Kerberos Services

You will need a Kerberos KDC running on a node that the Presto coordinator can reach over the network. The KDC is responsible for authenticating principals and issuing session keys that can be used with Kerberos-enabled services. KDCs typically run on port 88, which is the IANA-assigned port for Kerberos.

MIT Kerberos Configuration

Kerberos needs to be configured on the Presto coordinator. At a minimum, there needs to be a kdc entry in the [realms] section of the /etc/krb5.conf file. You may also want to include an admin_server entry and ensure that the Presto coordinator can reach the Kerberos admin server on port 749.

[realms]
  PRESTO.EXAMPLE.COM = {
    kdc = kdc.example.com
    admin_server = kdc.example.com
  }

[domain_realm]
  .presto.example.com = PRESTO.EXAMPLE.COM
  presto.example.com = PRESTO.EXAMPLE.COM

The complete documentation for krb5.conf is hosted by the MIT Kerberos Project. If you are using a different implementation of the Kerberos protocol, you will need to adapt the configuration to your environment.

Kerberos Principals and Keytab Files

The Presto coordinator needs a Kerberos principal, as do users who are going to connect to the Presto coordinator. You need to create these users in Kerberos using kadmin.

In addition, the Presto coordinator needs a keytab file. After you create the principal, you can create the keytab file using kadmin

kadmin
> addprinc -randkey presto@EXAMPLE.COM
> addprinc -randkey presto/presto-coordinator.example.com@EXAMPLE.COM
> ktadd -k /etc/presto/presto.keytab presto@EXAMPLE.COM
> ktadd -k /etc/presto/presto.keytab presto/presto-coordinator.example.com@EXAMPLE.COM

Java Cryptography Extension Policy Files

The Java Runtime Environment is shipped with policy files that limit the strength of the cryptographic keys that can be used. Kerberos, by default, uses keys that are larger than those supported by the included policy files. There are two possible solutions to the problem:

• Update the JCE policy files.
• Configure Kerberos to use reduced-strength keys.

Of the two options, updating the JCE policy files is recommended. The JCE policy files can be downloaded from Oracle. Note that the JCE policy files vary based on the major version of Java you are running. Java 6 policy files will not work with Java 8, for example.

The Java 8 policy files are available from Oracle. Instructions for installing the policy files are included in a README file in the ZIP archive. You need administrative access to install the policy files, if you are installing them in a system JRE.

Java Keystore File for TLS

When using Kerberos authentication, access to the Presto coordinator should be through HTTPS. You can do it by creating a Java Keystore File for TLS on the coordinator.

config.properties

Kerberos authentication is configured in the coordinator node’s config.properties file. The entries that need to be added are listed below.

http-server.authentication.type=KERBEROS

http-server.authentication.krb5.service-name=presto
http-server.authentication.krb5.principal-hostname=presto.prestosql.io
http-server.authentication.krb5.keytab=/etc/presto/presto.keytab
http.authentication.krb5.config=/etc/krb5.conf

http-server.https.enabled=true
http-server.https.port=7778

http-server.https.keystore.path=/etc/presto_keystore.jks
http-server.https.keystore.key=keystore_password

http-server.https.included-cipher=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256
http-server.https.excluded-cipher=

access-controls.properties

At a minimum, an access-control.properties file must contain an access-control.name property. All other configuration is specific for the implementation being configured. See System Access Control for details.

Kerberos Verification

Ensure that you can connect to the KDC from the Presto coordinator using telnet.

$ telnet kdc.example.com 88

Verify that the keytab file can be used to successfully obtain a ticket using kinit and klist

$ kinit -kt /etc/presto/presto.keytab presto@EXAMPLE.COM
$ klist

Java Keystore File Verification

Verify the password for a keystore file and view its contents using Java Keystore File Verification

Additional Kerberos Debugging Information

You can enable additional Kerberos debugging information for the Presto coordinator process by adding the following lines to the Presto jvm.config file

-Dsun.security.krb5.debug=true
-Dlog.enable-console=true

-Dsun.security.krb5.debug=true enables Kerberos debugging output from the JRE Kerberos libraries. The debugging output goes to stdout, which Presto redirects to the logging system. -Dlog.enable-console=true enables output to stdout to appear in the logs.

The amount and usefulness of the information the Kerberos debugging output sends to the logs varies depending on where the authentication is failing. Exception messages and stack traces can provide useful clues about the nature of the problem.

Additional resources

Common Kerberos Error Messages (A-M)

Common Kerberos Error Messages (N-Z)

MIT Kerberos Documentation: Troubleshooting