離線遷移或備份/恢復(fù)kdc數(shù)據(jù)庫(kù)筒愚，建議采用搭建主備kdc在線遷移物咳。
導(dǎo)出kdc數(shù)據(jù)庫(kù)備份文件
$ sudo kdb5_util dump -verbose /home/dengsc/kdc/bakfile
$ ls -l /home/dengsc/kdc/
total 64
-rw------- 1 root root 55991 Sep 19 10:30 bakfile
-rw------- 1 root root 1 Sep 19 10:30 bakfile.dump_ok
同步kdc.conf,krb5.conf,kadm5.acl,bakfile文件至恢復(fù)主機(jī)
$ scp kdc.conf kadm5.acl test01:/var/kerberos/krb5kdc/
$ scp krb5.con test01:/etc/
$ scp bakfile test01:~/
在恢復(fù)主機(jī)初始化數(shù)據(jù)庫(kù),領(lǐng)域名與先前一致
$ sudo kdb5_util create -r HADOOP.COM -s
導(dǎo)入備份數(shù)據(jù)
$ sudo kdb5_util load -verbose ~/bakfile
登錄kadmin.local查看數(shù)據(jù)是否恢復(fù)
$ sudo kadmin.local
kadmin.local: listprincs
修改krb.conf中的kdc,admin_server host為本地主機(jī)
$ sudo vi /etc/krb5.conf
[realms]
HADOOP.COM = {
kdc = test01
admin_server = test01
}
調(diào)試模式執(zhí)行kinit認(rèn)證(失敗)
# 認(rèn)證
$ kinit -kt dengsc.keytab dengsc
kinit: Generic error (see e-text) while getting initial credentials
# debug信息
$ KRB5_TRACE=/dev/stderr kinit -C admin/admin@HADOOP.COM
[158565] 1505798208.611471: Getting initial credentials for admin/admin@HADOOP.COM
[158565] 1505798208.611939: Sending request (174 bytes) to HADOOP.COM
[158565] 1505798208.612140: Resolving hostname nfjd-hadoop02-node177.jpushoa.com
[158565] 1505798208.612715: Initiating TCP connection to stream 192.168.254.226:88
[158565] 1505798208.612817: Sending TCP request to stream 192.168.254.226:88
[158565] 1505798208.613136: Received answer (175 bytes) from stream 192.168.254.226:88
[158565] 1505798208.613156: Terminating TCP connection to stream 192.168.254.226:88
[158565] 1505798208.613217: Response was not from master KDC
[158565] 1505798208.613268: Received error from KDC: -1765328324/Generic error (see e-text)
[158565] 1505798208.613310: Retrying AS request with master KDC
[158565] 1505798208.613328: Getting initial credentials for admin/admin@HADOOP.COM
[158565] 1505798208.613391: Sending request (174 bytes) to HADOOP.COM (master)
kinit: Generic error (see e-text) while getting initial credentials
關(guān)于報(bào)錯(cuò)社區(qū)回答:https://bugzilla.redhat.com/show_bug.cgi?id=1184628
redhat版本bug:"Principal canonicalization does not work for principals in IPA realm"
安裝ipa-server
$ sudo yum install ipa-server
$ rpm -qa | grep ipa-server
ipa-server-4.5.0-21.el7.centos.1.2.x86_64
ipa-server-common-4.5.0-21.el7.centos.1.2.noarch
再次執(zhí)行認(rèn)證(通過)
$ kinit admin/admin
Password for admin/admin@HADOOP.COM:
$ klist
Ticket cache: FILE:/tmp/krb5cc_2190
Default principal: admin/admin@HADOOP.COM
Valid starting Expires Service principal
09/19/2017 13:21:11 09/20/2017 13:21:11 krbtgt/HADOOP.COM@HADOOP.COM
renew until 09/26/2017 13:21:11
$ kdestroy
