服务账号：
– 命名：hdfs/hive/yarn等
– 密码：复杂密码
– 定期更换

# 权限规范
最小权限原则：
– 只授予必要权限
– 定期审核权限
– 及时回收权限

# 审计规范
审计日志：
– 保存时间：6个月以上
– 定期备份
– 定期审计

# 2. 配置krb5.conf
cat > /etc/krb5.conf << ‘EOF’
[libdefaults]
default_realm = FGEDU.NET.CN
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true

[realms]
FGEDU.NET.CN = {
kdc = fgedu-kdc01.fgedu.net.cn
kdc = fgedu-kdc02.fgedu.net.cn
admin_server = fgedu-kdc01.fgedu.net.cn
}

[domain_realm]
.fgedu.net.cn = FGEDU.NET.CN
fgedu.net.cn = FGEDU.NET.CN
EOF

# 3. 配置kdc.conf
cat > /var/kerberos/krb5kdc/kdc.conf << ‘EOF’
[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88

[realms]
FGEDU.NET.CN = {
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
}
EOF

# 4. 配置kadm5.acl
cat > /var/kerberos/krb5kdc/kadm5.acl << ‘EOF’
*/admin@FGEDU.NET.CN *
EOF

# 5. 创建Kerberos数据库
kdb5_util create -s -r FGEDU.NET.CN
# 输入密码：fgedu123

# 6. 创建管理员principal
kadmin.local -q “addprinc admin/admin”
# 输入密码：fgedu123

# 7. 启动Kerberos
systemctl start krb5kdc
systemctl start kadmin
systemctl enable krb5kdc
systemctl enable kadmin

# 8. 创建服务principal
kadmin.local -q “addprinc -randkey hdfs/fgedu-nn@FGEDU.NET.CN”
kadmin.local -q “addprinc -randkey yarn/fgedu-rm@FGEDU.NET.CN”
kadmin.local -q “addprinc -randkey hive/fgedu-hs2@FGEDU.NET.CN”
kadmin.local -q “addprinc -randkey HTTP/fgedu-nn@FGEDU.NET.CN”

# 9. 创建keytab
kadmin.local -q “xst -k hdfs.keytab hdfs/fgedu-nn”
kadmin.local -q “xst -k yarn.keytab yarn/fgedu-rm”
kadmin.local -q “xst -k hive.keytab hive/fgedu-hs2”
kadmin.local -q “xst -k HTTP.keytab HTTP/fgedu-nn”

# 10. 验证keytab
kinit -kt hdfs.keytab hdfs/fgedu-nn@FGEDU.NET.CN
klist

# 2. 创建数据库
mysql -u root -p
CREATE DATABASE ranger DEFAULT CHARACTER SET utf8;
CREATE USER ‘ranger’@’%’ IDENTIFIED BY ‘fgedu123’;
GRANT ALL PRIVILEGES ON ranger.* TO ‘ranger’@’%’;
FLUSH PRIVILEGES;

# 3. 配置install.properties
cd /bigdata/app/ranger-admin
vi install.properties

# 关键配置
db_root_user=root
db_root_password=fgedu123
db_host=fgedu-mysql
db_name=ranger
db_user=ranger
db_password=fgedu123
rangerAdmin_host=fgedu-ranger01
rangerAdmin_httpPort=6080
rangerAdmin_httpsPort=6182

# 4. 安装Ranger Admin
./setup.sh

# 5. 启动Ranger Admin
ranger-admin start

# 6. 访问Ranger
# http://fgedu-ranger01:6080
# 默认用户名: admin
# 默认密码: admin

# 7. 安装Ranger HDFS Plugin
cd /bigdata/app
wget https://archive.apache.org/dist/ranger/2.4.0/ranger-2.4.0-hdfs-plugin.tar.gz
tar -zxvf ranger-2.4.0-hdfs-plugin.tar.gz
ln -s ranger-2.4.0-hdfs-plugin ranger-hdfs-plugin

cd /bigdata/app/ranger-hdfs-plugin
vi install.properties

# 配置
POLICY_MGR_URL=http://fgedu-ranger01:6080
REPOSITORY_NAME=fgedu_hdfs
XAAUDIT.SOLR.ENABLE=false
XAAUDIT.HDFS.ENABLE=true
XAAUDIT.HDFS.HDFS_DIR=hdfs://fgedu-nn:8020/bigdata/fgdata/ranger/audit
HDFS_HOME=/bigdata/app/hadoop
HDFS_CONF_DIR=/bigdata/app/hadoop/etc/hadoop

./enable-hdfs-plugin.sh

# 8. 重启HDFS
su – hdfs
hdfs –daemon stop namenode
hdfs –daemon start namenode
hdfs –daemon stop datanode
hdfs –daemon start datanode

# 9. 在Ranger中创建HDFS Service
# Ranger Web UI
# Access Manager -> Resource Based Policies -> Add New Service
# Service Name: fgedu_hdfs
# Username: hdfs
# NameNode URL: hdfs://fgedu-nn:8020

# 2. 创建数据库
mysql -u root -p
CREATE DATABASE sentry DEFAULT CHARACTER SET utf8;
CREATE USER ‘sentry’@’%’ IDENTIFIED BY ‘fgedu123’;
GRANT ALL PRIVILEGES ON sentry.* TO ‘sentry’@’%’;
FLUSH PRIVILEGES;

# 3. 配置sentry-site.xml
cat > /bigdata/app/sentry/conf/sentry-site.xml << ‘EOF’
<?xml version=”1.0″?>
<configuration>
<property>
<name>sentry.service.client.server.rpc-address</name>
<value>fgedu-sentry01</value>
</property>
<property>
<name>sentry.service.client.server.rpc-port</name>
<value>8038</value>
</property>
<property>
<name>sentry.store.jdbc.url</name>
<value>jdbc:mysql://fgedu-mysql:3306/sentry</value>
</property>
<property>
<name>sentry.store.jdbc.driver</name>
<value>com.mysql.jdbc.Driver</value>
</property>
<property>
<name>sentry.store.jdbc.user</name>
<value>sentry</value>
</property>
<property>
<name>sentry.store.jdbc.password</name>
<value>fgedu123</value>
</property>
<property>
<name>sentry.verify.schema.metrics</name>
<value>false</value>
</property>
</configuration>
EOF

# 4. 初始化数据库
schematool -dbType mysql -initSchema

# 5. 启动Sentry
sentry –daemon start service

# 6. 配置Hive使用Sentry
# 在hive-site.xml中添加
<property>
<name>hive.security.authorization.task.factory</name>
<value>org.apache.sentry.binding.hive.SentryHiveAuthorizationTaskFactoryImpl</value>
</property>
<property>
<name>hive.security.authorization.manager</name>
<value>org.apache.sentry.binding.hive.conf.HiveAuthzConf</value>
</property>
<property>
<name>hive.sentry.conf.url</name>
<value>file:///bigdata/app/sentry/conf/sentry-site.xml</value>
</property>

# 7. 重启Hive
hive –service hiveserver2 stop
hive –service hiveserver2 start

# 8. 使用Sentry授权
# Hive中执行
CREATE ROLE fgedu_analyst;
GRANT ROLE fgedu_analyst TO GROUP fgedu;
GRANT SELECT ON DATABASE fgedu_db TO ROLE fgedu_analyst;