Kerberos認證(Elasticsearch)
一、Kerberos認證
1. 命令
A. kadmin.local:登錄客戶端,非kadmin節點需要用輸入密碼驗證,輸入exit可退出;
B. addprinc:添加principal服務主體,需要輸入密碼,如addprinc HTTP/es.domain;
C. ktadd:為principal生成key.tab,如ktadd -norandkey -kt /opt/elasticsearch/packages/config/es.keytab HTTP/es.domain@RHXY.COM;
D. klist:查看當前用戶認證信息;
E. list_principals:查看principal命令;
F. delete_principal:刪除principal,如delete_principal HTTP/es.domain;
G. kinit:認證某個服務主體,如: kinit HTTP/es@RZX.COM -kt /opt/elasticsearch/packages/config/es.keytab
二、Elasticsearch集成Kerberos認證
效果圖:


可參考:elasticsearch添加kerberos認證完整操作流程
三、Nginx代理服務進行配置kerberos認證
1. 下載GSSAPI模塊:https://github.com/stnoonan/spnego-http-auth-nginx-module.git
2. 執行nginx編譯:./configure --prefix=/opt/nginx --with-http_stub_status_module --with-http_ssl_module --add-module=./spnego-http-auth-nginx-module-main
3. Nginx配置:
server { listen 8010; server_name wz01; auth_gss on; auth_gss_keytab /opt/nginx/conf/nginx.keytab; auth_gss_realm RHXY.COM; auth_gss_service_name HTTP;
location / {
proxy_pass http://127.0.0.1:9200
} }
四、Redis配置Kerberos認證

浙公網安備 33010602011771號