Steps to set up a Kerberos Key Distribution Center (KDC) server on a Red Hat Enterprise Linux host for use with Greenplum Database.

1. Install the Kerberos server packages:

   sudo yum install krb5-libs krb5-server krb5-workstation

2. Edit the /etc/krb5.conf configuration file. The following example shows a Kerberos server with a default KRB.GREENPLUM.COM realm.

   [logging]
    default = FILE:/var/log/krb5libs.log
    kdc = FILE:/var/log/krb5kdc.log
    admin_server = FILE:/var/log/kadmind.log
   
   [libdefaults]
    default_realm = KRB.GREENPLUM.COM
    dns_lookup_realm = false
    dns_lookup_kdc = false
    ticket_lifetime = 24h
    renew_lifetime = 7d
    forwardable = true
    default_tgs_enctypes = aes128-cts des3-hmac-sha1 des-cbc-crc des-cbc-md5
    default_tkt_enctypes = aes128-cts des3-hmac-sha1 des-cbc-crc des-cbc-md5
    permitted_enctypes = aes128-cts des3-hmac-sha1 des-cbc-crc des-cbc-md5
   
   [realms]
    KRB.GREENPLUM.COM = {
     kdc = kerberos-gpdb:88
     admin_server = kerberos-gpdb:749
     default_domain = kerberos-gpdb
    }
   
   [domain_realm]
    .kerberos-gpdb = KRB.GREENPLUM.COM
    kerberos-gpdb = KRB.GREENPLUM.COM
   
   [appdefaults]
    pam = {
       debug = false
       ticket_lifetime = 36000
       renew_lifetime = 36000
       forwardable = true
       krb4_convert = false
    }
   

   The kdc and admin_server keys in the [realms] section specify the host (kerberos-gpdb) and port where the Kerberos server is running. IP numbers can be used in place of host names.

   If your Kerberos server manages authentication for other realms, you would instead add the KRB.GREENPLUM.COM realm in the [realms] and [domain_realm] section of the kdc.conf file. See the Kerberos documentation for information about the kdc.conf file.

3. To create a Kerberos KDC database, run the kdb5_util.

   kdb5_util create -s

   The kdb5_util create option creates the database to store keys for the Kerberos realms that are managed by this KDC server. The -s option creates a stash file. Without the stash file, every time the KDC server starts it requests a password.
4. Add an administrative user to the KDC database with the kadmin.local utility. Because it does not itself depend on Kerberos authentication, the kadmin.local utility allows you to add an initial administrative user to the local Kerberos server. To add the user gpadmin as an administrative user to the KDC database, run the following command:

   kadmin.local -q "addprinc gpadmin/admin"

   Most users do not need administrative access to the Kerberos server. They can use kadmin to manage their own principals (for example, to change their own password). For information about kadmin, see the Kerberos documentation.
5. If needed, edit the /var/kerberos/krb5kdc/kadm5.acl file to grant the appropriate permissions to gpadmin.
6. Start the Kerberos daemons:

   /sbin/service krb5kdc start
   /sbin/service kadmin start

7. To start Kerberos automatically upon restart:

   /sbin/chkconfig krb5kdc on
   /sbin/chkconfig kadmin on

Add principals to the Kerberos realm for Greenplum Database.

1. Start kadmin.local in interactive mode:

   kadmin.local

2. Add principals:

   kadmin.local: addprinc gpadmin/[email protected]
   kadmin.local: addprinc postgres/[email protected]

   The adprinc commands prompt for passwords for each principal. The first addprinc creates a Greenplum Database user as a principal, gpadmin/kerberos-gpdb. The second addprinc command creates the postgres process on the Greenplum Database master host as a principal in the Kerberos KDC. This principal is required when using Kerberos authentication with Greenplum Database.
3. Create a Kerberos keytab file with kadmin.local. The following example creates a keytab file gpdb-kerberos.keytab in the current directory with authentication information for the two principals.

   kadmin.local: xst -k gpdb-kerberos.keytab
       gpadmin/[email protected]
       postgres/[email protected]

   You will copy this file to the Greenplum Database master host.
4. Exit kadmin.local interactive mode with the quit command:
   kadmin.local: quit

Steps to install the Kerberos client on the Greenplum Database master host.

1. Install the Kerberos packages on the Greenplum Database master.

   sudo yum install krb5-libs krb5-workstation

2. Ensure that the /etc/krb5.conf file is the same as the one that is on the Kerberos server.
3. Copy the gpdb-kerberos.keytab file that was generated on the Kerberos server to the Greenplum Database master host.
4. Remove any existing tickets with the Kerberos utility kdestroy. Run the utility as root.

   sudo kdestroy

5. Use the Kerberos utility kinit to request a ticket using the keytab file on the Greenplum Database master for gpadmin/[email protected]. The -t option specifies the keytab file on the Greenplum Database master.

   # kinit -k -t gpdb-kerberos.keytab gpadmin/[email protected]

6. Use the Kerberos utility klist to display the contents of the Kerberos ticket cache on the Greenplum Database master. The following is an example:

   # klist
   Ticket cache: FILE:/tmp/krb5cc_108061
   Default principal: gpadmin/[email protected]
   Valid starting     Expires            Service principal
   03/28/13 14:50:26  03/29/13 14:50:26  krbtgt/KRB.GREENPLUM.COM     @KRB.GREENPLUM.COM
       renew until 03/28/13 14:50:26