[Linux] Kerberos Server Replication

Kerberos는 fault tolerance를 위해 replication을 제공함.

master-slave(s)로 구성되며,

평소에는 master에서 다 처리하고 주기적으로 master의 db를 slave(s)에 sync하는 방식으로 유지되다가,

master가 죽으면 slave가 처리하는 방식.

가정

1. 서버는 master(kdc1.bloodguy.com), slave(kdc2.bloodguy.com)로 구성.

2. hostname은 bloodguy.com이며 realm은 BLOODGUY.COM

3. centos 기준

설치 (kdc1, kdc2 전부)

[root@kdc1]# yum krb5-server krb5-libs krb5-workstation

[root@kdc2]# yum krb5-server krb5-libs krb5-workstation

설정

/etc/krb5.conf

master-slave 구성을 위해 kdc를 2개 지정함

[logging]

 default = FILE:/var/log/krb5libs.log

 kdc = FILE:/var/log/krb5kdc.log

 admin_server = FILE:/var/log/kadmind.log

[libdefaults]

 default_realm = BLOODGUY.COM

 dns_lookup_realm = false

 dns_lookup_kdc = false

 ticket_lifetime = 24h

 renew_lifetime = 7d

 forwardable = true

[realms]

 BLOODGUY.COM = {

  kdc = kdc1.bloodguy.com:88

  kdc = kdc2.bloodguy.com:88

  admin_server = kdc1.bloodguy.com:749

  default_domain = bloodguy.com

 }

[domain_realm]

 .bloodguy.com = BLOODGUY.COM

 bloodguy.com = BLOODGUY.COM

/var/kerberos/krb5kdc/kdc.conf

[kdcdefaults]

 kdc_ports = 88

 kdc_tcp_ports = 88

[realms]

 BLOODGUY.COM = {

  acl_file = /var/kerberos/krb5kdc/kadm5.acl

  dict_file = /usr/share/dict/words

  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab

  supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal des-cbc-crc:v4 des-cbc-crc:afs3

 }

Database 생성

[root@kdc1]# /usr/kerberos/sbin/kdb5_util create -s

// 비번 입력

// principal, principal.kadm5, principal.kadm5.lock, principal.ok, .k5.BLOODGUY.COM 파일 생성 확인

KDC ACL 세팅

/var/kerberos/krb5kdc/kadm5.acl 아래처럼 수정

*/admin@BLOODGUY.COM  *

kadmin 시작

[root@kdc1]# service kadmin start

최초 관리자 생성

[root@kdc1]# /usr/kerberos/sbin/kadmin.local -q "addprinc admin/admin"

// krb5kdc 시작

[root@kdc1]# service krb5kdc start

테스트

// kadmin

[root@kdc1]# /usr/kerberos/sbin/kadmin 

// principal 추가

kadmin: addprinc bloodguy/bloodguy.com@BLOODGUY.COM

// 비번 입력

WARNING: no policy specified for bloodguy/bloodguy.com@BLOODGUY.COM; defaulting to no policy

Enter password for principal "bloodguy/bloodguy.com@BLOODGUY.COM": 

Re-enter password for principal "bloodguy/bloodguy.com@BLOODGUY.COM": 

Principal "bloodguy/bloodguy.com@BLOODGUY.COM" created.

// 추가된 principal 확인

kadmin: listprincs

...

...

bloodguy/bloodguy.com@BLOODGUY.COM

kadmin: quit

// 인증 테스트

[root@kdc1]# /usr/kerberos/bin/kinit bloodguy/bloodguy.com

// 비번 입력

Password for bloodguy/bloodguy.com@BLOODGUY.COM: 

// 티켓 확인

[root@kdc1]# /usr/kerberos/bin/klist

Ticket cache: FILE:/tmp/krb5cc_0

Default principal: bloodguy/bloodguy.com@BLOODGUY.COM

Valid starting     Expires            Service principal

04/17/15 14:59:54  04/18/15 14:59:54  krbtgt/BLOODGUY.COM@BLOODGUY.COM

// 티켓 삭제

[root@kdc1]# /usr/kerberos/bin/kdestroy

[root@kdc1]# /usr/kerberos/bin/klist

klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_0)

Replication

이제부턴 경로를 생략하고 바로 실행파일명으로 함..귀찮음.

// host principal 생성 

[root@kdc1]# kadmin

kadmin: addprinc -randkey host/kdc1.bloodguy.com

kadmin: addprinc -randkey host/kdc2.bloodguy.com

// keytab

kadmin: ktadd host/kdc1.bloodguy.com

kadmin: ktadd host/kdc2.bloodguy.com

kadmin: quit

// keytab 복사 master -> slave

[root@kdc1]# scp /etc/krb5.keytab root@kdc2.bloodguy.com:/etc

// 각종 설정파일 복사 master -> slave

[root@kdc1]# scp /etc/krb5.conf root@kdc2.bloodguy.com:/etc

[root@kdc1]# scp /var/kerberos/krb5kdc/kdc.conf root@kdc2.bloodguy.com:/var/kerberos/krb5kdc

[root@kdc1]# scp /var/kerberos/krb5kdc/kadm5.acl root@kdc2.bloodguy.com:/var/kerberos/krb5kdc

[root@kdc1]# scp /var/kerberos/krb5kdc/.k5.BLOODGUY.COM root@kdc2.bloodguy.com:/var/kerberos/krb5kdc

// slave KDC에서 /var/kerberos/krb5kdc/kpropd.acl 파일을 만들고 아래 내용 입력 후 저장

host/kdc1.bloodguy.com@BLOODGUY.COM

host/kdc2.bloodguy.com@BLOODGUY.COM

// slave에서 kpropd 시작

[root@kdc2]# service kprop start

// db dump

[root@kdc1]# kdb5_util dump /var/kerberos/krb5kdc/slave_datatrans

// slave_datatrans, slave_datatrans.dump_ok 파일 존재여부 확인

// master -> slave db propagate

[root@kdc1]# kprop -f /var/kerberos/krb5kdc/slave_datatrans kdc2.bloodguy.com

Database propagation to kdc2.bloodguy.com: SUCCEEDED

// slave에서 propagation 결과확인

// /var/kerberos/krb5kdc 디렉토리에 principal 관련 파일들과 from_master라는 파일이 있어야 함.

// slave의 krb5kdc 시작

[root@kdc2]# service krb5kdc start

failover 테스트

// master kdc stop

[root@kdc1]# service krb5kdc stop

// kinit 테스트

[root@kdc1]# kinit bloodguy/bloodguy.com

Password for bloodguy/bloodguy.com@BLOODGUY.COM:

// slave인 kdc2.bloodguy.com의 krb5kdc를 통해 성공함.

// kdc2.bloodguy.com의 /var/log/krb5kdc.log 보면 아래와 같은 인증성공 로그를 확인 가능.

Apr 17 15:11:34 kdc2.bloodguy.com krb5kdc[6458](info): AS_REQ (12 etypes {18 17 16 23 1 3 2 11 10 15 12 13}) 111.111.111.111: ISSUE: authtime 1429251094, etypes {rep=18 tkt=18 ses=18}, admin/bloodguy.com@BLOODGUY.COM for krbtgt/BLOODGUY.COM@BLOODGUY.COM

주기적인 db propagation을 위해 스크립트를 하나 만듬. 

/var/kerberos/krb5kdc/repl.sh

#!/bin/sh

kdclist="kdc2.bloodguy.com"

/usr/kerberos/sbin/kdb5_util dump /var/kerberos/krb5kdc/slave_datatrans

for kdc in $kdclist
do
    /usr/kerberos/sbin/kprop -f /var/kerberos/krb5kdc/slave_datatrans $kdc
done

실행권한을 주고

[root@kdc1]# chmod 0755 /var/kerberos/krb5kdc/repl.sh

crontab에 아래처럼 등록. 5분에 한 번씩 master-slave db sync

*/5 * * * * /var/kerberos/krb5kdc/repl.sh

Kerberos Replication 구성 완료.