java - 发现 nn/hadoop-kerberos@HADOOP-KERBEROS 不支持的 key 类型 (8)

Question

我正在尝试在启用 Kerberos 身份验证的安全模式下设置单节点 Hadoop 集群，使用 hadoop-2.4.0和 jdk1.7.0_25 .

为此，我按照文档中的描述创建了 key 表文件。在调试具有属性 HADOOP_OPTS 的东西时设置为 -Dsun.security.krb5.debug=true我看到以下错误消息:

Found unsupported keytype (8) for nn/hadoop-kerberos@HADOOP-KERBEROS
Added key: 23version: 4
Added key: 16version: 4
Added key: 17version: 4
Added key: 18version: 4
Ordering keys wrt default_tkt_enctypes list
Using builtin default etypes for default_tkt_enctypes
default etypes for default_tkt_enctypes: 18 17 16 23 1 3.
Added key: 3version: 4
Found unsupported keytype (8) for nn/hadoop-kerberos@HADOOP-KERBEROS
Added key: 23version: 4
Added key: 16version: 4
Added key: 17version: 4
Added key: 18version: 4
Ordering keys wrt default_tkt_enctypes list
Using builtin default etypes for default_tkt_enctypes
default etypes for default_tkt_enctypes: 18 17 16 23 1 3.
Using builtin default etypes for default_tkt_enctypes
default etypes for default_tkt_enctypes: 18 17 16 23 1 3.
>>> KrbAsReq creating message
>>> KrbKdcReq send: kdc=localhost UDP:3738, timeout=30000, number of retries =3, #bytes=171</code></pre>

请注意我有../jre/lib/security/local_policy.jar和 .../jre/lib/security/US_export_policy.jar在我的 CLASSPATH变量。

我在 kdc.conf 中也有以下内容:

 [kdcdefaults]
 kdc_ports = 3738
 kdc_tcp_ports = 3738

[realms]
 HADOOP-KERBEROS = {
  kadmind_port = 3739
  #master_key_type = des3-hmac-sha1
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  #admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  admin_keytab = /etc/krb5.keytab
  supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal des-cbc-crc:v4 des-cbc-crc:afs3
 }
[logging]
   # By default, the KDC and kadmind will log output using
   # syslog.  You can instead send log output to files like this:
   kdc = FILE:/home/build/log/krb5kdc.log
   admin_server = FILE:/home/build/log/kadmin.log
   default = FILE:/home/build/log/krb5lib.log

klist -e显示用户 aleksg 的以下输出我用它来运行名称节点 hadoop namenode命令

Ticket cache: FILE:/tmp/krb5cc_501
Default principal: aleksg@HADOOP-KERBEROS

Valid starting     Expires            Service principal
07/12/15 09:16:39  07/13/15 09:16:39  krbtgt/HADOOP-KERBEROS@HADOOP-KERBEROS
        Etype (skey, tkt): Triple DES cbc mode with HMAC/sha1, Triple DES cbc mode with HMAC/sha1 


Kerberos 4 ticket cache: /tmp/tkt501
klist: You have no tickets cached

看来 DES cbc mode with HMAC/sha1正在用于 TGT。

请问我该如何解决这个问题？这是否与 keytab 文件的权限有某种关系，或者我应该重新生成启用了不同加密类型的 keytab 文件？

谢谢!

Answer 1

我已经通过生成安全 Hadoop 配置中使用的所有 key 表文件解决了这个问题，这些文件在 hdfs-site.xml、yarn-site.xml 中提到，等通过使用 des3-hmac-sha1:normal 加密类型。

kadmin.local -e "des3-hmac-sha1:normal"

我还更改了我的 krb5.conf 以将此加密类型用于 default_tkt_enctypes、default_tgs_enctypes 和 permitted_enctypes。

同时在 krb5kdc/kdc.conf 中将 master_key_type 更改为 des3-hmac-sha1。