kerberos 无法renew ticket

i1zhuxian

配置文件如下：

[Bash shell] 纯文本查看 复制代码

[iyunv@hadoop5 log]# cat /etc/krb5.conf 
[logging]
  default = FILE:/var/log/krb5libs.log
  kdc = FILE:/var/log/krb5kdc.log
  admin_server = FILE:/var/log/kadmind.log

[libdefaults]
  default_realm = ATM.COM
  dns_lookup_realm = false
  dns_lookup_kdc = false
  ticket_lifetime = 24h
  renew_lifetime = 7d
  forwardable = true

[realms]
  ATM.COM = { 
  kdc = hadoop5
  admin_server = hadoop5
}

[domain_realm]
hadoop5 = ATM.COM
hadoop4 = ATM.COM
hadoop3 = ATM.COM
hadoop2 = ATM.COM

[AppleScript] 纯文本查看 复制代码

[iyunv@hadoop5 log]# cat /var/kerberos/krb5kdc/kdc.conf 
[kdcdefaults]
  kdc_ports = 88
  kdc_tcp_ports = 88

[realms]
  ATM.COM = {
  #master_key_type = aes256-cts
  max_renewable_life = 7d 0h 0m 0s
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  supported_enctypes = aes128-cts:normal  des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal  des-cbc-md5:normal des-cbc-crc:normal
  default_principal_flags = +renewable, +forwardable

 } 

[iyunv@hadoop5 log]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: xiaoyu@ATM.COM

Valid starting     Expires            Service principal
05/26/16 19:19:32  05/27/16 19:19:32  krbtgt/ATM.COM@ATM.COM
        renew until 05/26/16 19:19:32

安装的版本如下：
[iyunv@hadoop5 log]# rpm -qa | grep krb
krb5-auth-dialog-0.13-5.el6.x86_64
krb5-workstation-1.10.3-57.el6.x86_64
krb5-server-1.10.3-57.el6.x86_64
krb5-devel-1.10.3-57.el6.x86_64
krb5-libs-1.10.3-57.el6.x86_64


java的话并没有安装JCE POLICY FILE
这个无法renew的问题要如何解决呢？日志的话 也没看到什么。日志如下：

[AppleScript] 纯文本查看 复制代码

May 26 19:10:47 hadoop5 krb5kdc[22669](info): setting up network...
May 26 19:10:47 hadoop5 krb5kdc[22669](info): listening on fd 7: udp 0.0.0.0.88 (pktinfo)
krb5kdc: setsockopt(8,IPV6_V6ONLY,1) worked
krb5kdc: ????? - Cannot request packet info for udp socket address :: port 88
May 26 19:10:47 hadoop5 krb5kdc[22669](info): skipping unrecognized local address family 17
May 26 19:10:47 hadoop5 krb5kdc[22669](info): skipping unrecognized local address family 17
krb5kdc: setsockopt(8,IPV6_V6ONLY,1) worked
May 26 19:10:47 hadoop5 krb5kdc[22669](info): listening on fd 8: udp fe80::f816:3eff:fe71:8317%eth0.88
krb5kdc: setsockopt(9,IPV6_V6ONLY,1) worked
May 26 19:10:47 hadoop5 krb5kdc[22669](info): listening on fd 10: tcp 0.0.0.0.88
May 26 19:10:47 hadoop5 krb5kdc[22669](info): listening on fd 9: tcp ::.88
May 26 19:10:47 hadoop5 krb5kdc[22669](info): set up 4 sockets
May 26 19:10:47 hadoop5 krb5kdc[22670](info): commencing operation
May 26 19:10:52 hadoop5 krb5kdc[22670](info): AS_REQ (4 etypes {18 17 16 23}) 172.16.0.18: ISSUE: authtime 1464261052, etypes {rep=17 tkt=17 ses=17}, [url=mailto:xiaoyu@ATM.COM]xiaoyu@ATM.COM[/url] for krbtgt/ATM.COM@ATM.COM
May 26 19:17:59 hadoop5 krb5kdc[22670](info): AS_REQ (4 etypes {18 17 16 23}) 172.16.0.18: ISSUE: authtime 1464261479, etypes {rep=17 tkt=17 ses=17}, [url=mailto:xiaoyu@ATM.COM]xiaoyu@ATM.COM[/url] for krbtgt/ATM.COM@ATM.COM
May 26 19:18:17 hadoop5 krb5kdc[22670](info): AS_REQ (4 etypes {18 17 16 23}) 172.16.0.18: ISSUE: authtime 1464261497, etypes {rep=17 tkt=17 ses=17}, [url=mailto:xiaoyu@ATM.COM]xiaoyu@ATM.COM[/url] for krbtgt/ATM.COM@ATM.COM
May 26 19:19:32 hadoop5 krb5kdc[22670](info): AS_REQ (4 etypes {18 17 16 23}) 172.16.0.18: ISSUE: authtime 1464261572, etypes {rep=17 tkt=17 ses=17}, [url=mailto:xiaoyu@ATM.COM]xiaoyu@ATM.COM[/url] for krbtgt/ATM.COM@ATM.COM

i1zhuxian

额 问题解决了，之前为了省事，没有安装JCE，使用的是aes128-cts-hmac-sha1-96，后来重新配置kerberos时，安装了JCE 使用aes256-cts-hmac-sha1-96，可以正常renew kerberos ticket了。