Step 4: Enabling Kerberos Using the Wizard

Minimum Required Role: Full Administrator

To start the Kerberos wizard:
  1. Go to the Cloudera Manager Admin Console and click to the right of the cluster for which you want to enable Kerberos authentication.
  2. Select Enable Kerberos.

The steps below instructions will guide you through the wizard to secure your cluster.

  1. Getting Started
  2. Setup KDC
  3. Manage krb5.conf
  4. Setup KDC Account
  5. Configure Kerberos
  6. Summary

Getting Started

The first page lists steps you should have completed before starting the wizard.
  • Set up a working KDC. Cloudera Manager supports authentication with MIT KDC, Active Directory, and Red Hat Identity Management/FreeIPA.
  • Configure the KDC to allow renewable tickets with non-zero ticket lifetimes.

    Active Directory allows renewable tickets with non-zero lifetimes by default. You can verify this by checking Domain Security Settings > Account Policies > Kerberos Policy in Active Directory.

    For MIT KDC, make sure you have the following lines in the kdc.conf. 
    max_life = 1d  
max_renewable_life = 7d
  • If you are using Active Directory, make sure LDAP over TLS/SSL (LDAPS) is enabled for the Domain Controllers.
  • Hostnames must be in lowercase. If you use uppercase letters in any hostname, the cluster services will not start after enabling Kerberos.
  • Install the OS-specific packages for your cluster listed in the table:
    OS Packages Required
    RHEL 7 Compatible, RHEL 6 Compatible
    • openldap-clients on the Cloudera Manager Server host
    • krb5-workstation, krb5-libs on ALL hosts
    • (Red Hat IdM/FreeIPA only) freeipa-client on all cluster hosts
    SLES
    • openldap2-client on the Cloudera Manager Server host
    • krb5-client on ALL hosts
    • (Red Hat IdM/FreeIPA only) freeipa-client on all cluster hosts
    Ubuntu
    • ldap-utils on the Cloudera Manager Server host
    • krb5-user on ALL hosts
    • (Red Hat IdM/FreeIPA only) freeipa-client on all cluster hosts
    Windows
    • krb5-workstation, krb5-libs on ALL hosts
  • Create an account for Cloudera Manager that has the permissions to create other accounts in the KDC. This should have been completed as part of Step 3: Create the Kerberos Principal for Cloudera Manager Server.

Once you are able to check all the items on this list, click Continue.

Setup KDC

On this page, select the KDC type you are using: MIT KDC, Active Directory, or Red Hat IPA. Complete the fields as applicable to enable Cloudera Manager to generate principals/accounts for the CDH services running on the cluster.

Click Continue to proceed.

Manage krb5.conf

Choose whether Cloudera Manager should deploy and manage the krb5.conf on your cluster or not. If left unchecked, you must ensure that the krb5.conf is deployed on all hosts in the cluster, including the Cloudera Manager Server's host.

If you check Manage krb5.conf through Cloudera Manager, this page will let you configure the properties that will be emitted in it. In particular, the safety valves on this page can be used to configure cross-realm authentication. More information can be found at Configuring a Dedicated MIT KDC for Cross-Realm Trust.

Click Continue to proceed.

Setup KDC Account

Enter the username and password for the user that can create principals for CDH cluster in the KDC. This is the user/principal you created in Step 3: Create the Kerberos Principal for Cloudera Manager Server. Cloudera Manager encrypts the username and password into a keytab and uses it as needed to create new principals.

If you are using Red Hat IdM/FreeIPA, enter the IPA admin credentials here. These admin credentials are not stored, and are used only to create a new user and role (named cmadin-<random_id> and cmadminrole, respectively) and retrieve its keytab. Cloudera Manager stores this keytab for future Kerberos operations, such as regenerating the credentials of the CDH service accounts.

Click Continue to proceed.

The Command Details page displays the outcome of the Import KDC Account Manager Credentials command. After it successfully completes, click Continue.

Configure Kerberos

If you have not already done so, run the provided commands on each cluster host to install the Kerberos libraries.

Then, specify the privileged ports needed by the DataNode Transceiver Protocol and the HTTP Web UI in a secure cluster.

You can configure custom service principals for CDH services. Before you begin making configuration changes, see Customizing Kerberos Principals for some additional configuration changes required and limitations. If you want to use custom service principals, uncheck the box labeled Use Default Kerberos Principals, and then specify a custom principal for each service.

Click Continue to proceed.

The Command Details page displays the outcome of the Enable Kerberos command. After it successfully completes, click Continue.

Summary

The final page lists the cluster(s) for which Kerberos has been successfully enabled. Click Finish to return to the Cloudera Manager Admin Console home page.