1) [toto@hadoop hadoop-2.8.0]$ ssh-keygen -t dsa -P '' -f ~/.ssh/id_dsa Generating public/private dsa key pair. Your identification has been saved in /home/toto/.ssh/id_dsa. Your public key has been saved in /home/toto/.ssh/id_dsa.pub. The key fingerprint is: 33:9d:e6:a4:a4:99:5a:af:e2:b6:46:ac:59:a8:41:10 toto@hadoop The key's randomart image is: +--[ DSA 1024]----+ |E. | |. | |. | | . . . | |. o S = | |. . + = B | | o = = . . | |. o +o . | | ++o... | +-----------------+ (注意:如果执行上面的命令出现open /home/toto/.ssh/id_dsa failed: Permission denied.,则用root用户执行:[root@hadoop1 ~]# chmod 777 /home/toto/.ssh) 以上是产生公私密钥,产生目录在用户主目录下的.ssh目录中,如下: [toto@hadoop hadoop-2.8.0]$ cd /home/toto/.ssh [toto@hadoop .ssh]$ ls id_dsa id_dsa.pub known_hosts [toto@hadoop .ssh]$ 其中id_dsa.pub为私钥,id_dsa为私钥,紧接着将公钥文件复制成authorized_keys文件,这个步骤是必须的,过程如下: [toto@hadoop .ssh]$ cat id_dsa.pub >> authorized_keys [toto@hadoop .ssh]$ ls authorized_keys id_dsa id_dsa.pub known_hosts 2):单机回环ssh免密码登陆测试 即在单机节点上用ssh进行登录,看看是否能够登陆成功。登陆成功后注销退出,过程如下: [toto@hadoop .ssh]$ ssh localhost The authenticity of host 'localhost (::1)' can't be established. RSA key fingerprint is 23:da:24:9c:b9:82:fa:f2:52:3c:30:2c:98:1e:4a:d7. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'localhost' (RSA) to the list of known hosts. [toto@hadoop ~]$ ssh Hadoop (如果是hadoop2,hadoop3这里分别写成这两个名字即可) Last login: Sun May 28 19:47:27 2017 from localhost 有以上信息表示操作成功,这将为后续跨子节点ssh远程免密登录做好准备。用上述同样的方法在剩下的两个节点如法炮制即可。 3) 让主结点hadoop(master)能够通过ssh免密登录两个子节点hadoop1,hadoop2(slave) 为了实现这个功能,两个slave节点的公钥文件中必须包含主结点的公钥信息,这样当master就可以顺利安全地当问两个slave结点了,操作过程如下: [toto@hadoop2 ~]$ cd ~/.ssh/ [toto@hadoop2 .ssh]$ ls authorized_keys id_dsa id_dsa.pub known_hosts [toto@hadoop2 .ssh]$ scp toto@hadoop:~/.ssh/id_dsa.pub ./master_dsa.pub The authenticity of host 'hadoop (192.168.106.80)' can't be established. RSA key fingerprint is 23:da:24:9c:b9:82:fa:f2:52:3c:30:2c:98:1e:4a:d7. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'hadoop,192.168.106.80' (RSA) to the list of known hosts. toto@hadoop's password: 这里输入123456 Permission denied, please try again. toto@hadoop's password: 这里输入123456 id_dsa.pub 100% 601 0.6KB/s 00:00 [toto@hadoop2 .ssh]$ ls authorized_keys id_dsa id_dsa.pub known_hosts master_dsa.pub [toto@hadoop2 .ssh]$ cat master_dsa.pub >> authorized_keys [toto@hadoop2 .ssh]$ 说明:如上过程显示了hadoop2结点通过scp命令远程登录master结点,并复制master的公钥到当前的目录下,这一过程需要密码验证。接着,将master结点的公钥文件追加至authorized_keys文件中,通过这步骤,如果不出现问题,master结点就可以通过ssh远程密码连接hadoop2结点了。在master(hadoop)结点中操作如下: [toto@hadoop .ssh] cd ~/.ssh/ (一定要在这个目录下进行才可以) [toto@hadoop .ssh]$ ssh hadoop2 (如果是进入hadoop配置hadoop3,这里写成:ssh hadoop3) The authenticity of host 'hadoop2 (192.168.106.81)' can't be established. RSA key fingerprint is 23:da:24:9c:b9:82:fa:f2:52:3c:30:2c:98:1e:4a:d7. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'hadoop2,192.168.106.81' (RSA) to the list of known hosts. Last login: Sun May 28 19:58:56 2017 from hadoop2 [toto@hadoop2 ~]$ exit logout Connection to hadoop2 closed. [toto@hadoop .ssh]$ ssh hadoop2 Last login: Sun May 28 20:12:06 2017 from hadoop [toto@hadoop2 ~]$ 由上图可以看出,node1结点首次连接时需要”YES”确认连接,这意味着master结点连接hadoop2(slave)结点时需要人工询问,无法自动连接,输入yes后成功接入,紧接着注销退出至master(hadoop)结点。要实现ssh免密码连接至其它结点,还差一步,只需执行ssh hadoop2,如果没有要求你输入”yes”,就算成功了,上述过程已经演示过。 4):进入hadoop3,执行3)这样步骤 [toto@hadoop3 ~]$ cd ~/.ssh/ [toto@hadoop3 .ssh]$ ls authorized_keys id_dsa id_dsa.pub known_hosts [toto@hadoop3 .ssh]$ scp toto@hadoop:~/.ssh/id_dsa.pub ./master_dsa.pub The authenticity of host 'hadoop (192.168.106.80)' can't be established. RSA key fingerprint is 23:da:24:9c:b9:82:fa:f2:52:3c:30:2c:98:1e:4a:d7. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'hadoop,192.168.106.80' (RSA) to the list of known hosts. toto@hadoop's password: id_dsa.pub 100% 601 0.6KB/s 00:00 [toto@hadoop3 .ssh]$ ls authorized_keys id_dsa id_dsa.pub known_hosts master_dsa.pub [toto@hadoop3 .ssh]$ cat master_dsa.pub >> authorized_keys [toto@hadoop3 .ssh]$ 进入hadoop机器,登录hadoop3 [toto@hadoop .ssh]$ ssh hadoop3 The authenticity of host 'hadoop2 (192.168.106.81)' can't be established. RSA key fingerprint is 23:da:24:9c:b9:82:fa:f2:52:3c:30:2c:98:1e:4a:d7. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'hadoop2,192.168.106.81' (RSA) to the list of known hosts. Last login: Sun May 28 19:58:56 2017 from hadoop2 [toto@hadoop3 ~]$ exit logout Connection to hadoop3 closed. [toto@hadoop .ssh]$ ssh hadoop3 Last login: Sun May 28 20:12:06 2017 from hadoop [toto@hadoop3 ~]$ 经过上述过程,可以通过hadoop免密登录hadoop2,hadoop3了。 表面上看,这两个节点的ssh免密登录已经配置成功,但是我们还需要对主结点master也要进行上面的同样工作,具体原因现在也说不太好,据说是真实物理节点时需要做这项工作,因为jobtracker有可能会分布在其它的结点上,jobtracker有不存在master结点上可能性。 [toto@hadoop root]$cd ~/.ssh/ [toto@hadoop .ssh]$ ls authorized_keys id_dsa id_dsa.pub known_hosts [toto@hadoop .ssh]$ scp toto@hadoop:~/.ssh/id_dsa.pub ./master_dsa.pub id_dsa.pub 100% 601 0.6KB/s 00:00 [toto@hadoop .ssh]$ ls authorized_keys id_dsa id_dsa.pub known_hosts master_dsa.pub [toto@hadoop .ssh]$ cat master_dsa.pub >> authorized_keys [toto@hadoop .ssh]$ ssh hadoop Last login: Sun May 28 19:59:13 2017 from hadoop [toto@hadoop ~]$
|