/doc/).
99+
100+
7. If required, edit the `/var/kerberos/krb5kdc/kadm5.acl` file to grant the appropriate permissions to `admin`.
101+
8. Start the Kerberos daemons:
102+
103+
```
104+
root@kdc-server$ /sbin/service krb5kdc start
105+
root@kdc-server$ /sbin/service kadmin start
106+
```
107+
108+
9. To start Kerberos automatically upon system restart:
109+
110+
```
111+
root@kdc-server$ /sbin/chkconfig krb5kdc on
112+
root@kdc-server$ /sbin/chkconfig kadmin on
113+
```

‎markdown/clientaccess/kerberos-securehdfs.html.md.erb‎

Lines changed: 219 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,219 @@
1+
---
2+
title: Configuring HAWQ/PXF for Secure HDFS
3+
---
4+
5+
<!--
6+
Licensed to the Apache Software Foundation (ASF) under one
7+
or more contributor license agreements. See the NOTICE file
8+
distributed with this work for additional information
9+
regarding copyright ownership. The ASF licenses this file
10+
to you under the Apache License, Version 2.0 (the
11+
"License"); you may not use this file except in compliance
12+
with the License. You may obtain a copy of the License at
13+
14+
http://www.apache.org/licenses/LICENSE-2.0
15+
16+
Unless required by applicable law or agreed to in writing,
17+
software distributed under the License is distributed on an
18+
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
19+
KIND, either express or implied. See the License for the
20+
specific language governing permissions and limitations
21+
under the License.
22+
-->
23+
24+
When Kerberos is enabled for your HDFS filesystem, HAWQ, as an HDFS client, requires a principal and keytab file to authenticate access to HDFS (filesystem) and YARN (resource management). If you have enabled Kerberos at the HDFS filesystem level, you will create and deploy principals for your HDFS cluster, and ensure that Kerberos authentication is enabled and functioning for all HDFS client services, including HAWQ and PXF.
25+
26+
You will perform different procedures depending upon whether you use Ambari to manage your HAWQ cluster or you manage your cluster from the command line.
27+
28+
## <a id="task_kerbhdfs_ambarimgd"></a>Procedure for Ambari-Managed Clusters
29+
30+
If you manage your cluster with Ambari, you will enable Kerberos authentication for your cluster as described in the [Enabling Kerberos Authentication Using Ambari](https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.5.3/bk_security/content/configuring_amb_hdp_for_kerberos.html) Hortonworks documentation. The Ambari **Kerberos Security Wizard** guides you through the kerberization process, including installing Kerberos client packages on cluster nodes, syncing Kerberos configuration files, updating cluster configuration, and creating and distributing the Kerberos principals and keytab files for your Hadoop cluster services, including HAWQ and PXF.
31+
32+
## <a id="task_kerbhdfs_cmdlinemgd"></a>Procedure for Command-Line-Managed Clusters
33+
34+
**Note**: HAWQ does not support command-line-managed clusters employing an Active Directory KDC.
35+
36+
If you manage your cluster from the command line, before you configure HAWQ and PXF for access to a secure HDFS filesystem ensure that you have:
37+
38+
- Enabled Kerberos for your Hadoop cluster per the instructions for your specific distribution and verified the configuration.
39+
40+
- Verified that the HDFS configuration parameter `dfs.block.access.token.enable` is set to `true`. You can find this setting in the `hdfs-site.xml` configuration file.
41+
42+
- Noted the host name or IP address of your HAWQ \<master\> and Kerberos Key Distribution Center \(KDC\) \<kdc-server\> nodes.
43+
44+
- Noted the name of the Kerberos \<realm\> in which your cluster resides.
45+
46+
- Distributed the `/etc/krb5.conf` Kerberos configuration file on the KDC server node to **each** HAWQ and PXF cluster node if not already present. For example:
47+
48+
``` shell
49+
$ ssh root@<hawq-node>
50+
root@hawq-node$ cp /etc/krb5.conf /save/krb5.conf.save
51+
root@hawq-node$ scp <kdc-server>:/etc/krb5.conf /etc/krb5.conf
52+
```
53+
54+
- Verified that the Kerberos client packages are installed on **each** HAWQ and PXF node.
55+
56+
``` shell
57+
root@hawq-node$ rpm -qa | grep krb
58+
root@hawq-node$ yum install krb5-libs krb5-workstation
59+
```
60+
61+
#### <a id="task_kerbhdfs_cmdlinemgd_steps"></a>Procedure
62+
63+
Perform the following steps to configure HAWQ and PXF for a secure HDFS. You will perform operations on both the HAWQ \<master\> and the \<kdc-server\> nodes.
64+
65+
1. Log in to the Kerberos KDC server as the `root` user.
66+
67+
``` shell
68+
$ ssh root@<kdc-server>
69+
root@kdc-server$
70+
```
71+
72+
2. Use the `kadmin.local` command to create a Kerberos principal for the `postgres` user. Substitute your \<realm\>. For example:
73+
74+
``` shell
75+
root@kdc-server$ kadmin.local -q "addprinc -randkey [email protected]"
76+
```
77+
78+
3. Use `kadmin.local` to create a Kerberos service principal for **each** host on which a PXF agent is configured and running. The service principal should be of the form `pxf/<host>@<realm>` where \<host\> is the DNS resolvable, fully-qualified hostname of the PXF host system \(output of `hostname -f` command\).
79+
80+
For example, these commands add service principals for three PXF nodes on the hosts host1.example.com, host2.example.com, and host3.example.com:
81+
82+
``` shell
83+
root@kdc-server$ kadmin.local -q "addprinc -randkey pxf/[email protected]"
84+
root@kdc-server$ kadmin.local -q "addprinc -randkey pxf/[email protected]"
85+
root@kdc-server$ kadmin.local -q "addprinc -randkey pxf/[email protected]"
86+
```
87+
88+
**Note:** As an alternative, if you have a hosts file that lists the fully-qualified domain name of each PXF host \(one host per line\), then you can generate principals using the command:
89+
90+
``` shell
91+
root@kdc-server$ for HOST in $(cat hosts) ; do sudo kadmin.local -q "addprinc -randkey pxf/[email protected]" ; done
92+
```
93+
94+
4. Generate a keytab file for each principal that you created in the previous steps \(i.e. `postgres` and each `pxf/<host>`\). Save the keytab files in any convenient location \(this example uses the directory `/etc/security/keytabs`\). You will deploy the service principal keytab files to their respective HAWQ and PXF host machines in a later step. For example:
95+
96+
``` shell
97+
root@kdc-server$ kadmin.local -q "xst -k /etc/security/keytabs/hawq.service.keytab [email protected]"
98+
root@kdc-server$ kadmin.local -q "xst -k /etc/security/keytabs/pxf-host1.service.keytab pxf/[email protected]"
99+
root@kdc-server$ kadmin.local -q "xst -k /etc/security/keytabs/pxf-host2.service.keytab pxf/[email protected]"
100+
root@kdc-server$ kadmin.local -q "xst -k /etc/security/keytabs/pxf-host3.service.keytab pxf/[email protected]"
101+
root@kdc-server$ kadmin.local -q "listprincs"
102+
```
103+
104+
Repeat the `xst` command as necessary to generate a keytab for each HAWQ and PXF service principal that you created in the previous steps.
105+
106+
5. The HAWQ master server requires a `/etc/security/keytabs/hdfs.headless.keytab` keytab file for the HDFS principal. If this file does not already exist on the HAWQ master node, create the principal and generate the keytab. For example:
107+
108+
``` shell
109+
root@kdc-server$ kadmin.local -q "addprinc -randkey [email protected]"
110+
root@kdc-server$ kadmin.local -q "xst -k /etc/security/keytabs/hdfs.headless.keytab [email protected]"
111+
```
112+
113+
6. Copy the HAWQ service keytab file \(and the HDFS headless keytab file if you created one) to the HAWQ master segment host. For example:
114+
115+
``` shell
116+
root@kdc-server$ scp /etc/security/keytabs/hawq.service.keytab <master>:/etc/security/keytabs/hawq.service.keytab
117+
root@kdc-server$ scp /etc/security/keytabs/hdfs.headless.keytab <master>:/etc/security/keytabs/hdfs.headless.keytab
118+
```
119+
120+
7. Change the ownership and permissions on `hawq.service.keytab` (and `hdfs.headless.keytab`) as follows:
121+
122+
``` shell
123+
root@kdc-server$ ssh <master> chown gpadmin:gpadmin /etc/security/keytabs/hawq.service.keytab
124+
root@kdc-server$ ssh <master> chmod 400 /etc/security/keytabs/hawq.service.keytab
125+
root@kdc-server$ ssh <master> chown hdfs:hdfs /etc/security/keytabs/hdfs.headless.keytab
126+
root@kdc-server$ ssh <master> chmod 400 /etc/security/keytabs/hdfs.headless.keytab
127+
```
128+
129+
8. Copy the keytab file for each PXF service principal to its respective host. For example:
130+
131+
``` shell
132+
root@kdc-server$ scp /etc/security/keytabs/pxf-host1.service.keytab host1.example.com:/etc/security/keytabs/pxf.service.keytab
133+
root@kdc-server$ scp /etc/security/keytabs/pxf-host2.service.keytab host2.example.com:/etc/security/keytabs/pxf.service.keytab
134+
root@kdc-server$ scp /etc/security/keytabs/pxf-host3.service.keytab host3.example.com:/etc/security/keytabs/pxf.service.keytab
135+
```
136+
137+
Note the keytab file location on each PXF host; you will need this information for a later configuration step.
138+
139+
9. Change the ownership and permissions on the `pxf.service.keytab` files. For example:
140+
141+
``` shell
142+
root@kdc-server$ ssh host1.example.com chown pxf:pxf /etc/security/keytabs/pxf.service.keytab
143+
root@kdc-server$ ssh host1.example.com chmod 400 /etc/security/keytabs/pxf.service.keytab
144+
root@kdc-server$ ssh host2.example.com chown pxf:pxf /etc/security/keytabs/pxf.service.keytab
145+
root@kdc-server$ ssh host2.example.com chmod 400 /etc/security/keytabs/pxf.service.keytab
146+
root@kdc-server$ ssh host3.example.com chown pxf:pxf /etc/security/keytabs/pxf.service.keytab
147+
root@kdc-server$ ssh host3.example.com chmod 400 /etc/security/keytabs/pxf.service.keytab
148+
```
149+
150+
10. On **each** PXF node, edit the `/etc/pxf/conf/pxf-site.xml` configuration file to identify the local keytab file and security principal name. Add or uncomment the properties, substituting your \<realm\>. For example:
151+
152+
``` xml
153+
<property>
154+
<name>pxf.service.kerberos.keytab</name>
155+
<value>/etc/security/keytabs/pxf.service.keytab</value>
156+
<description>path to keytab file owned by pxf service
157+
with permissions 0400</description>
158+
</property>
159+
160+
<property>
161+
<name>pxf.service.kerberos.principal</name>
162+
<value>pxf/[email protected]</value>
163+
<description>Kerberos principal pxf service should use.
164+
_HOST is replaced automatically with hostnames
165+
FQDN</description>
166+
</property>
167+
```
168+
169+
11. Perform the remaining steps on the HAWQ master node as the `gpadmin` user:
170+
1. Log in to the HAWQ master node and set up the HAWQ runtime environment:
171+
172+
``` shell
173+
$ ssh gpadmin@<master>
174+
gpadmin@master$ . /usr/local/hawq/greenplum_path.sh
175+
```
176+
177+
2. Run the following commands to configure Kerberos HDFS security for HAWQ and identify the keytab file:
178+
179+
``` shell
180+
gpadmin@master$ hawq config -c enable_secure_filesystem -v ON
181+
gpadmin@master$ hawq config -c krb_server_keyfile -v /etc/security/keytabs/hawq.service.keytab
182+
```
183+
184+
3. Start the HAWQ service:
185+
186+
``` shell
187+
gpadmin@master$ hawq start cluster -a
188+
```
189+
190+
4. Obtain a HDFS Kerberos ticket and change the ownership and permissions of the HAWQ HDFS data directory, substituting the HDFS data directory path for your HAWQ cluster. For example:
191+
192+
``` shell
193+
gpadmin@master$ sudo -u hdfs kinit -kt /etc/security/keytabs/hdfs.headless.keytab hdfs
194+
gpadmin@master$ sudo -u hdfs hdfs dfs -chown -R postgres:gpadmin /<hawq_data_hdfs_path>
195+
```
196+
197+
5. On the **HAWQ master node and each segment node**, edit the `/usr/local/hawq/etc/hdfs-client.xml` file to enable kerberos security and assign the HDFS NameNode principal. Add or uncomment the following properties in each file:
198+
199+
``` xml
200+
<property>
201+
<name>hadoop.security.authentication</name>
202+
<value>kerberos</value>
203+
</property>
204+
```
205+
206+
6. If you are using YARN for resource management, edit the `yarn-client.xml` file to enable kerberos security. Add or uncomment the following property in the `yarn-client.xml` file on the **HAWQ master and each HAWQ segment node**:
207+
208+
``` xml
209+
<property>
210+
<name>hadoop.security.authentication</name>
211+
<value>kerberos</value>
212+
</property>
213+
```
214+
215+
7. Restart your HAWQ cluster:
216+
217+
``` shell
218+
gpadmin@master$ hawq restart cluster -a -M fast
219+
```

0 commit comments

Comments
 (0)