11.14. Kerberos 集成

1. 检查所需 RPM 是否安装在您要设置 KDC 的机器上。

   [root@host ~]# rpm -qa | grep krb5
   
   krb5-libs-1.20.1-9.el9_2.x86_64
   krb5-pkinit-1.20.1-9.el9_2.x86_64
   krb5-server-1.20.1-9.el9_2.x86_64
   krb5-server-ldap-1.20.1-9.el9_2.x86_64
   krb5-devel-1.20.1-9.el9_2.x86_64
   krb5-workstation-1.20.1-9.el9_2.x86_64

   注意
   • 根据 Kerberos REALM 名称，最好使用域名。例如，Realm - PUNE.IBM.COM，管理主体 - admin/admin。
   • 编辑安装的配置文件，以反映新的 KDC。请注意，KDC 可以作为 IP 地址或 DNS 名称提供。

2. 更新 krb5.conf 文件：

   注意

   您需要使用 krb5.conf 文件中的 kdc 和 admin_server IP 更新所有域(default_realm 和 domain_realm)。

   [root@host ~]# cat /etc/krb5.conf
   
   # To opt out of the system crypto-policies configuration of krb5, remove the
   # symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
   
   includedir /etc/krb5.conf.d/
   [logging]
       default = [FILE:/var/log/krb5libs.log](file:///var/log/krb5libs.log)
       kdc = [FILE:/var/log/krb5kdc.log](file:///var/log/krb5kdc.log)
       admin_server = [FILE:/var/log/kadmind.log](file:///var/log/kadmind.log)
   [libdefaults]
       dns_lookup_realm = false
       ticket_lifetime = 24h
       renew_lifetime = 7d
       forwardable = true
       rdns = false
       pkinit_anchors = [FILE:/etc/pki/tls/certs/ca-bundle.crt](file:///etc/pki/tls/certs/ca-bundle.crt)
       spake_preauth_groups = edwards25519
       dns_canonicalize_hostname = fallback
       qualify_shortname = ""
       default_realm = PUNE.IBM.COM
       default_ccache_name = KEYRING:persistent:%{uid}
   [realms]
       PUNE.IBM.COM = {
          kdc = 10.0.210.222:88
          admin_server = 10.0.210.222:749
       }
   [domain_realm]
     .redhat.com = PUNE.IBM.COM
     redhat.com = PUNE.IBM.COM

3. 更新 krb5.conf 文件：

   注意

   您需要更新 kdc.conf 文件中的域。

   [root@host ~]# cat /var/kerberos/krb5kdc/kdc.conf
   
    [kdcdefaults]
    kdc_ports = 88
    kdc_tcp_ports = 88
    spake_preauth_kdc_challenge = edwards25519
   [realms]
      PUNE.IBM.COM = {
         master_key_type = aes256-cts-hmac-sha384-192
         acl_file = /var/kerberos/krb5kdc/kadm5.acl
         dict_file = /usr/share/dict/words
         default_principal_flags = +preauth
         admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
         supported_enctypes = aes256-cts-hmac-sha384-192:normal aes128-cts-hmac-sha256-128:normal aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal camellia256-cts-cmac:normal camellia128-cts-cmac:normal arcfour-hmac-md5:normal
        # Supported encryption types for FIPS mode:
        #supported_enctypes = aes256-cts-hmac-sha384-192:normal aes128-cts-hmac-sha256-128:normal
     }

4. 使用 kdb5_util 创建 KDC 数据库：

   注意

   确保主机名可以通过 DNS 或 /etc/hosts 解析。

   [root@host ~]# kdb5_util create -s -r [PUNE.IBM.COM](http://pune.ibm.com/)
   
   Initializing database '/var/kerberos/krb5kdc/principal' for realm 'PUNE.IBM.COM',
   master key name 'K/M@PUNE.IBM.COM'
   You will be prompted for the database Master Password.
   It is important that you NOT FORGET this password.
   Enter KDC database master key:
   Re-enter KDC database master key to verify:

5. 将管理员添加到 ACL 文件中：

   [root@host ~]# cat /var/kerberos/krb5kdc/kadm5.acl
   
   */admin@PUNE.IBM.COM	*

   输出显示 PUNE.IBM.COM 域中的任何主体都有 admin 实例的所有主体都有所有管理特权。

6. 将管理员添加到 Kerberos 数据库：

   [root@host ~]# kadmin.local
   
   Authenticating as principal root/admin@PUNE.IBM.COM with password.
   kadmin.local:  addprinc admin/admin@PUNE.IBM.COM
   No policy specified for admin/admin@PUNE.IBM.COM; defaulting to no policy
   Enter password for principal "admin/admin@PUNE.IBM.COM":
   Re-enter password for principal "admin/admin@PUNE.IBM.COM":
   Principal "admin/admin@PUNE.IBM.COM" created.
   kadmin.local:

7. 启动 kdc 和 kadmind ：

   # krb5kdc
   # kadmind

流程

1. 检查所需的 RPM

   [root@host ~]# rpm -qa | grep krb5
   
   krb5-libs-1.20.1-9.el9_2.x86_64
   krb5-pkinit-1.20.1-9.el9_2.x86_64
   krb5-workstation-1.20.1-9.el9_2.x86_64

2. 更新与 KDC 服务器上的 krb5.conf 文件类似的文件：

   [root@host ~]# cat /etc/krb5.conf
   
   # To opt out of the system crypto-policies configuration of krb5, remove the
   # symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
   
   includedir /etc/krb5.conf.d/
   [logging]
       default = [FILE:/var/log/krb5libs.log](file:///var/log/krb5libs.log)
       kdc = [FILE:/var/log/krb5kdc.log](file:///var/log/krb5kdc.log)
       admin_server = [FILE:/var/log/kadmind.log](file:///var/log/kadmind.log)
   [libdefaults]
       dns_lookup_realm = false
       ticket_lifetime = 24h
       renew_lifetime = 7d
       forwardable = true
       rdns = false
       pkinit_anchors = [FILE:/etc/pki/tls/certs/ca-bundle.crt](file:///etc/pki/tls/certs/ca-bundle.crt)
       spake_preauth_groups = edwards25519
       dns_canonicalize_hostname = fallback
       qualify_shortname = ""
       default_realm = PUNE.IBM.COM
      default_ccache_name = KEYRING:persistent:%{uid}
   [realms]
     PUNE.IBM.COM = {
        kdc = 10.0.210.222:88
        admin_server = 10.0.210.222:749
     }
   [domain_realm]
     .IBM.com = PUNE.IBM.COM
     IBM.com = PUNE.IBM.COM

流程

1. 为该主机创建服务主体：

   [root@host ~]# kinit admin/admin
   
   Password for admin/admin@PUNE.IBM.COM:
   [root@host ~]# kadmin
   Authenticating as principal admin/admin@PUNE.IBM.COM with password.
   Password for admin/admin@PUNE.IBM.COM:
   kadmin:  addprinc -randkey nfs/<hostname>.ibm.com
   No policy specified for nfs/<hostname>.ibm.com@PUNE.IBM.COM; defaulting to no policy
   Principal "nfs/<hostname>.ibm.com@PUNE.IBM.COM" created.

2. 在 keytab 文件中添加密钥：

   注意

   在这一步中，您已在 NFS 服务器上并使用 kadmin 接口。在这里，keytab 操作反映了 NFS 服务器的 keytab。

   kadmin:  ktadd nfs/<hostname>.ibm.com
   
   Entry for principal nfs/<hostname>.ibm.com with kvno 2, encryption type aes256-cts-hmac-sha384-192 added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com with kvno 2, encryption type aes128-cts-hmac-sha256-128 added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com with kvno 2, encryption type camellia256-cts-cmac added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com with kvno 2, encryption type camellia128-cts-cmac added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com with kvno 2, encryption type arcfour-hmac added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   kadmin:

3. 在运行 NFS Ganesha 容器以及所有 NFS 客户端的所有 Ceph 节点上，运行第 1 和 2 步。

流程

1. 检索现有的 NFS Ganesha 容器配置：

   [ceph: root@host /]# ceph orch ls --service-type nfs --export
   
   service_type: nfs
   service_id: c_ganesha
   service_name: nfs.c_ganesha
   placement:
     hosts:
     - host1
     - host2
     - host3
   spec:
     port: 2049

2. 修改容器配置，以传递 /etc/krb5.conf 和 /etc/krb5.keytab' 文件到主机上的容器。这些文件在运行时由 NFS Ganesha 引用，以验证传入的服务票据并保护 Ganesha 和 NFS 客户端(krb5p)之间的通信。

   [root@host ~]# cat nfs.yaml
   
   service_type: nfs
   service_id: c_ganesha
   service_name: nfs.c_ganesha
   placement:
     hosts:
     - host1
     - host2
     - host3
   spec:
     port: 2049
   extra_container_args:
     - "-v"
     - "/etc/krb5.keytab:/etc/krb5.keytab:ro"
     - "-v"
     - "/etc/krb5.conf:/etc/krb5.conf:ro"

3. 在 cephadm shell 中提供修改后的 nfs.yaml 文件：

   [root@host ~]# cephadm shell --mount nfs.yaml:/var/lib/ceph/nfs.yaml
   
   Inferring fsid ff1c1498-73ec-11ee-af38-fa163e9a17fd
   Inferring config /var/lib/ceph/ff1c1498-73ec-11ee-af38-fa163e9a17fd/mon.ceph-msaini-qp49z7-node1-installer/config
   Using ceph image with id 'fada497f9c5f' and tag 'ceph-7.0-rhel-9-containers-candidate-73711-20231018030025' created on 2023-10-18 03:03:39 +0000 UTC
   registry-proxy.engineering.ibm.com/rh-osbs/rhceph@sha256:e66e5dd79d021f3204a183f5dbe4537d0c0e4b466df3b2cc4d50cc79c0f34d75

4. 验证该文件是否有所需的更改：

   [ceph: root@host /]# cat /var/lib/ceph/nfs.yaml
   
   service_type: nfs
   service_id: c_ganesha
   service_name: nfs.c_ganesha
   placement:
     hosts:
     - host1
     - host2
     - host3
   spec:
     port: 2049
   extra_container_args:
     - "-v"
     - "/etc/krb5.keytab:/etc/krb5.keytab:ro"
     - "-v"
     - "/etc/krb5.conf:/etc/krb5.conf:ro"

5. 将所需的更改应用到 NFS Ganesha 容器并重新部署容器：

   [ceph: root@host /]# ceph orch apply -i /var/lib/ceph/nfs.yaml
   
   Scheduled nfs.c_ganesha update...
   [ceph: root@ceph-msaini-qp49z7-node1-installer /]# ceph orch redeploy nfs.c_ganesha
   Scheduled to redeploy nfs.c_ganesha.1.0.ceph-msaini-qp49z7-node1-installer.sxzuts on host 'ceph-msaini-qp49z7-node1-installer'
   Scheduled to redeploy nfs.c_ganesha.2.0.ceph-msaini-qp49z7-node2.psuvki on host 'ceph-msaini-qp49z7-node2'
   Scheduled to redeploy nfs.c_ganesha.0.0.ceph-msaini-qp49z7-node3.qizzvk on host 'ceph-msaini-qp49z7-node3'

6. 验证重新部署的服务是否有所需的更改：

   [ceph: root@host /]# ceph orch ls --service-type nfs --export
   
   service_type: nfs
   service_id: c_ganesha
   service_name: nfs.c_ganesha
   placement:
     hosts:
     - ceph-msaini-qp49z7-node1-installer
     - ceph-msaini-qp49z7-node2
     - ceph-msaini-qp49z7-node3
   extra_container_args:
   - -v
   - /etc/krb5.keytab:/etc/krb5.keytab:ro
   - -v
   - /etc/krb5.conf:/etc/krb5.conf:ro
   spec:
     port: 2049

7. 将导出定义修改为具有 krb5*(krb5、krb5i、krb5p) 安全类型：

   注意

   在完成上述设置后，您可以创建这样的导出。

   [ceph: root@host /]# ceph nfs export info c_ganesha /exp1
   
   {
     "access_type": "RW",
     "clients": [],
     "cluster_id": "c_ganesha",
     "export_id": 1,
     "fsal": {
       "fs_name": "fs1",
       "name": "CEPH",
       "user_id": "nfs.c_ganesha.1"
     },
     "path": "/volumes/_nogroup/exp1/81f9a67e-ddf1-4b5a-9fe0-d87effc7ca16",
     "protocols": [
       4
     ],
     "pseudo": "/exp1",
     "sectype": [
       "krb5"
     ],
     "security_label": true,
     "squash": "none",
     "transports": [
       "TCP"
     ]
   }

流程

1. 创建服务主体：

   kadmin:  addprinc -randkey nfs/<hostname>.ibm.com@PUNE.IBM.COM
   No policy specified for nfs/<hostname>.ibm.com@PUNE.IBM.COM; defaulting to no policy
   Principal "nfs/<hostname>.ibm.com@PUNE.IBM.COM" created.
   kadmin:  ktadd nfs/<hostname>.ibm.com@PUNE.IBM.COM
   Entry for principal nfs/<hostname>.ibm.com@PUNE.IBM.COM with kvno 2, encryption type aes256-cts-hmac-sha384-192 added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com@PUNE.IBM.COM with kvno 2, encryption type aes128-cts-hmac-sha256-128 added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com@PUNE.IBM.COM with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com@PUNE.IBM.COM with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com@PUNE.IBM.COM with kvno 2, encryption type camellia256-cts-cmac added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com@PUNE.IBM.COM with kvno 2, encryption type camellia128-cts-cmac added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).
   Entry for principal nfs/<hostname>.ibm.com@PUNE.IBM.COM with kvno 2, encryption type arcfour-hmac added to keytab [FILE:/etc/krb5.keytab](file:///etc/krb5.keytab).

2. 重启 rpc.gssd 服务，使修改/新的 keytab 文件生效：

   # systemctl restart rpc-gssd

3. 挂载 NFS 导出：

   语法

   [root@host ~]# mount -t nfs -o vers=4.1,port=2049 <IP>:/<export_name> >mount_point>

   Example

   mount -t nfs -o vers=4.1,port=2049 10.8.128.233:/ganesha /mnt/test/

4. 创建用户。挂载 NFS 导出后，常规用户将用于处理挂载的导出。这些常规用户（通常是系统上的本地用户，或者来自 LDAP/AD 等集中式系统的用户）需要是 Kerberos 设置的一部分。根据设置类型，还需要在 KDC 中创建本地用户。