You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@metron.apache.org by GitBox <gi...@apache.org> on 2019/04/13 01:35:42 UTC
[GitHub] [metron] mmiklavc commented on issue #1382: METRON-2074: Script to
handle TGT renewal with Storm and Kerberos enabled
mmiklavc commented on issue #1382: METRON-2074: Script to handle TGT renewal with Storm and Kerberos enabled
URL: https://github.com/apache/metron/pull/1382#issuecomment-482765401
# Test Instructions
1. Run up full dev
1. Setup Kerberos per the instructions in https://github.com/apache/metron/blob/master/metron-deployment/Kerberos-ambari-setup.md
1. Modify the maxlife and maxrenewlife for your TGT. Here we're setting it to 3 and 4 minutes, respectively, but you can set the values even shorter for testing purposes.
```
kadmin.local -q "modprinc -maxlife 3minutes krbtgt/EXAMPLE.COM@EXAMPLE.COM"
kadmin.local -q "modprinc -maxrenewlife 4minutes krbtgt/EXAMPLE.COM@EXAMPLE.COM"
```
1. Restart the bro parser topology. We'll focus on one topology for this exercise.
1. Allow your max renew time to pass. If you look at your Storm bolt logs, you should see at least one renewal prior to expiration, e.g.
```
2018-09-17 06:52:54.506 o.a.s.s.o.a.z.Login Thread-1 [INFO] Initiating logout for metron@EXAMPLE.COM
2018-09-17 06:52:54.507 o.a.s.s.o.a.z.Login Thread-1 [INFO] Initiating re-login for metron@EXAMPLE.COM
2018-09-17 06:52:54.521 o.a.s.s.o.a.z.Login Thread-1 [INFO] TGT valid starting at: Mon Sep 17 06:53:17 UTC 2018
2018-09-17 06:52:54.527 o.a.s.s.o.a.z.Login Thread-1 [INFO] TGT expires: Mon Sep 17 07:03:17 UTC 2018
2018-09-17 06:52:54.527 o.a.s.s.o.a.z.Login Thread-1 [INFO] TGT refresh sleeping until: Mon Sep 17 07:01:29 UTC 2018
```
1. You should also start to see error messages like the following in the Nimbus logs:
```
2018-09-17 07:12:52.064 o.a.s.s.a.k.AutoTGT timer [INFO] Renewing TGT for metron@EXAMPLE.COM
2018-09-17 07:12:52.064 o.a.s.s.a.k.AutoTGT timer [WARN] Failed to refresh TGT javax.security.auth.RefreshFailedException: This ticket is past its last renewal time.
```
1. Run the tgt_renew.py script per the Kerberos README instructions in this PR and verify that you again start to see TGT login/renewal for metron@EXAMPLE.COM
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services