Lustre 1.6 Operations Manual

11.2 Lustre Setup with Kerberos
Setting up Lustre with Kerberos can provide advanced security protections for the
Lustre network. Broadly, Kerberos offers three types of benefit:
■
■
■
Allows Lustre connection peers (MDS, OSS and clients) to authenticate one
another.
Protects the integrity of the PTLRPC message from being modified during
network transfer.
Protects the privacy of the PTLRPC message from being eavesdropped during
network transfer.
Kerberos uses the “kernel keyring” client upcall mechanism.
11.2.1 Configuring Kerberos for Lustre
This section describes supported Kerberos distributions and how to set up and
configure Kerberos on Lustre.
11.2.1.1 Kerberos Distributions Supported on Lustre
Lustre supports the following Kerberos distributions:
■
■
■
■
MIT Kerberos 1.3.x
MIT Kerberos 1.4.x
MIT Kerberos 1.5.x
MIT Kerberos 1.6 (not yet verified)
On a number of operating systems, the Kerberos RPMs are installed when the
operating system is first installed. To determine if Kerberos RPMs are installed on
your OS, run:
# rpm -qa | grep krb
If Kerberos is installed, the command returns a list like this:
krb5-devel-1.4.3-5.1
krb5-libs-1.4.3-5.1
krb5-workstation-1.4.3-5.1
pam_krb5-2.2.6-2.2
11-2 Lustre 1.6 Operations Manual • September 2008