23.07.2014 Views

Lustre 1.6 Operations Manual

Lustre 1.6 Operations Manual

Lustre 1.6 Operations Manual

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

11.2.1.3 Configuring <strong>Lustre</strong> for Kerberos<br />

To configure <strong>Lustre</strong> for Kerberos:<br />

1. Configure the client nodes.<br />

a. For each client node, create a lustre_root principal and generate the keytab.<br />

kadmin> addprinc -randkey lustre_root/client_host.domain@REALM<br />

kadmin> ktadd -e aes128-cts:normal \<br />

lustre_root/client_host.domain@REALM<br />

b. Install the keytab on the client node.<br />

Note – For each client-OST pair, there is only one security context, shared by all<br />

users on the client. This protects data written by one user to be passed to an OST by<br />

another user due to asynchronous bulk I/O. The client-OST connection only<br />

guarantees message integrity or privacy; it does not authenticate users.<br />

2. Configure the MDS nodes.<br />

a. For each MDS node, create a lustre_mds principal and generate the keytab.<br />

kadmin> addprinc -randkey lustre_mds/mdthost.domain@REALM<br />

kadmin> ktadd -e aes128-cts:normal lustre_mds/mdthost.domain@REALM<br />

b. Install the keytabl on the MDS node.<br />

3. Configure the OSS nodes.<br />

a. For each OSS node, create a lustre_oss principal and generate the keytab.<br />

kadmin> addprinc -randkey lustre_oss/osthost.domain@REALM<br />

kadmin> ktadd -e aes128-cts:normal lustre_oss/osshost.domain@REALM<br />

b. Install the keytab on the OSS node.<br />

Tip – To avoid assigning a unique keytab to each client node, create a general<br />

lustre_root principal and keytab, and install the keytab on as many client nodes as<br />

needed.<br />

kadmin> addprinc -randkey lustre_root@REALM<br />

kadmin> ktadd -e aes128-cts:normal lustre_root@REALM<br />

Remember that if you use a general keytab, then one compromised client means that<br />

all client nodes are insecure.<br />

11-4 <strong>Lustre</strong> <strong>1.6</strong> <strong>Operations</strong> <strong>Manual</strong> • September 2008

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!