Oracle^® ZFS Storage Appliance 管理指南，发行版 OS8.8.0

导入 Kerberos 密钥 (CLI)

使用以下过程可导入在 KDC 上创建的 Kerberos 密钥。然后，将密钥存储在设备密钥表中。此任务不需要 KDC 上的登录凭证。有关每个属性的说明，请参见Kerberos 服务属性和Kerberos 属性和日志。

开始之前

确保启用了 Kerberos 服务，设置了领域，并确定了 KDC，如创建 Kerberos 领域 (CLI)中所述。

1. 转到 configuration services kerberos importkeytab 并输入 show 以查看属性。

   hostname:configuration services kerberos importkeytab (uncommitted)> show
   Properties:
                             url = (unset)
                            user = (unset)
                        password = (unset)

2. 输入 set url= 及 Kerberos 密钥表文件的 URL。

   hostname:configuration services kerberos importkeytab (uncommitted)> set url=http://akbuild1/shares/export/123456/demo.keytab
                             url = http://akbuild1/shares/export/123456/demo.keytab

3. 输入 set user= 及 URL 访问的用户名。

   hostname:configuration services kerberos importkeytab (uncommitted)> set user=myusername
                            user = myusername

4. 输入 set password= 及 URL 访问的密码，然后再输入 commit。

   hostname:configuration services kerberos importkeytab (uncommitted)> set password=letmein
                        password = (set)
   hostname:configuration services kerberos importkeytab (uncommitted)> commit
   Transferred 718 of 718 (100%) . . . done
   Imported 8 keys.

5. 输入 show 查看领域和 KDC。

   hostname:configuration services kerberos> show
   Properties:
                        <status> = online
               allow_weak_crypto = true
   Realms:
   REALM          KDC
   TEST.NET       kdc1.us.oracle.com

6. 要查看领域的主体，请选择一个领域，然后输入 show。

   hostname:configuration services kerberos> select TEST.NET
   hostname:configuration services kerberos TEST.NET> show
   Properties:
                   kdcs = kdc1.us.oracle.com
   Keytab entries:
   NAME            KEYS  PRINCIPAL
   principal-000   4     host/hostname.us.oracle.com@TEST.NET
   principal-001   4     nfs/hostname.us.oracle.com@TEST.NET

7. 要查看主体的密钥，请选择一个主体，然后输入 show。

   hostname:configuration services kerberos TEST.NET> select principal-001
   hostname:configuration services kerberos principal-001> show
   Properties:
                    name = nfs/hostname.us.oracle.com@TEST.NET
   Keys:
   KEY       KVNO   ENCTYPENO   ENCTYPE
   key-000   28     18          AES-256 CTS mode with 96-bit SHA-1 HMAC
   key-001   28     17          AES-128 CTS mode with 96-bit SHA-1 HMAC
   key-002   28     16          Triple DES cbc mode with HMAC/sha1
   key-003   28     23          ArcFour with HMAC/md5
   key-004   28     24          Exportable ArcFour with HMAC/md5
   key-005   28     3           DES cbc mode with RSA-MD5
   key-006   28     1           DES cbc mode with CRC-32

   列标题图例：

   • KEY = 密钥名称

   • KVNO = 密钥版本号

   • ENCTYPENO = 加密类型编号

   • ENCTYPE = 加密类型

8. 要查看密钥的属性，请选择一个密钥，然后输入 show。

   hostname:configuration services kerberos principal-001> select key-003
   hostname:configuration services kerberos principal-001 key-003> show
   Properties:
                  principal = nfs/hostname.us.oracle.com@TEST.NET
                       kvno = 28
                    enctype = ArcFour with HMAC/md5
                  enctypeno = 23