1

I do hbase+kerberos for safety verification on linux RHEL7,There one error show when i use zookeeper client server by command "zkCli.sh -server master":

...... mechanism level server not found in kerberos database (7) - unknown_server......

Here is Detail logs

Hbase Hmaster and RegionServer can not work by this error. I have checked all my kerberos and zookeeper configs,i do not know why this error occur.

Community
  • 1
  • 1
lin.qin
  • 11
  • 1
  • 2
  • (1).hosts has added. – lin.qin Jul 28 '17 at 06:42
  • (2).add jvmflags:Dsun.net.spi.nameService.provider = dns,sun can not resolve this error. – lin.qin Jul 28 '17 at 06:45
  • links get broken, please edit your post and add the logs to your question. – Tavo Jul 28 '17 at 06:50
  • 1
    Kerberos expects *canonical DNS names* by default (can be spoofed via `/etc/hosts`, can be relaxed with some Krb config) -- what happens when you `nslookup master` then reverse-lookup the IP given? – Samson Scharfrichter Jul 28 '17 at 07:42
  • 1
    Did you properly specify the rules that Kerberos must use to map a server to a realm, in `/etc/krb5.conf`? It's usually based on DNS domain, but since `master` has no domain you have to define per-server rules – Samson Scharfrichter Jul 28 '17 at 07:46
  • 1
    Recommended reading: the GitBook _Hadoop and Kerberos, the Madness beyond the Gate_, sections "Errors to fear" and "Low-level secrets" (for debug trace flags) – Samson Scharfrichter Jul 28 '17 at 07:49
  • @Samson Scharfrichter Thanks for uper answer,It is ok when i run command nslookup master.I think the krb5.conf is ok,because run kinit for the tgt successful. – lin.qin Jul 31 '17 at 01:05
  • `kinit` creates a TGT as proof of your authentication. But the ZK client lib needs to create a **service ticket** valid for a **specific ZK server** -- that's where DNS is involved *(to avoid man-in-the-middle attacks and so on)* – Samson Scharfrichter Jul 31 '17 at 06:32

0 Answers0