Step 2: Installing JCE Policy File for AES-256 Encryption

By default, CentOS and Red Hat Enterprise Linux 5.5 (and higher) use AES-256 encryption for Kerberos tickets, so the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy File must be installed on all cluster hosts as detailed below. Alternatively, the Kerberos instance can be modified to not use AES-256.

To install the JCE Policy file on the host system at the OS layer:
  1. Download the jce_policy-x.zip.
  2. Unzip the file.
  3. Follow the steps in the README.txt to install it.
To use Cloudera Manager to install the JCE policy file:
  1. Log in to the Cloudera Manager Admin Console.
  2. Enter the following URL in the browser: 
    http://<Cloudera_Manager_server_host>:7180/cmf/upgrade-wizard/wizard
  3. Select Install Oracle Java SE Development Kit (JDK 8).
  4. Select Install Java Unlimited Strength Encryption Policy Files.
  5. Click Continue.
Alternative: Disable AES-256 encryption from the Kerberos instance:
  1. Remove aes256-cts:normal from the supported_enctypes field of the kdc.conf or krb5.conf file.
  2. Restart the Kerberos KDC and the kadmin server so the changes take effect.

The keys of relevant principals, such as Ticket Granting Ticket principal (krbtgt/REALM@REALM), might need to change.

To verify the type of encryption used in your cluster:

  1. For MIT KDC: On the local KDC host, type this command in the kadmin.local or kadmin shell to create a test principal: 
    kadmin:  addprinc test

    For Active Directory: Create a new AD account with the name, test.

  2. On a cluster host, type this command to start a Kerberos session as test: 
    kinit test
  3. On a cluster host, type this command to view the encryption type in use: 
    klist -e

    If AES is being used, output like the following is displayed after you type the klist command (note that AES-256 is included in the output):

    Ticket cache: FILE:/tmp/krb5cc_0
Default principal: test@Cloudera Manager
Valid starting     Expires            Service principal
05/19/11 13:25:04  05/20/11 13:25:04  krbtgt/Cloudera Manager@Cloudera Manager
    Etype (skey, tkt): AES-256 CTS mode with 96-bit SHA-1 HMAC, AES-256 CTS mode with 96-bit SHA-1 HMAC