Question

为了允许从MacBook访问Kerberized Hadoop，请尝试创建SPNEGO。在Centos 7中从KDC中复制spnego keytab后，执行kinit失败，并出现以下错误：

$kinit -kt /etc/security/keytabs/spnego.service.keytab ambari-qa-tcluster@EXAMPLE.COM

kinit: krb5_init_creds_set_keytab: Failed to find ambari-qa-ambari-qa-tcluster@EXAMPLE.COM in keytab FILE:/etc/security/keytabs/smokeuser.headless.keytab (unknown enctype)

在Centos上，使用以下命令检查了enctype：

[root@vpimply1 ~]# klist -kte /etc/security/keytabs/smokeuser.headless.keytab
Keytab name: FILE:/etc/security/keytabs/smokeuser.headless.keytab
KVNO Timestamp           Principal
---- ------------------- ------------------------------------------------------
   2 11/27/2018 21:48:00 ambari-qa-tcluster@EXAMPLE.COM (des-cbc-md5)
   2 11/27/2018 21:48:00 ambari-qa-tcluster@EXAMPLE.COM (aes128-cts-hmac-sha1-96)
   2 11/27/2018 21:48:00 ambari-qa-tcluster@EXAMPLE.COM (arcfour-hmac)
   2 11/27/2018 21:48:00 ambari-qa-tcluster@EXAMPLE.COM (des3-cbc-sha1)
   2 11/27/2018 21:48:00 ambari-qa-tcluster@EXAMPLE.COM (aes256-cts-hmac-sha1-96)
[root@vpimply1 ~]#

试图创建具有特定enctype的密钥表，但仍然遇到相同的错误。

如何解决此“ enctype”问题？

Answer 1

经过一番努力，我在Macbook中将KRB5跟踪设置如下：

KRB5_TRACE = / dev / stdout

设置此后，我可以清楚地看到keytab上的权限不正确。

$ kinit -t /etc/security/keytabs/smokeuser.headless.keytab ambari-qa-vpimply@IMPLY.IO
2018-11-29T11:17:29 set-error: -1765328242: Reached end of credential caches
2018-11-29T11:17:29 set-error: -1765328243: Principal ambari-qa-vpimply@IMPLY.IO not found in any credential cache
2018-11-29T11:17:29 set-error: 13: keytab /etc/security/keytabs/smokeuser.headless.keytab access failed: Permission denied
2018-11-29T11:17:29 set-error: 13: Failed to find ambari-qa-vpimply@IMPLY.IO in keytab FILE:/etc/security/keytabs/smokeuser.headless.keytab (unknown enctype)
kinit: krb5_init_creds_set_keytab: Failed to find ambari-qa-vpimply@IMPLY.IO in keytab FILE:/etc/security/keytabs/smokeuser.headless.keytab (unknown enctype)

$ ls -alrt /etc/security/keytabs
total 24
-r--r-----  1 root                wheel  338 Nov 28 13:19 smokeuser.headless.keytab
drwxr-xr-x  5 root                wheel  160 Nov 28 17:16 .

修复权限以匹配当前登录的用户后，kinit可以正常工作！它与“ enctype”无关。同样，最近的MACO不需要安装任何软件包-甚至不需要MIT Kerberos即可使客户端正常运行。

kinit：krb5_init_creds_set_keytab：找不到密钥表（未知的enctype）

1 个答案: