Kerberos guidelines
In order to allow DSE clients to authenticate using Kerberos tickets, ensure that your environment meets the DataStax Enterprise requirements and recommendations to establish DSE as a Service Principal. When DSE Authorizer is also enabled, you can map User Principal (including Realm) to roles for database access control.
|
The Kerberos Tutorial provides step-by-step instructions on establishing client-DSE Kerberos authentication in DataStax Enterprise and OpsCenter. Kerberos is a network authentication protocol designed to provide strong authentication for client/server applications using secret-key cryptography. For information on installing and setting up Kerberos, see the MIT Kerberos Consortium documentation. |
Kerberos guidelines
The following general guidelines apply to setting up Kerberos and configuring DataStax Enterprise as a Kerberos Service Principal:
-
Familiarity with Kerberos and understand how to use these commands:
kinit,klist, andkdestroy. -
Write permission on the cassandra.yaml and dse.yaml files and access to all nodes in the cluster.
-
Ability to restart the cluster after the configuration is complete.
-
Fully operational Kerberos Key Distribution Center (KDC) servers. DataStax recommends using multiple KDC servers, with a single primary or administration KDC server and all others as secondary.
For security purposes, DataStax recommends running the KDC on a secured server outside the DSE cluster. Never install KDC servers on DataStax Enterprise nodes.
-
Proper security for the KDC servers, such as firewalls and physically protecting the KDC machines.
-
Privilege to manage Kerberos principals and export keytab files (or access to a KDC administrator that does).
-
Always secure the DSE keytab files; the DSE service account should own the keytab file and have read/write access (
chmod 600).
-
Configure your operating system to use the latest version of Java 8:
-
Recommended. The latest build of a TCK (Technology Compatibility Kit) Certified OpenJDK version 8. For example, OpenJDK 8 (1.8.0_151 minimum). DataStax’s recommendation changed due to the end of public updates for Oracle JRE/JDK 8. See Oracle Java SE Support Roadmap.
-
Supported. Oracle Java SE 8 (JRE or JDK) (1.8.0_151 minimum)
-
|
When using Kerberos security, be aware of the scope of Kerberos tickets. Using the su or sudo command leaves existing credentials behind and requires you to re-authenticate as that new user. If you encounter authentication issues, ensure that you have a proper Kerberos ticket. |
Using Kerberos with DataStax Enterprise
The following topics provide information on using Kerberos with various DataStax Enterprise features and other software:
-
When using audit logging with Kerberos authentication, the login events take place on Kerberos and are not logged in DataStax Enterprise. Authentication history is available only on Kerberos. When DataStax Enterprise is unable to authenticate a client with Kerberos, a LOGIN_ERROR event is logged, see Enabling data auditing in DataStax Enterprise.
|
DataStax recommends choosing either Kerberos or SSL because of overlap in features, and using it for both encryption and authentication. |
