kafka开启kerberos

蘑菇丁2024-08-17 9:23

一、基本环境准备

  1. 创建票据创建Kerberos主体（Principal）：

使用kadmin.local或kadmin命令为Zookeeper和Kafka服务创建Kerberos主体。例如：

注意有几台机器创建几个

kadmin.local -q "addprinc -randkey zookeeper/dshieldcdh01@HADOOP139.COM"

kadmin.local -q "addprinc -randkey zookeeper/dshieldcdh02@HADOOP139.COM"

kadmin.local -q "addprinc -randkey zookeeper/dshieldcdh03@HADOOP139.COM"

kadmin.local -q "addprinc -randkey kafka/dshieldcdh01@HADOOP139.COM"

kadmin.local -q "addprinc -randkey kafka/dshieldcdh02@HADOOP139.COM"

kadmin.local -q "addprinc -randkey kafka/dshieldcdh03@HADOOP139.COM"

  1. 验证主体是否创建成功

kadmin.local -q "listprincs"

root@dshieldcdh02 \~# kadmin.local -q "listprincs"

Authenticating as principal root/admin@HADOOP139.COM with password.

K/M@HADOOP139.COM

host/dshieldcdh01@HADOOP139.COM

host/dshieldcdh02@HADOOP139.COM

kadmin/admin@HADOOP139.COM

kadmin/changepw@HADOOP139.COM

kadmin/dshieldcdh02@HADOOP139.COM

kafka/dshieldcdh01@HADOOP139.COM

kafka/dshieldcdh02@HADOOP139.COM

kafka/dshieldcdh03@HADOOP139.COM

kiprop/dshieldcdh02@HADOOP139.COM

krbtgt/HADOOP139.COM@HADOOP139.COM

root/admin@HADOOP139.COM

zookeeper/dshieldcdh01@HADOOP139.COM

zookeeper/dshieldcdh02@HADOOP139.COM

zookeeper/dshieldcdh03@HADOOP139.COM

  1. 创建keytab

mkdir /etc/security/keytabs/

kadmin.local -q "xst -k /etc/security/keytabs/kafka.keytab kafka/dshieldcdh01@HADOOP139.COM"

kadmin.local -q "xst -k /etc/security/keytabs/kafka.keytab kafka/dshieldcdh02@HADOOP139.COM"

kadmin.local -q "xst -k /etc/security/keytabs/kafka.keytab kafka/dshieldcdh03@HADOOP139.COM"

  1. 验证KeyTab文件内容：

klist -kt /etc/security/keytabs/zookeeper.keytab

klist -kt /etc/security/keytabs/kafka.keytab

kinit -kt /etc/security/keytabs/zookeeper.keytab zookeeper/dshieldcdh02@HADOOP139.COM

  1. 将keytab文件拷贝到其他两天zookeeper上,需要将keytab文件拷贝过去才可以使用

scp /etc/security/keytabs/*keytab root@dshieldcdh01:/etc/security/keytabs/

scp /etc/security/keytabs/*keytab root@dshieldcdh03:/etc/security/keytabs/

  1. 在其他机器上验证keytab文件可用

kinit -kt /etc/security/keytabs/zookeeper.keytab zookeeper/dshieldcdh01@HADOOP139.COM

二、Zookeeper配置Kerberos

  1. 配置Zookeeper的JAAS文件：

在Zookeeper的配置目录下创建JAAS配置文件（如zookeeper_jaas.conf），内容如下：

java
Server {

com.sun.security.auth.module.Krb5LoginModule required

useKeyTab=true

storeKey=true

keyTab="/etc/security/keytabs/zookeeper.keytab"

principal="zookeeper/dshieldcdh01@HADOOP139.COM"

useTicketCache=false;

};

Client {

com.sun.security.auth.module.Krb5LoginModule required

useKeyTab=true

storeKey=true

keyTab="/etc/security/keytabs/zookeeper.keytab"

principal="zookeeper/dshieldcdh01@HADOOP139.COM"

useTicketCache=false;

};

注意修改principal和keyTab路径以匹配实际环境。

在Zookeeper的启动脚本中添加JVM参数，指定JAAS配置文件的路径。

配置zookeeper的kerberos验证，切换到配置文件目录下cd conf，添加zoo.cfg配置文件，cp zoo_sample.cfg zoo.cfg打开zoo.cfg配置文件，添加配置，修改Zookeeper的配置文件cat zoo.cfg 启用SASL认证，并指定认证提供者。
authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider

jaasLoginRenew=3600000

kerberos.removeHostFromPrincipal=true

kerberos.removeRealmFromPrincipal=true

export JVMFLAGS="-Djava.security.auth.login.config= /usr/local/apache-zookeeper-3.6.4/conf/zookeeper_jaas.conf"

scp /usr/local/apache-zookeeper-3.6.4/conf/zookeeper_jaas.conf root@dshieldcdh02:/usr/local/apache-zookeeper-3.6.4/conf

scp /usr/local/apache-zookeeper-3.6.4/conf/zookeeper_jaas.conf root@dshieldcdh03:/usr/local/apache-zookeeper-3.6.4/conf

root@dshieldcdh03 \~# cat /usr/local/apache-zookeeper-3.6.4/conf/zookeeper_jaas.conf
Server {

com.sun.security.auth.module.Krb5LoginModule required

useKeyTab=true

storeKey=true

useTicketCache=false

keyTab="/etc/security/keytabs/zookeeper.keytab"

principal="zookeeper/dshieldcdh03@HADOOP139.COM";

};

cat /usr/local/apache-zookeeper-3.6.4/conf/zookeeper_client_jaas.conf

Client {

com.sun.security.auth.module.Krb5LoginModule required

useKeyTab=true

storeKey=true

useTicketCache=false

keyTab="/usr/local/apacje-zookeeper-3.6.4/conf/zk.service.keytab"

principal="zookeeper/dshieldcdh03@HADOOP139.COM";

};

三、Kafka配置Kerberos

将kafka用户的keytab文件拷贝到其他服务器上

scp /etc/security/keytabs/kafka.keytab root@ dshieldcdh02:/etc/security/keytabs/kafka.keytab

配置Kafka的JAAS文件：

在Kafka的配置目录下创建JAAS配置文件（如kafka_client_jaas.conf），内容如下：

kafka_client_jaas.conf

KafkaServer {

com.sun.security.auth.module.Krb5LoginModule required

useKeyTab=true

keyTab="/etc/security/keytabs/kafka.keytab"

storeKey=true

useTicketCache=false

serviceName="kafka"

principal="kafka/dshieldcdh01@HADOOP139.COM";

};

KafkaClient {

com.sun.security.auth.module.Krb5LoginModule required

useKeyTab=true

keyTab="/etc/security/keytabs/kafka.keytab"

storeKey=true

useTicketCache=false

serviceName="kafka"

principal="kafka/dshieldcdh01@HADOOP139.COM";

};

Client {

com.sun.security.auth.module.Krb5LoginModule required

useKeyTab=true

keyTab="/etc/security/keytabs/zookeeper.keytab"

storeKey=true

useTicketCache=false

serviceName="zookeeper"

principal=" zookeeper/dshieldcdh01@HADOOP139.COM";

};

com.sun.security.jgss.krb5.initiate {

com.sun.security.auth.module.Krb5LoginModule required

renewTGT=false

doNotPrompt=true

useKeyTab=true

keyTab="/etc/security/keytabs/kafka.keytab"

storeKey=true

useTicketCache=false

serviceName="kafka"

principal="kafka/dshieldcdh01@HADOOP139.COM";

};

kafka_server_jaas.conf

KafkaServer {

com.sun.security.auth.module.Krb5LoginModule required

useKeyTab=true

keyTab="/etc/security/keytabs/kafka.keytab"

storeKey=true

useTicketCache=false

serviceName="kafka"

principal="kafka/dshieldcdh01@HADOOP139.COM";

};

KafkaClient {

com.sun.security.auth.module.Krb5LoginModule required

useKeyTab=true

keyTab="/etc/security/keytabs/kafka.keytab"

storeKey=true

useTicketCache=false

serviceName="kafka"

principal="kafka/dshieldcdh01@HADOOP139.COM";

};

Client {

com.sun.security.auth.module.Krb5LoginModule required

useKeyTab=true

keyTab="/etc/security/keytabs/zookeeper.keytab"

storeKey=true

useTicketCache=false

serviceName="zookeeper"

principal=" zookeeper/dshieldcdh01@HADOOP139.COM";

};

com.sun.security.jgss.krb5.initiate {

com.sun.security.auth.module.Krb5LoginModule required

renewTGT=false

doNotPrompt=true

useKeyTab=true

keyTab="/etc/security/keytabs/kafka.keytab"

storeKey=true

useTicketCache=false

serviceName="kafka"

principal="kafka/dshieldcdh01@HADOOP139.COM";

};

注意修改principal、keyTab路径和serviceName以匹配实际环境。

修改Kafka的启动脚本：

在Kafka的启动脚本中添加JVM参数，指定JAAS配置文件的路径。

cat kafka_client_jaas.conf

kafkaClient {

com.sun.security.auth.module.Krb5LoginModule required

useKeyTab=true

storeKey=true

serviceName=kafka

keyTab="/etc/security/keytabs/kafka.keytab"

principal="kafka/dshieldcdh01@HADOOP139.COM";

};

cat server.properties

broker.id=1

hostname=dshieldcdh01

listerners=SASL_PLAINTEXT://dshieldcdh01:9092

security.inter.broker.protocol=SASL_PLAINTEXT

sasl.mechanism.inter.broker.protocol=GSSAPI

sasl.enabled.mechanisms= GSSAPI

sasl.kerberos.service.name=kaka

zookeeper.connect=dshieldcdh01:2181, dshieldcdh02:2181, dshieldcdh03:2181

zookeeper.set.acl=true

zookeeper.connection.timeout.ms=18000

kafka@dshieldcdh01 config$ pwd

/usr/local/kafka/config

kafka@dshieldcdh01 config$ scp kafka_jaas.conf dshieldcdh02:/usr/local/kafka/config

scp kafka_jaas.conf dshieldcdh03:/usr/local/kafka/config

#kerberos

listeners=SASL_PLAINTEXT://ambarim2:9092

advertised.listeners=SASL_PLAINTEXT://ambarim2:9092

security.inter.broker.protocol=SASL_PLAINTEXT

sasl.mechanism.inter.broker.protocol=GSSAPI

principal.to.local.class=kafka.security.auth.KerberosPrincipalToLocal

isasl.enabled.mechanisms=GSSAPI

zookeeper.connect=dshieldcdh01:2181,dshieldcdh02:2181,dshieldcdh03:2181

相关推荐
小五传输20 分钟前
杀毒引擎有哪些软件好用？机器人企业文件威胁防护选型指南
大数据·运维·安全
fb_1234534 分钟前
KVM虚拟化保姆级实战：图形界面建机 + virsh命令管理 + 热迁移全流程，一篇打通！
运维
2401_8628808234 分钟前
Linux应用层开发 --- UDP&TCP
linux·运维·tcp/ip·udp
姚不倒40 分钟前
Nginx 虚拟主机：server_name 匹配规则与实战
运维·nginx
代码方舟2 小时前
零信任架构实战：基于天远车辆过户详版查询构建自动化车辆估值网关
运维·人工智能·架构·自动化
BlueAsia_Lab2 小时前
Wi‑Fi 认证：企业办理需要准备哪些资料？
运维·服务器·网络
Mortalbreeze3 小时前
深入理解 Linux IO 模型（一）：阻塞 IO、非阻塞 IO 与信号驱动 IO
linux·运维·服务器
D_codingXuChu4 小时前
2026年物联网应用开发服务商选型指南｜从设备接入、数据处理、业务联动到长期运维，拆解项目落地中的工程实践与可验证方法，帮助企业判断供应商真实交付能力
运维·物联网·开发经验·企业服务
2301_780789664 小时前
CDN提供商常用的DDoS缓解技术与策略
linux·运维·服务器·人工智能·架构
进击的雷神4 小时前
网站 SEO 功能怎么测：从手工检查到自动化脚本的实战思路
运维·爬虫·自动化·官网seo·收录
热门推荐
01国内可直接用、免费额度/永久免费的大模型API清单（含 SiliconFlow、火山、阿里、智谱、百度、Kimi、DeepSeek、DMXAPI 等）02GitHub 镜像站点03蜘蛛磁力 搜索引擎大全，如何使用蜘蛛磁力查找磁力链接042026 国产 AI 大模型横评：DeepSeek、通义千问、Kimi、文心一言、星火、豆包谁更能打？05ZCode 周末送额度活动开启：3 亿 Token 免费领取06历年考研数学一、数学二、数学三真题试卷及答案PDF07微信历史版本含下载地址（ Windows PC | 安卓 | MAC ）及设置微信不更新08AI 编程 IDE 全景解析 2026：Agent 全面接管开发链路09Agnes AI 免费 API 接入指南：文本、生图、生视频，一套接口全免费10VSCode+CodeX扩展，无法启动