23.07.2014 Views

Lustre 1.6 Operations Manual

Lustre 1.6 Operations Manual

Lustre 1.6 Operations Manual

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

. Install the keytab.<br />

Note – There is only one security context for each client-OST pair, shared by all<br />

users on the client. This protects data written by one user to be passed to an OST by<br />

another user due to asynchronous bulk I/O. The client-OST connection only<br />

guarantees message integrity or privacy; it does not authenticate users.<br />

5. Configure the MDS nodes. For each MDT node, create a lustre_mds principal,<br />

and generate and install the keytab.<br />

kadmin> addprinc -randkey lustre_mds/mdthost.domain@REALM<br />

kadmin> ktadd -e aes128-cts:normal<br />

lustre_mds/mdthost.domain@REALM<br />

6. Configure the OSS nodes. For each OST node, create a lustre_oss principal,<br />

and generate and install the keytab.<br />

kadmin> addprinc -randkey lustre_oss/oss_host.domain@REALM<br />

kadmin> ktadd -e aes128-cts:normal<br />

lustre_oss/oss_host.domain@REALM<br />

To save the trouble of assigning a unique keytab for each client node, create a<br />

general lustre_root principal and its keytab, and then install the keytab on as many<br />

client nodes as needed.<br />

kadmin> addprinc -randkey lustre_root@REALM<br />

kadmin> ktadd -e aes128-cts:normal lustre_root@REALM<br />

Note – If one client is compromised, all client nodes become insecure.<br />

For more detailed information on installing and configuring Kerberos, see:<br />

http://web.mit.edu/Kerberos/krb5-<strong>1.6</strong>/#documentation<br />

Chapter 11 Kerberos 11-7

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!