Active Directory 를 KDC 로 쓸 때의 노드 준비. sssd/realmd 로 AD 에 가입하고 krb5.conf 를 맞춘다.[1]
Cloudera Manager 에서 Kerberos 를 켜는 절차는 공식 문서를 따른다.[2]
dnf install -y nscd sssd realmd adcli oddjob oddjob-mkhomedir krb5-workstation krb5-libs openldap-clients
# openldap-clients 는 매니저 서버에만 있으면 된다
realm discover ad.domain_name.com
realm join -v --computer-ou="OU=Computers,OU=AD,DC=DOMAIN_NAME,DC=COM" --user=<AD 관리자 계정> ad.domain_name.com
systemctl enable sssd --now
id <AD 계정>@ad.domain_name.com
realm join 이 만들어 주는 파일이다. 아래 값과 다르면 고친 뒤 systemctl restart sssd.
/etc/sssd/sssd.conf
[sssd]
domains = AD.DOMAIN_NAME.COM
config_file_version = 2
services = nss, pam
[domain/AD.DOMAIN_NAME.COM]
ad_server = AD_SERVER.HOST_NAME.COM
ad_domain = AD.DOMAIN_NAME.COM
krb5_realm = AD.DOMAIN_NAME.COM
realmd_tags = manager-system joined-with-adcli
cache_credentials = True
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
realm 이름은 대소문자를 구분한다 — [realms] 의 키와 [domain_realm] 의 오른쪽은 대문자로 쓴다.
[libdefaults]
default_realm = AD.DOMAIN_NAME.COM
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
[realms]
AD.DOMAIN_NAME.COM = {
kdc = ad.domain_name.com
admin_server = ad.domain_name.com
default_domain = ad.domain_name.com
}
[domain_realm]
.ad.domain_name.com = AD.DOMAIN_NAME.COM
ad.domain_name.com = AD.DOMAIN_NAME.COM
Red Hat — Connecting RHEL systems directly to AD using SSSD. 2026-09-17 확인. https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/integrating_rhel_systems_directly_with_windows_active_directory/connecting-rhel-systems-directly-to-ad-using-sssd_integrating-rhel-systems-directly-with-active-directory ↩︎
Cloudera Manager — Enabling Kerberos Authentication for CDP (7.3.1). https://docs.cloudera.com/cdp-private-cloud-base/7.3.1/security-kerberos-authentication/topics/cm-security-kerberos-enabling-intro.html ↩︎