我已经安装了 IPA 服务器、创建了副本协议并建立了对 AD 林的单向信任。 IPA 服务器已集成 DNS 并位于其自己的 dns 区域中。这按预期工作，我可以使用我的 AD 帐户登录 IPA 服务器。
我的问题是在设置客户端时，我可以使用 IPA 用户（例如管理员），但无法使用我的 AD 帐户进行身份验证/登录。
在 IPA 服务器上运行 HBAC 测试验证了我的 AD 用户是否有权访问客户端。我还可以在 IPA 客户端上成功为 AD 用户获取 kerberos 票证。
当我从 IPA 客户端对 AD 帐户执行 id 操作时，我收到一个
未知的用户错误
当我尝试 ssh 时，安全日志显示底层身份验证模块存在非法用户/未知用户。
环境详情如下：
- 国际音标版本 4.4.0
- IPA 服务器：ipaserver01.ipa.us.example.com CentOS 7.3
- IPA 副本：ipaserver02.ipa.us.example.com CentOS 7.3
- IPA 客户端：ipaclient.us.example.com CentOS 7.3
- IPA 领域：IPA.US.EXAMPLE.COM
- AD 森林：win.example.com
- 用户：[电子邮件受保护]
/etc/sssd/sssd.conf：
[domain/ipa.us.example.com]
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = ipa.us.example.com
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ldap_tls_cacert = /etc/ipa/ca.crt
ipa_hostname = ipaclient.us.example.com
chpass_provider = ipa
ipa_server = _srv_, ipaserver02.ipa.us.example.com
dns_discovery_domain = ipa.us.example.com
subdomain_inherit = ignore_group_members
ignore_group_members = True
debug_level = 6
[sssd]
domains = ipa.us.example.com
config_file_version = 2
services = nss, sudo, pam, ssh, pac
subdomain_enumerate = all
debug_level = 6
[nss]
debug_level = 6
homedir_substring = /home
/etc/krb5.conf
#File modified by ipa-client-install
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults]
default_realm = IPA.US.EXAMPLE.COM
dns_lookup_realm = true
dns_lookup_kdc = true
rdns = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
IPA.US.EXAMPLE.COM = {
pkinit_anchors = FILE:/etc/ipa/ca.crt
}
[domain_realm]
.ipa.us.example.com = IPA.US.EXAMPLE.COM
ipa.us.example.com = IPA.US.EXAMPLE.COM
ipaclient.us.example.com = IPA.US.EXAMPLE.COM
.us.example.com = IPA.US.EXAMPLE.COM
us.example.com = IPA.US.EXAMPLE.COM
/var/日志/安全
May 17 10:23:23 lxmatazan100s sshd[8256]: reverse mapping checking getaddrinfo for dhcp-ngkusernetworkuzo-1921690252.revonly.kn [192.169.0.252] failed - POSSIBLE BREAK-IN ATTEMPT!
May 17 10:23:47 lxmatazan100s sshd[8256]: Invalid user [email protected] from 192.169.0.252
May 17 10:23:47 lxmatazan100s sshd[8256]: input_userauth_request: invalid user [email protected] [preauth]
May 17 10:23:50 lxmatazan100s sshd[8256]: Failed password for invalid user [email protected] from 192.169.0.252 port 51819 ssh2
May 17 10:23:53 lxmatazan100s sshd[8256]: Failed password for invalid user [email protected] from 192.169.0.252 port 51819 ssh2
May 17 10:23:56 lxmatazan100s sshd[8256]: Failed password for invalid user [email protected] from 192.169.0.252 port 51819 ssh2
May 17 10:23:56 lxmatazan100s sshd[8256]: error: PAM: User not known to the underlying authentication module for illegal user [email protected] from 192.169.0.252
May 17 10:23:56 lxmatazan100s sshd[8256]: Failed keyboard-interactive/pam for invalid user [email protected] from 192.169.0.252 port 51819 ssh2
May 17 10:23:56 lxmatazan100s sshd[8256]: Connection closed by 192.169.0.252 [preauth]
/var/log/sssd/sssd_ipa.us.example.com（这些条目对于 AD 林中的每个域都存在多次！）
(Wed May 17 08:25:50 2017) [sssd[be[ipa.us.example.com]]] [_dp_req_recv] (0x0400): DP Request [Account #134]: Receiving request data.
(Wed May 17 08:25:50 2017) [sssd[be[ipa.us.example.com]]] [dp_req_reply_gen_error] (0x0080): DP Request [Account #134]: Finished. Backend is currently offline.
(Wed May 17 08:25:50 2017) [sssd[be[ipa.us.example.com]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:1:1:U:usa.win.example.com:[email protected]] from reply table
(Wed May 17 08:25:50 2017) [sssd[be[ipa.us.example.com]]] [dp_req_destructor] (0x0400): DP Request [Account #134]: Request removed.
(Wed May 17 08:25:50 2017) [sssd[be[ipa.us.example.com]]] [dp_req_destructor] (0x0400): Number of active DP request: 0
/var/log/sssd/sssd_nss.log
（同样，AD 林中的每个域都存在这些）
(Wed May 17 08:25:50 2017) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0100): Requesting info for [[email protected]]
(Wed May 17 08:25:50 2017) [sssd[nss]] [sysdb_search_user_by_upn] (0x0400): No entry with upn [[email protected]] found.
(Wed May 17 08:25:50 2017) [sssd[nss]] [get_dp_name_and_id] (0x0400): Not a LOCAL view, continuing with provided values.
(Wed May 17 08:25:50 2017) [sssd[nss]] [sss_dp_issue_request] (0x0400): Issuing request for [0x7f99f622c880:1:[email protected]:[email protected]]
(Wed May 17 08:25:50 2017) [sssd[nss]] [sss_dp_get_account_msg] (0x0400): Creating request for [usa.win.example.com][0x1][BE_REQ_USER][1][[email protected]:U]
(Wed May 17 08:25:50 2017) [sssd[nss]] [sss_dp_internal_get_send] (0x0400): Entering request [0x7f99f622c880:1:[email protected]:[email protected]]
(Wed May 17 08:25:50 2017) [sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x7f99f622c880:1:[email protected]:[email protected]]
(Wed May 17 08:25:50 2017) [sssd[nss]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
(Wed May 17 08:25:50 2017) [sssd[nss]] [nss_cmd_getby_dp_callback] (0x0040): Unable to get information from Data Provider
Error: 3, 5, Failed to get reply from Data Provider
Will try to return what we have in cache
我剩下要尝试的一件事是将客户端移至 ipa.us.example.com dns 域，尽管文档特别提到客户端不需要与服务器位于同一 dns 域中。
编辑** - 我之前注释掉了一行 /etc/pam.d/password-auth ，认为它修复了 ipa（不信任）用户身份验证。我现在认为它允许任何用户进行身份验证，因为当我从 HBAC 规则中删除用户时，他们仍然可以进行身份验证。我已取消注释该行，现在 IPA 用户无法进行身份验证。我仍然可以查找这些用户（而不是 AD 用户）。
/etc/pam.d/密码验证
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth [default=1 success=ok] pam_localuser.so
auth [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
#The following line is what I had commented out
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session optional pam_oddjob_mkhomedir.so umask=0077
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so
编辑#2**
我现在已经让 ipa 用户与我的客户端一起工作，我必须在 sssd.conf 的 [domain/ipa.us.example.com] 部分中包含“selinux_provider=none”。 AD Trust 用户仍然因相同的错误而失败。