#encoding: utf-8
#!/bin/bash

user=`whoami`
localPwd="$( cd "$( dirname "$0"   )" && pwd   )"
logFile="$localPwd/install.log"
dateNow=`date '+%Y-%m-%d %H:%M:%S'`
dateFlag=`date '+%Y%m%d%H%M%S'`
kdc_server=`hostname`
node_list=$localPwd/ip.list
domain=HADOOP.COM
kadminPass=Admin@1298

sudoCmd=""
[ "$user" != "root" ] && sudoCmd="sudo " && echo "非root用户，使用免密sudo命令执行。"

function echo_info {
  echo -e "\e[32m`printf '%-20s' "[install_kdc]"`\e[0m - $1"
  echo "$dateNow INFO [install_kdc] $1" >> $logFile
}
function echo_warn {
  echo -e "\e[31m`printf '%-20s' "[install_kdc]"`\e[0m - $1"
  echo "$dateNow WARN [install_kdc] $1" >> $logFile
}

function main() {
  echo_info "install krb5-server krb5-libs krb5-workstation"
  $sudoCmd yum install krb5-server krb5-libs krb5-workstation  -y 2>&1 >>$logFile
	[ $? -ne 0 ] && echo_warn "安装失败，请检查yum配置." && exit 1
  echo_info "创建kdc数据库"
  $sudoCmd kdb5_util create -r $domain -s -P kdc@1298
	[ $? -ne 0 ] && echo_warn "初始化数据库失败，检查是否已有库.ls /var/kerberos/krb5kdc/principal*" && exit 1
  echo_info "初始化客户端配置文件/etc/krb5.conf"
  $sudoCmd \cp /etc/krb5.conf /etc/krb5.conf.bak.$dateFlag
  $sudoCmd cat >/etc/krb5.conf <<EOF
# Configuration snippets may be placed in this directory as well
[libdefaults]
  renew_lifetime = 7d
  forwardable = true
  default_realm = $domain
  ticket_lifetime = 24h
  dns_lookup_realm = false
  dns_lookup_kdc = false
  default_ccache_name = /tmp/krb5cc_%{uid}
  #default_tgs_enctypes = aes des3-cbc-sha1 rc4 des-cbc-md5
  #default_tkt_enctypes = aes des3-cbc-sha1 rc4 des-cbc-md5
#[logging]
#  default = FILE:/var/log/krb5kdc.log
#  admin_server = FILE:/var/log/kadmind.log
#  kdc = FILE:/var/log/krb5kdc.log

[realms]
  $domain = {
    admin_server = $kdc_server
    kdc = $kdc_server
  }
EOF

  echo_info "初始化服务端配置文件/var/kerberos/krb5kdc/kdc.conf"
  $sudoCmd \cp /var/kerberos/krb5kdc/kdc.conf /var/kerberos/krb5kdc/kdc.conf.bak.$dateFlag
  $sudoCmd cat > /var/kerberos/krb5kdc/kdc.conf << EOF
[kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88

[realms]
 $domain = {
  #master_key_type = aes256-cts
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
}
EOF

  echo_info "启动admin&kdc服务并使能开机启动"
  $sudoCmd systemctl start krb5kdc && $sudoCmd systemctl enable krb5kdc 
	[ $? -ne 0 ] && echo_warn "启动krb5kdc失败，请检查服务配置." && exit 1
  $sudoCmd systemctl start kadmin  && $sudoCmd systemctl enable kadmin
	[ $? -ne 0 ] && echo_warn "启动kadmin失败，请检查服务配置." && exit 1

  echo_info "创建管理⽤户"
  $sudoCmd kadmin.local -q "addprinc -pw $kadminPass admin/admin@$domain"
	[ $? -ne 0 ] && echo_warn "创建管理员失败，请检查服务配置." && exit 1

  echo_info "设置kdc本地acl，文件/var/kerberos/krb5kdc/kadm5.acl"
  $sudoCmd \cp /var/kerberos/krb5kdc/kadm5.acl /var/kerberos/krb5kdc/kadm5.acl.bak.$dateFlag
  $sudoCmd sed -i "/EXAMPLE.COM/c */admin@${domain} *" /var/kerberos/krb5kdc/kadm5.acl
  $sudoCmd systemctl restart kadmin krb5kdc
	[ $? -ne 0 ] && echo_warn "重启服务失败，请检查ACL配置." && exit 1

  echo_info "部署客户端"
  for i in `cat $node_list`;do
    ssh $i "$sudoCmd yum install krb5-libs krb5-workstation -y"
	  [ $? -ne 0 ] && echo_warn "节点部署客户端失败:$i" && continue
		ssh $i "$sudoCmd \cp /etc/krb5.conf /etc/krb5.conf.bak.$dateFlag"
    rsync -av /etc/krb5.conf $i:/etc/
  done
  
  echo_info "安装信息汇总："
	echo_info "kdc server：$kdc_server"
	echo_info "kdc domain：$domain"
	echo_info "kdc 数据库密码：kdc@1298"
	echo_info "kdc 管理员用户：admin/admin@$domain"
	echo_info "kdc 管理员密码：$kadminPass"
	echo_info "kdc 客户端节点：`cat $node_list|tr '\n' ' '`"
}
main
