Preparing DSE nodes for Kerberos

Use these instructions as guidelines for installing the Kerberos client libraries on DSE nodes, verifying DNS entry, and system time settings. Each node in your cluster requires DNS to be working properly, NTP to be enabled and the system time synchronized, and the Kerberos client libraries installed.

Do not upgrade DataStax Enterprise and set up Kerberos at the same time; see Upgrade restrictions and limitations.


Complete the following prerequisites:

  • Each node has a DNS entry that resolves the hostname to the correct IP address

  • Each node uses NTP for the system time

  • All KDS requirements have been met, see Kerberos guidelines.

  • Configure your operating system to use the latest version of Java 8:

  • Each node has the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files are enabled, see Enabling JCE Unlimited.

    If you are not using the JCE Unlimited Strength Jurisdiction Policy, make sure that your ticket granting principal does not use AES-256.


  1. Verify the DNS resolves hostname and NTP settings on each node:

    1. For Kerberos the hostname is used for the Service Principal name, therefore the hostname must resolve to the correct IP address. To verify:

      nslookup $(hostname --fqdn) && hostname --fqdn && hostname -i

    2. Kerberos authentication is sensitive to system time, manually set system clocks may cause issues. On each node, confirm that NTP is configured and running:

      ntpq -p
      remote           refid            st t when poll reach   delay   offset  jitter
      *li506-17.member   2  u 331 1024  377   80.289    1.384   1.842   2  u 410 1024  377   53.812    1.706  34.692
      +time01.muskegon      2  u 402 1024  377   59.378   -1.635   1.840 .ACTS.           1  u 746 1024  151  132.832   26.931  55.018
      +golem.canonical    2  u 994 1024  377  144.080   -1.732  20.072
  2. On each node, install Kerberos:

    • RHEL-based systems:

      sudo yum install krb5-workstation krb5-libs krb5-pkinit-openssl
    • Debian-based systems:

      sudo apt-get install krb5-user krb5-config krb5-pkinit
  3. Your the krb5.conf for your REALM in the /etc directory on each DataStax Enterprise node.

    The krb5.conf file contains Realm configuration required by Kerberos, see MIT Kerberos krb5.conf documentation. DataStax recommends not using DNS lookup for KDC, and REALM entries. Relying on DNS may negative impact performance and functionality. Verify that the libdefaults section contains the following entries.

    dns_lookup_kdc = false
    dns_lookup_realm = false
  4. On the Key Distribution Center (KDC) server, create a Service Principal and keytab for each node:

    1. Add a DSE Service Principal and HTTP Principal for each node using the kadmin command:

      kadmin -p user_name/admin
      addprinc -randkey service_name/FQDN
      addprinc -randkey HTTP/FQDN
      Parameter Description


      Launch Kerberos admin shell with an administrator account that has add privileges.


      Creates a new service principal for each DSE node.


      Service name is dse.


      The fully qualified domain name of the DSE node.


      Sets the key of the principal to a random value.

      For more details on using kadmin, see the kadmin help.


      kadmin -p kadmin/admin
      kadmin: addprinc -randkey dse/
      kadmin: addprinc -randkey HTTP/
      kadmin: addprinc -randkey dse/
      kadmin: addprinc -randkey HTTP/
    2. Verify that the principals have been added by running the listprincs command within kadmin:

      kadmin: listprincs

      where node* is the FQDN and EXAMPLE.COM is your Kerberos realm, which must be all uppercase.

    3. Create a keytab file for each node and add the principals keys for each node:

      kadmin: ktadd -k keytabfilename dse/FQDN
      kadmin: ktadd -k keytabfilename HTTP/FQDN

      where ktadd -k creates or appends a key for the DSE service and HTTP principals.


      kadmin: ktadd -k /tmp/node1.keytab dse/
      kadmin: ktadd -k /tmp/node1.keytab HTTP/node1.example.oom
      kadmin: ktadd -k /tmp/node2.keytab dse/
      kadmin: ktadd -k /tmp/node2.keytab HTTP/
    4. Use the klist command to view your principals in each keytab file:

      For example:

      sudo klist -e -kt /tmp/node1.keytab
      Keytab name: FILE:/tmp/node1.keytab
      KVNO Timestamp        Principal
      ---- ---------------- ----------------------------------------------
      2    14/02/16 22:03   HTTP/node1FQDN@YOUR_REALM (des3-cbc-sha1)
      2    14/02/16 22:03   HTTP/node1FQDN@YOUR_REALM (arcfour-hmac)
      2    14/02/16 22:03   HTTP/node1FQDN@YOUR_REALM (des-hmac-sha1)
      2    14/02/16 22:03   HTTP/node1FQDN@YOUR_REALM (des-cbc-md5)
      2    14/02/16 22:03   dse/node1FQDN@YOUR_REALM (des3-cbc-sha1)
      2    14/02/16 22:03   dse/node1FQDN@YOUR_REALM (arcfour-hmac)
      2    14/02/16 22:03   dse/node1FQDN@YOUR_REALM (des-hmac-sha1)
      2    14/02/16 22:03   dse/node1FQDN@YOUR_REALM (des-cbc-md5)

      where: -e displays the encryption type and -kt displays the keytab file and its timestamp.

    5. Distribute keytab files from the KDC server to the nodes, to ease DSE Kerberos configuration ensure the files have the same name on each node:

      scp /tmp/node1.keytab node_admin@node_hostname:/etc/dse/dse.keytab
    6. Change the permissions on dse.keytab so that only the dse_service_account user can read and write to the keytab file:

      sudo chown dse:dse /etc/dse/dse.keytab && sudo chmod 600 /etc/dse/dse.keytab

Was this helpful?

Give Feedback

How can we improve the documentation?

© 2024 DataStax | Privacy policy | Terms of use

Apache, Apache Cassandra, Cassandra, Apache Tomcat, Tomcat, Apache Lucene, Apache Solr, Apache Hadoop, Hadoop, Apache Pulsar, Pulsar, Apache Spark, Spark, Apache TinkerPop, TinkerPop, Apache Kafka and Kafka are either registered trademarks or trademarks of the Apache Software Foundation or its subsidiaries in Canada, the United States and/or other countries. Kubernetes is the registered trademark of the Linux Foundation.

General Inquiries: +1 (650) 389-6000,