ECS 3.6.2 Data Access Guide

Set up the Kerberos KDC

Set up the Kerberos KDC by following these steps.

1. Install krb5-workstation.
   Use the command:

   yum install -y krb5-libs krb5-server krb5-workstation

2. Modify /etc/krb5.conf and change the realm name and extensions.
3. Modify /var/kerberos/krb5kdc/kdc.conf and change the realm name to match your own.
4. If your KDC is a VM, recreate /dev/random (otherwise your next step of creating the KDC database will take a very long time).
   1. Remove using:

      # rm -rf /dev/random

   2. Recreate using:

       # mknod /dev/random c 1 9

5. Create the KDC database.

    # kdb5_util create -s

   NOTE: If you made a mistake with the initial principals. For example, you ran "kdb5_util create -s" incorrectly, you might need to delete these principals explicitly in the /var/kerberos/krb5kdc/ directory.
6. Modify kadm5.acl to specify users that have admin permission.

   */admin@DET.EMC.COM *

7. Modify /var/kerberos/krb5kdc/kdc.conf and take out any encryption type except des-cbc-crc:normal. Also modify the realm name.
8. Ensure that iptables and selinux are off on all nodes (KDC server as well as Hadoop nodes).
9. Start KDC services and create a local admin principal.

   kadmin.local 
   
   # service krb5kdc start
   
   # service kadmin start
   
   # /usr/kerberos/sbin/kadmin.local-q "addprinc root/admin"
   
   # kinit root/admin

10. Copy the krb5.conf file to all Hadoop nodes.
    Any time you make a modification to any of the configuration files restart the below services and copy the krb5.conf file over to relevant Hadoop host and ECS nodes.
11. Restart the services.

    service krb5kdc restart
    
    service kadmin restart

12. Alternatively, use vendor documentation to set up a Kerberos KDC.