--- title: （可选）配置Keytab和Whitelist description: "配置Keytab和Whitelist都可以提高系统的安全性和可靠性。Keytab简化了Kerberos认证过程，提高了系统的安全性，而Whitelist则增强了系统的访问控制。配置Keytab和Whitelist之前，需要使用KDC服务器，建议为第三方服务器（非OmniShuffle Shuffle加速集群服务器），请提前准备。" url: https://www.hikunpeng.com/document/detail/zh/kunpengboostkithistory/240RC2/bds/kunpengbds_omniruntime_20_0131.html sourcePath: /source/zh/kunpengboostkithistory/240RC2/bds/kunpengbds_omniruntime_20_0131.html indexId: abab719e311a4d100c0567ad53240cbfc45697f1753fdde80bcbc337a611b19680 --- # （可选）配置Keytab和Whitelist 配置Keytab和Whitelist都可以提高系统的安全性和可靠性。Keytab简化了Kerberos认证过程，提高了系统的安全性，而Whitelist则增强了系统的访问控制。配置Keytab和Whitelist之前，需要使用KDC服务器，建议为第三方服务器（非OmniShuffle Shuffle加速集群服务器），请提前准备。 - 出于安全考虑，建议将各节点运维账户umask修改为077及以上。 - 如果在当前环境中以运维账户执行过kmc_tool相关操作，需要在集群环境中删除运维账户kmc信号量。 - 查询信号量。 1 ipcs -s -t - 删除信号量。 1 ipcrm -S 0x20161316 #### 配置Keytab、Whitelist 1. 登录OmniShuffle Shuffle加速集群服务器，修改每台服务器的“/etc/hosts”文件。 在“hosts”文件中添加KDC服务器的“地址 主机名”映射关系。 ``` IPaddress 1 server ``` 2. 登录KDC服务器节点。 3. 在ZooKeeper运行用户与提交Spark任务用户的“${HOME}/.bashrc”中新增OCK_HOME、OCK_VERSION、OCK_BINARY_TYPE环境变量。 a. 打开文件。 ``` vi ~ /.bashrc ``` b. 按“i”进入编辑模式，在文件中添加以下内容。 ``` export OCK_HOME=/home/ockadmin/opt/ock export OCK_VERSION=24.0.0 export OCK_BINARY_TYPE=linux-aarch64 ``` c. 按“Esc”键，输入:wq!，按“Enter”保存并退出编辑。 4. 用户需自行生成KDC所需的数字证书文件、白名单whitelist文件、kmc密钥文件。将文件复制至各节点对应用户的指定位置。 - ock用户生成文件位于“${OCK_HOME}/security/”目录下。 ├── authorization │ └── whitelist_en ├── kdc │ └── krb5-server_en.keytab ├── pmt │ ├── master │ │ └── ksfa │ └── standby │ └── ksfb └── tls ├── client.crt.pem ├── client.pem ├── server │ ├── ca.cert.pem │ ├── server.cert.pem │ ├── server.keypass.key │ └── server.private.key.pem └── server.crt.pem 相关配置如下： | 用户 | 文件 | 配置项 | 示例路径 | | --- | --- | --- | --- | | ockadmin | whitelist\_en | ock.ucache.rpc.author.file.path | /home/ockadmin/opt/ock/security/authorization/whitelist\_en | | ockadmin | krb5\-server\_en.keytab | ock.ucache.rpc.auth.kerb.server.keytab | /home/ockadmin/opt/ock/security/kdc/krb5\-server\_en.keytab | | ockadmin | krb5\-server\_en.keytab | ock.zookeeper.security.client.keytab | /home/ockadmin/opt/ock/security/kdc/krb5\-server\_en.keytab | | ockadmin | ksfa | ock.ucache.kmc.ksf.primary.path | /home/ockadmin/opt/ock/security/pmt/master/ksfa/keytab | | ockadmin | ksfb | ock.ucache.kmc.ksf.standby.path | /home/ockadmin/opt/ock/security/pmt/standby/ksfb | | ockadmin | client.crt.pem | ock.zookeeper.security.certs | /home/ockadmin/opt/ock/security/tls/client.crt.pem | | ockadmin | client.pem | ock.zookeeper.security.certs | /home/ockadmin/opt/ock/security/tls/client.pem | | ockadmin | ca.cert.pem | ock.ucache.rpc.tls.ca.cert.path | /home/ockadmin/opt/ock/security/tls/server/ca.cert.pem | | ockadmin | server.cert.pem | ock.ucache.rpc.tls.cert.path | /home/ockadmin/opt/ock/security/tls/server/server.cert.pem | | ockadmin | server.keypass.key | ock.ucache.rpc.tls.key.pass.path | /home/ockadmin/opt/ock/security/tls/server/server.keypass.key | | ockadmin | server.private.key.pem | ock.ucache.rpc.tls.key.path | /home/ockadmin/opt/ock/security/tls/server/server.private.key.pem | | ockadmin | server.crt.pem | ock.zookeeper.security.certs | /home/ockadmin/opt/ock/security/tls/server.crt.pem | - 提交Spark任务用户生成文件位于用户“${SPARK_HOME}/huawei/ock/security”目录下。 ├── authorization │ └── whitelist_en ├── kdc │ ├── krb5-client_en.keytab │ └── krb5-server_en.keytab ├── pmt │ ├── master │ │ └── ksfa │ └── standby │ └── ksfb │ └── tls ├── ca.cert.pem ├── client.crt.pem ├── client.pem ├── server.cert.pem ├── server.crt.pem ├── server.keypass.key └── server.private.key.pem 相关配置如下： | 用户 | 文件 | 配置项 | 示例路径 | | --- | --- | --- | --- | | Sparkadmin | whitelist\_en | ock.ucache.rpc.author.driver.file.path | /home/Sparkadmin/huawei/ock/security/authorization/whitelist\_en | | Sparkadmin | krb5\-client\_en.keytab | ock.ucache.rpc.auth.kerb.client.keytab | /home/Sparkadmin/huawei/ock/security/kdc/krb5\-client\_en.keytab | | Sparkadmin | krb5\-client\_en.keytab | ock.zookeeper.sdk.security.client.keytab | /home/Sparkadmin/huawei/ock/security/kdc/krb5\-client\_en.keytab | | Sparkadmin | krb5\-server\_en.keytab | ock.ucache.rpc.auth.driver.kerb.server.keytab | /home/Sparkadmin/huawei/ock/security/kdc/krb5\-server\_en.keytab | | Sparkadmin | ksfa | ock.ucache.sdk.kmc.ksf.primary.path | /home/Sparkadmin/huawei/ock/security/pmt/master/ksfa | | Sparkadmin | ksfb | ock.ucache.sdk.kmc.ksf.standby.path | /home/Sparkadmin/huawei/ock/security/pmt/standby/ksfb | | Sparkadmin | client.crt.pem | ock.zookeeper.sdk.security.certs | /home/Sparkadmin/huawei/ock/security/tls/client.crt.pem | | Sparkadmin | client.pem | ock.zookeeper.sdk.security.certs | /home/Sparkadmin/huawei/ock/security/tls/client.pem | | Sparkadmin | ca.cert.pem | ock.ucache.rpc.tls.sdk.ca.cert.path | /home/Sparkadmin/huawei/ock/security/tls/ca.cert.pem | | Sparkadmin | server.cert.pem | ock.ucache.rpc.tls.driver.cert.path | /home/Sparkadmin/huawei/ock/security/tls/server.cert.pem | | Sparkadmin | server.keypass.key | ock.ucache.rpc.tls.driver.key.pass.path | /home/Sparkadmin/huawei/ock/security/tls/server.keypass.key | | Sparkadmin | server.private.key.pem | ock.ucache.rpc.tls.driver.key.path | /home/Sparkadmin/huawei/ock/security/tls/server.private.key.pem | | Sparkadmin | server.crt.pem | ock.zookeeper.sdk.security.certs | home/Sparkadmin/huawei/ock/security/tls/server.crt.pem | authorization目录下的文件是鉴权相关文件，kdc目录下的文件是安全认证相关文件，tls目录下的文件是tls安全传输通信的相关文件，pmt目录下的文件是对证书文件进行加密的加密密钥。authorization、kdc、tls目录下的文件需要调用kmc_tools工具 使用pmt目录下的加密密钥对文件进行加密，具体加密使用方法见章节4.2。 - ZooKeeper用户生成文件位于用户“${ZOOKEEPER_HOME}/huawei/ock/security”目录下。 ├── kdc │ └── zookeeper_en.keytab ├── pmt │ ├── master │ │ └── ksfa │ └── standby │ └── ksfb 相关配置如下： | 用户 | 文件 | 配置项 | 示例路径 | | --- | --- | --- | --- | | Zookeeperadmin | zookeeper\_en.keytab | keytab | /home/Zookeeperadmin/huawei/ock/security/kdc/zookeeper\_en.keytab | | Zookeeperadmin | ksfa | kmc.ksf.primary.path | /home/Zookeeperadmin/huawei/ock/security/pmt/master/ksfa | | Zookeeperadmin | ksfb | kmc.ksf.standby.path | /home/Zookeeperadmin/huawei/ock/security/pmt/standby/ksfb | Zookeeper的具体配置见下述章节2.2.3。