Step 2: Install JCE policy files for AES-256 encryption
How to install JCE policy files, if required.
By default, CentOS and Red Hat Enterprise Linux 5.5 (and higher) use AES-256 encryption for Kerberos tickets, so the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files must be installed on all cluster hosts as detailed below. Alternatively, the Kerberos instance can be modified to not use AES-256.
To manually install the JCE policy files on the host system:
- Download the
jce_policy-<version>.zip
file from the Oracle website. - Unzip the file.
- Follow the steps in
README.txt
to install it.
To use Cloudera Manager to install the JCE policy file:
- Log in to the Cloudera Manager Admin Console.
- Navigate to .
- Click Install Java Unlimited Strength Encryption Policy Files.
- Specify the repository location for your version of Cloudera Manager, and click Continue.
- Check the box labeled Install Oracle Java SE Development Kit (JDK 8), and then check the box labeled Install Java Unlimited Strength Encryption Policy Files. Click Continue.
- Provide cluster host login credentials, and then click Continue.
- After the installation completes, click Finish. If the Upgrade Cloudera Manager page displays, you can exit by clicking the Cloudera Manager logo to return to the home page.
Alternative: Disable AES-256 encryption from the Kerberos instance:
- Remove any
aes256
entries from thesupported_enctypes
field of thekdc.conf
orkrb5.conf
files. - Restart the Kerberos KDC and the kadmin server so the changes take effect.
The keys of relevant principals, such as Ticket Granting Ticket principal (krbtgt/REALM@REALM), might need to change.
To verify the type of encryption used in your cluster: