{"id":2683,"date":"2021-03-02T14:49:15","date_gmt":"2021-03-02T06:49:15","guid":{"rendered":"https:\/\/nj.transwarp.cn:8180\/?p=2683"},"modified":"2021-03-17T11:28:11","modified_gmt":"2021-03-17T03:28:11","slug":"%e5%bc%80%e5%90%afkerberos%e5%90%8e%e7%9a%84kinit%e6%93%8d%e4%bd%9c","status":"publish","type":"post","link":"https:\/\/kbwp.transwarp.cn\/?p=2683","title":{"rendered":"\u5f00\u542f kerberos \u540e\u7684 kinit \u64cd\u4f5c"},"content":{"rendered":"

\u6982\u8981\u63cf\u8ff0<\/h3>\n
\n

\u5728\u5f00\u542f\u4e86 Kerberos \u8ba4\u8bc1\u7684\u96c6\u7fa4\u91cc\uff0c\u7528\u6237\u7684 keytab \u53ef\u7528\u4e8e\u8bbf\u95ee\u96c6\u7fa4\u670d\u52a1\u3002\u4e0b\u9762\u7684\u6307\u4ee4\u60a8\u53ef\u4ee5\u5728\u5b89\u88c5\u4e86 Kerberos \u7684\u96c6\u7fa4\u4e2d\u4efb\u610f\u4e00\u53f0\u673a\u5668\u4e0a\u6267\u884c\u3002<\/p>\n

\u8be6\u7ec6\u8bf4\u660e<\/h3>\n
\n

\u6ce8\u610f\u4e8b\u9879\uff1a<\/h4>\n
    \n
  1. \u5728\u80fd\u591f\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u524d\uff0c\u8bf7\u786e\u4fdd\u60a8\u6309\u7167 \u51c6\u5907TDH\u5ba2\u6237\u7aef\u73af\u5883<\/a> \u4e2d\u7684\u6b65\u9aa4\u6b63\u786e\u5b89\u88c5\u4e86TDH-Client\u3002<\/strong><\/li>\n
  2. \u8bf7\u53c2\u8003 Guardian\u65b0\u5efa\u7528\u6237\u3001\u4fee\u6539\u7528\u6237\u5bc6\u7801\u3001\u4e0b\u8f7dkeytab\u53ca\u8d4b\u6743<\/a> \u6765\u83b7\u53d6 keytab \u6587\u4ef6\u3002<\/strong><\/li>\n<\/ol>\n

    \u83b7\u53d6\u8bbf\u95ee\u96c6\u7fa4\u4e2d\u670d\u52a1\u7684\u51ed\u8bc1\uff1akinit<\/h4>\n
      \n
    1. \u4f7f\u7528\u5bc6\u7801\u65b9\u5f0f\uff1a<\/strong><\/li>\n<\/ol>\n
      kinit {your_principal}<\/code><\/pre>\n
      \u5728 {your_principal} \u5904\u63d0\u4f9b\u60a8\u7684 Principal \u5e76\u5728\u7cfb\u7edf\u63d0\u793a\u4e0b\u8f93\u5165\u5bc6\u7801\uff0c\u5373\u53ef\u83b7\u53d6\u4e00\u5f20 ticket\u3002\u5982\u679c\u60a8\u591a\u6b21\u767b\u5f55\u4e86\u4e0d\u540c\u7684 Principal\uff0c\u4ec5\u6700\u540e\u4e00\u6b21\u751f\u6548\uff0c\u4f1a\u8986\u76d6\u4e4b\u524d\u7684\u8ba4\u8bc1\u6743\u9650\u4fe1\u606f\u3002<\/p>\n
      \u4e3e\u4f8b<\/strong>: Alice \u7528\u6237\u83b7\u53d6ticket:<\/p>\n
      [root@tw-node118 ~]# kinit alice@TDH\nPassword for alice@TDH:<\/code><\/pre>\n
      [root@tw-node118 ~]# kinit alice\nPassword for alice:<\/code><\/pre>\n
        \n
      1. \u4f7f\u7528keytab\u6587\u4ef6\uff1a<\/strong><\/li>\n<\/ol>\n
        kinit  -kt  <\/code><\/pre>\n
        \u6ce8\u610f:<\/strong>
        \n{}keytab_path} \u5904\u63d0\u4f9b\u60a8 keytab \u6587\u4ef6\u7684\u8def\u5f84\u3002\u8fd9\u4e2a\u8def\u5f84\u53ef\u4ee5\u662f\u7edd\u5bf9\u8def\u5f84\u4e5f\u53ef\u4ee5\u662f\u76f8\u5bf9\u8def\u5f84<\/strong>\u3002\u4f7f\u7528keytab \u6587\u4ef6\u767b\u5f55\uff0c\u65e0\u9700\u8f93\u5165\u5bc6\u7801\u3002<\/p>\n
        \u4e3e\u4f8b:Alice \u7528\u6237\u901a\u8fc7\u63d0\u4f9b keyta b\u83b7\u53d6 ticket:<\/p>\n
        [root@tw-node118 ~]# kinit alice@TDH -kt \/root\/alice.keytab<\/code><\/pre>\n
        \u67e5\u770b\u51ed\u8bc1: klist<\/h4>\n
        \u8981\u67e5\u770b\u60a8\u5f53\u524d\u7684 session \u662f\u5426\u6709 ticket \u4ee5\u53ca ticket \u7684\u6709\u6548\u671f\uff0c\u60a8\u53ea\u9700\u8981\u5728\u547d\u4ee4\u884c\u6267\u884c klist\u3002<\/p>\n
        \u4e3e\u4f8b:<\/strong>\u5f53\u524dsession\u6ca1\u6709ticket:<\/p>\n
        [root@tw-node118 ~]# klist\nklist: No credentials cache found (ticket cache FILE:\/tmp\/krb5cc_0)<\/code><\/pre>\n
        \u4e3e\u4f8b:<\/strong>\u5f53\u524dsession\u6709ticket:<\/p>\n
        [root@tw-node118 ~]# klist\nTicket cache: FILE:\/tmp\/krb5cc_0\nDefault principal: alice@TDH\nValid starting\nExpires\n11\/26\/15 19:04:19 11\/27\/15 05:04:19\nrenew until 12\/03\/15 19:04:19\nService principal\nkrbtgt\/TDH@TDH<\/code><\/pre>\n
        \u5728\u8fd9\u91cc\u60a8\u53ef\u4ee5\u770b\u5230ticket\u7684\u8fc7\u671f\u65f6\u95f4\uff0c\u5982\u679c\u6839\u636e\u8fd9\u4e2a\u4fe1\u606f\u5f53\u524dsession\u4e2d\u7684 ticket \u5df2\u7ecf\u8fc7\u671f\uff0c\u60a8\u662f\u65e0\u6cd5\u8bbf\u95ee\u670d\u52a1\u7684\u3002\u60a8\u9700\u8981\u4f7f\u7528 kinit \u6307\u4ee4\u91cd\u65b0\u83b7\u53d6 ticket\u3002<\/p>\n
        \u5982\u679c\u4e0d\u786e\u5b9a\u5f53\u524d\u4f7f\u7528\u7684\u662f\u54ea\u4e2aPrincipal<\/strong>\uff0c\u53ef\u4ee5\u7528klist -ket <keytab_path><\/code>\u547d\u4ee4\u6765\u67e5\u770b\uff0c\u5982\uff1a<\/p>\n
        [root@tw-node1 ~]# klist -ket alice.keytab\nKeytab name: FILE:alice.keytab\nKVNO Timestamp           Principal\n---- ------------------- ------------------------------------------------------\n   1 2018-07-06T11:27:36 alice@TDH (des-cbc-md5)\n   1 2018-07-06T11:27:36 alice@TDH (aes256-cts-hmac-sha1-96)\n   1 2018-07-06T11:27:36 alice@TDH (des3-cbc-sha1)\n   1 2018-07-06T11:27:36 alice@TDH (arcfour-hmac)\n   1 2018-07-06T11:27:36 alice@TDH (aes128-cts-hmac-sha1-96)<\/code><\/pre>\n
        \u53ef\u4ee5\u770b\u5230\u5f53\u524dPrincipal\u4e3aalice@TDH\uff0c\u518d\u8fd0\u884c\u4ee5\u4e0b\u547d\u4ee4\u5c31\u53ef\u4ee5\u83b7\u53d6TGT\u4e86\uff1a<\/p>\n
        kinit alice@TDH -kt \/root\/alice.keytab<\/code><\/p>\n
        \u9500\u6bc1\u51ed\u8bc1: kdestroy<\/h4>\n
        \u5f53\u60a8\u7ed3\u675f\u5bf9\u96c6\u7fa4\u670d\u52a1\u7684\u4f7f\u7528,\u53ef\u4ee5\u7528kdestroy\u6307\u4ee4\u624b\u52a8\u9500\u6bc1\u60a8\u7684ticket,\u4ee5\u9632\u522b\u4eba\u6301\u60a8\u7684ticket\u6765\u4f7f\u7528\u60a8\u7684\u6570\u636e\u548c\u5e94\u7528\u3002<\/p>\n
        \u4e3e\u4f8b<\/strong>
        \n\u5f53\u524d\u6709\u7968\u636e:<\/p>\n
        [root@tw-node118 ~]# klist\nTicket cache: FILE:\/tmp\/krb5cc_0\nDefault principal: alice@TDH\nValid starting\nExpires\n11\/26\/15 19:11:31 11\/27\/15 05:11:31\nrenew until 12\/03\/15 19:11:31<\/code><\/pre>\n
        \u9500\u6bc1\u540e:<\/p>\n
        [root@tw-node118 ~]# kdestroy\n[root@tw-node118 ~]# klist\nService principal\nkrbtgt\/TDH@TDH\nklist: No credentials cache found (ticket cache FILE:\/tmp\/krb5cc_0)<\/code><\/pre>\n
        \u5f53\u524dsession\u6ca1\u6709ticket\u8bf4\u660eticket\u5df2\u7ecf\u88ab\u9500\u6bc1\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
        \u6982\u8981\u63cf\u8ff0 \u5728\u5f00\u542f\u4e86 Kerberos \u8ba4\u8bc1\u7684\u96c6\u7fa4\u91cc\uff0c\u7528\u6237\u7684 keytab \u53ef\u7528\u4e8e\u8bbf\u95ee\u96c6\u7fa4\u670d\u52a1\u3002\u4e0b\u9762\u7684\u6307\u4ee4\u60a8\u53ef\u4ee5 ..<\/p>\n
        <\/div>\n
        Read more<\/a><\/p>\n","protected":false},"author":17,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2683","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"acf":[],"_links":{"self":[{"href":"https:\/\/kbwp.transwarp.cn\/index.php?rest_route=\/wp\/v2\/posts\/2683","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kbwp.transwarp.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kbwp.transwarp.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kbwp.transwarp.cn\/index.php?rest_route=\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/kbwp.transwarp.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2683"}],"version-history":[{"count":3,"href":"https:\/\/kbwp.transwarp.cn\/index.php?rest_route=\/wp\/v2\/posts\/2683\/revisions"}],"predecessor-version":[{"id":5504,"href":"https:\/\/kbwp.transwarp.cn\/index.php?rest_route=\/wp\/v2\/posts\/2683\/revisions\/5504"}],"wp:attachment":[{"href":"https:\/\/kbwp.transwarp.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2683"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kbwp.transwarp.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2683"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kbwp.transwarp.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2683"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}