11.14. Kerberos 통합

1. KDC를 설정할 시스템에 필요한 RPM이 설치되어 있는지 확인합니다.

   [root@host ~]# rpm -qa | grep krb5
   
   krb5-libs-1.20.1-9.el9_2.x86_64
   krb5-pkinit-1.20.1-9.el9_2.x86_64
   krb5-server-1.20.1-9.el9_2.x86_64
   krb5-server-ldap-1.20.1-9.el9_2.x86_64
   krb5-devel-1.20.1-9.el9_2.x86_64
   krb5-workstation-1.20.1-9.el9_2.x86_64

   참고
   • Kerberos REALM 이름에 따라 도메인 이름을 사용하는 것이 좋습니다. 예를 들어, Cryostat - PUNE.IBM.COM, Admin principal - admin/admin.
   • 설치된 구성 파일을 편집하여 새 KDC를 반영합니다. KDC는 IP 주소 또는 DNS 이름으로 제공할 수 있습니다.

2. krb5.conf 파일을 업데이트합니다.

   참고

   krb5.conf 파일의 kdc 및 admin_server IP를 사용하여 모든 영역(default_realm 및 domain_realm)을 업데이트해야 합니다.

   [root@host ~]# cat /etc/krb5.conf
   
   # To opt out of the system crypto-policies configuration of krb5, remove the
   # symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
   
   includedir /etc/krb5.conf.d/
   [logging]
       default = [FILE:/var/log/krb5libs.log](file:///var/log/krb5libs.log)
       kdc = [FILE:/var/log/krb5kdc.log](file:///var/log/krb5kdc.log)
       admin_server = [FILE:/var/log/kadmind.log](file:///var/log/kadmind.log)
   [libdefaults]
       dns_lookup_realm = false
       ticket_lifetime = 24h
       renew_lifetime = 7d
       forwardable = true
       rdns = false
       pkinit_anchors = [FILE:/etc/pki/tls/certs/ca-bundle.crt](file:///etc/pki/tls/certs/ca-bundle.crt)
       spake_preauth_groups = edwards25519
       dns_canonicalize_hostname = fallback
       qualify_shortname = ""
       default_realm = PUNE.IBM.COM
       default_ccache_name = KEYRING:persistent:%{uid}
   [realms]
       PUNE.IBM.COM = {
          kdc = 10.0.210.222:88
          admin_server = 10.0.210.222:749
       }
   [domain_realm]
     .redhat.com = PUNE.IBM.COM
     redhat.com = PUNE.IBM.COM

3. krb5.conf 파일을 업데이트합니다.

   참고

   kdc.conf 파일에서 영역을 업데이트해야 합니다.

   [root@host ~]# cat /var/kerberos/krb5kdc/kdc.conf
   
    [kdcdefaults]
    kdc_ports = 88
    kdc_tcp_ports = 88
    spake_preauth_kdc_challenge = edwards25519
   [realms]
      PUNE.IBM.COM = {
         master_key_type = aes256-cts-hmac-sha384-192
         acl_file = /var/kerberos/krb5kdc/kadm5.acl
         dict_file = /usr/share/dict/words
         default_principal_flags = +preauth
         admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
         supported_enctypes = aes256-cts-hmac-sha384-192:normal aes128-cts-hmac-sha256-128:normal aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal camellia256-cts-cmac:normal camellia128-cts-cmac:normal arcfour-hmac-md5:normal
        # Supported encryption types for FIPS mode:
        #supported_enctypes = aes256-cts-hmac-sha384-192:normal aes128-cts-hmac-sha256-128:normal
     }

4. kdb5_util:을 사용하여 KDC 데이터베이스를 생성합니다.

   참고

   DNS 또는 /etc/hosts 를 통해 호스트 이름을 확인할 수 있는지 확인합니다.

   [root@host ~]# kdb5_util create -s -r [PUNE.IBM.COM](http://pune.ibm.com/)
   
   Initializing database '/var/kerberos/krb5kdc/principal' for realm 'PUNE.IBM.COM',
   master key name 'K/M@PUNE.IBM.COM'
   You will be prompted for the database Master Password.
   It is important that you NOT FORGET this password.
   Enter KDC database master key:
   Re-enter KDC database master key to verify:

5. ACL 파일에 관리자를 추가합니다.

   [root@host ~]# cat /var/kerberos/krb5kdc/kadm5.acl
   
   */admin@PUNE.IBM.COM	*

   출력은 관리자 인스턴스의 PUNE.IBM.COM 영역에 있는 모든 주체에 모든 관리 권한이 있음을 나타냅니다.

6. Kerberos 데이터베이스에 관리자를 추가합니다.

   [root@host ~]# kadmin.local
   
   Authenticating as principal root/admin@PUNE.IBM.COM with password.
   kadmin.local:  addprinc admin/admin@PUNE.IBM.COM
   No policy specified for admin/admin@PUNE.IBM.COM; defaulting to no policy
   Enter password for principal "admin/admin@PUNE.IBM.COM":
   Re-enter password for principal "admin/admin@PUNE.IBM.COM":
   Principal "admin/admin@PUNE.IBM.COM" created.
   kadmin.local:

7. kdc 및 kadmind:을 시작합니다.

   # krb5kdc
   # kadmind

프로세스

1. 필요한 RPM 확인

   [root@host ~]# rpm -qa | grep krb5
   
   krb5-libs-1.20.1-9.el9_2.x86_64
   krb5-pkinit-1.20.1-9.el9_2.x86_64
   krb5-workstation-1.20.1-9.el9_2.x86_64

2. KDC 서버의 것과 유사한 krb5.conf 파일을 업데이트합니다.

   [root@host ~]# cat /etc/krb5.conf
   
   # To opt out of the system crypto-policies configuration of krb5, remove the
   # symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
   
   includedir /etc/krb5.conf.d/
   [logging]
       default = [FILE:/var/log/krb5libs.log](file:///var/log/krb5libs.log)
       kdc = [FILE:/var/log/krb5kdc.log](file:///var/log/krb5kdc.log)
       admin_server = [FILE:/var/log/kadmind.log](file:///var/log/kadmind.log)
   [libdefaults]
       dns_lookup_realm = false
       ticket_lifetime = 24h
       renew_lifetime = 7d
       forwardable = true
       rdns = false
       pkinit_anchors = [FILE:/etc/pki/tls/certs/ca-bundle.crt](file:///etc/pki/tls/certs/ca-bundle.crt)
       spake_preauth_groups = edwards25519
       dns_canonicalize_hostname = fallback
       qualify_shortname = ""
       default_realm = PUNE.IBM.COM
      default_ccache_name = KEYRING:persistent:%{uid}
   [realms]
     PUNE.IBM.COM = {
        kdc = 10.0.210.222:88
        admin_server = 10.0.210.222:749
     }
   [domain_realm]
     .IBM.com = PUNE.IBM.COM
     IBM.com = PUNE.IBM.COM

프로세스

1. 해당 호스트에 대한 서비스 주체를 생성합니다.

   [root@host ~]# kinit admin/admin
   
   Password for admin/admin@PUNE.IBM.COM:
   [root@host ~]# kadmin
   Authenticating as principal admin/admin@PUNE.IBM.COM with password.
   Password for admin/admin@PUNE.IBM.COM:
   kadmin:  addprinc -randkey nfs/<hostname>.ibm.com
   No policy specified for nfs/<hostname>.ibm.com@PUNE.IBM.COM; defaulting to no policy
   Principal "nfs/<hostname>.ibm.com@PUNE.IBM.COM" created.

2. 키탭 파일에 키를 추가합니다.

   참고

   이 단계에서는 이미 NFS 서버에 있고 kadmin 인터페이스를 사용합니다. 여기에서 키탭 작업은 NFS 서버의 키탭에 반영됩니다.

   kadmin:  ktadd nfs/<hostname>.ibm.com
   
   Entry for principal nfs/<hostname>.ibm.com with kvno 2, encryption type aes256-cts-hmac-sha384-192 added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com with kvno 2, encryption type aes128-cts-hmac-sha256-128 added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com with kvno 2, encryption type camellia256-cts-cmac added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com with kvno 2, encryption type camellia128-cts-cmac added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com with kvno 2, encryption type arcfour-hmac added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   kadmin:

3. NFS Ganesha 컨테이너가 실행 중인 모든 Ceph 노드와 모든 NFS 클라이언트에서 1단계와 2단계를 실행합니다.

프로세스

1. 기존 NFS Ganesha 컨테이너 구성을 검색합니다.

   [ceph: root@host /]# ceph orch ls --service-type nfs --export
   
   service_type: nfs
   service_id: c_ganesha
   service_name: nfs.c_ganesha
   placement:
     hosts:
     - host1
     - host2
     - host3
   spec:
     port: 2049

2. /etc/krb5.conf 및 / etc/krb5.keytab 파일을 호스트에서 컨테이너로 전달하도록 컨테이너 구성을 수정합니다. 이러한 파일을 런타임 시 NFS Ganesha에서 참조하여 들어오는 서비스 티켓을 검증하고 Ganesha와 NFS 클라이언트(krb5p) 간의 통신을 보호합니다.

   [root@host ~]# cat nfs.yaml
   
   service_type: nfs
   service_id: c_ganesha
   service_name: nfs.c_ganesha
   placement:
     hosts:
     - host1
     - host2
     - host3
   spec:
     port: 2049
   extra_container_args:
     - "-v"
     - "/etc/krb5.keytab:/etc/krb5.keytab:ro"
     - "-v"
     - "/etc/krb5.conf:/etc/krb5.conf:ro"

3. cephadm 쉘 내에서 수정된 nfs.yaml 파일을 사용할 수 있도록 합니다.

   [root@host ~]# cephadm shell --mount nfs.yaml:/var/lib/ceph/nfs.yaml
   
   Inferring fsid ff1c1498-73ec-11ee-af38-fa163e9a17fd
   Inferring config /var/lib/ceph/ff1c1498-73ec-11ee-af38-fa163e9a17fd/mon.ceph-msaini-qp49z7-node1-installer/config
   Using ceph image with id 'fada497f9c5f' and tag 'ceph-7.0-rhel-9-containers-candidate-73711-20231018030025' created on 2023-10-18 03:03:39 +0000 UTC
   registry-proxy.engineering.ibm.com/rh-osbs/rhceph@sha256:e66e5dd79d021f3204a183f5dbe4537d0c0e4b466df3b2cc4d50cc79c0f34d75

4. 파일에 필요한 변경 사항이 있는지 확인합니다.

   [ceph: root@host /]# cat /var/lib/ceph/nfs.yaml
   
   service_type: nfs
   service_id: c_ganesha
   service_name: nfs.c_ganesha
   placement:
     hosts:
     - host1
     - host2
     - host3
   spec:
     port: 2049
   extra_container_args:
     - "-v"
     - "/etc/krb5.keytab:/etc/krb5.keytab:ro"
     - "-v"
     - "/etc/krb5.conf:/etc/krb5.conf:ro"

5. NFS Ganesha 컨테이너에 필요한 변경 사항을 적용하고 컨테이너를 재배포합니다.

   [ceph: root@host /]# ceph orch apply -i /var/lib/ceph/nfs.yaml
   
   Scheduled nfs.c_ganesha update...
   [ceph: root@ceph-msaini-qp49z7-node1-installer /]# ceph orch redeploy nfs.c_ganesha
   Scheduled to redeploy nfs.c_ganesha.1.0.ceph-msaini-qp49z7-node1-installer.sxzuts on host 'ceph-msaini-qp49z7-node1-installer'
   Scheduled to redeploy nfs.c_ganesha.2.0.ceph-msaini-qp49z7-node2.psuvki on host 'ceph-msaini-qp49z7-node2'
   Scheduled to redeploy nfs.c_ganesha.0.0.ceph-msaini-qp49z7-node3.qizzvk on host 'ceph-msaini-qp49z7-node3'

6. 재배포된 서비스에 필요한 변경 사항이 있는지 확인합니다.

   [ceph: root@host /]# ceph orch ls --service-type nfs --export
   
   service_type: nfs
   service_id: c_ganesha
   service_name: nfs.c_ganesha
   placement:
     hosts:
     - ceph-msaini-qp49z7-node1-installer
     - ceph-msaini-qp49z7-node2
     - ceph-msaini-qp49z7-node3
   extra_container_args:
   - -v
   - /etc/krb5.keytab:/etc/krb5.keytab:ro
   - -v
   - /etc/krb5.conf:/etc/krb5.conf:ro
   spec:
     port: 2049

7. krb5* (krb5, krb5i, krb5p) 보안 플레이버를 갖도록 내보내기 정의를 수정합니다.

   참고

   위의 설정을 완료한 후 이러한 내보내기를 생성할 수 있습니다.

   [ceph: root@host /]# ceph nfs export info c_ganesha /exp1
   
   {
     "access_type": "RW",
     "clients": [],
     "cluster_id": "c_ganesha",
     "export_id": 1,
     "fsal": {
       "fs_name": "fs1",
       "name": "CEPH",
       "user_id": "nfs.c_ganesha.1"
     },
     "path": "/volumes/_nogroup/exp1/81f9a67e-ddf1-4b5a-9fe0-d87effc7ca16",
     "protocols": [
       4
     ],
     "pseudo": "/exp1",
     "sectype": [
       "krb5"
     ],
     "security_label": true,
     "squash": "none",
     "transports": [
       "TCP"
     ]
   }

프로세스

1. 서비스 주체를 생성합니다.

   kadmin:  addprinc -randkey nfs/<hostname>.ibm.com@PUNE.IBM.COM
   No policy specified for nfs/<hostname>.ibm.com@PUNE.IBM.COM; defaulting to no policy
   Principal "nfs/<hostname>.ibm.com@PUNE.IBM.COM" created.
   kadmin:  ktadd nfs/<hostname>.ibm.com@PUNE.IBM.COM
   Entry for principal nfs/<hostname>.ibm.com@PUNE.IBM.COM with kvno 2, encryption type aes256-cts-hmac-sha384-192 added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com@PUNE.IBM.COM with kvno 2, encryption type aes128-cts-hmac-sha256-128 added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com@PUNE.IBM.COM with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com@PUNE.IBM.COM with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com@PUNE.IBM.COM with kvno 2, encryption type camellia256-cts-cmac added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com@PUNE.IBM.COM with kvno 2, encryption type camellia128-cts-cmac added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com@PUNE.IBM.COM with kvno 2, encryption type arcfour-hmac added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).

2. rpc.gssd 서비스를 다시 시작하여 수정된 키탭 파일을 적용합니다.

   # systemctl restart rpc-gssd

3. NFS 내보내기를 마운트합니다.

   구문

   [root@host ~]# mount -t nfs -o vers=4.1,port=2049 <IP>:/<export_name> >mount_point>

   예제

   mount -t nfs -o vers=4.1,port=2049 10.8.128.233:/ganesha /mnt/test/

4. 사용자를 생성합니다. NFS 내보내기가 마운트되면 일반 사용자가 마운트된 내보내기에서 작업하는 데 사용됩니다. 이러한 일반 사용자(일반적으로 시스템의 로컬 사용자 또는 LDAP/AD와 같은 중앙 집중식 시스템의 사용자)는 Kerberos 설정의 일부여야 합니다. 설정 유형에 따라 KDC에도 로컬 사용자를 생성해야 합니다.