我无法进行 Kerberos 登录。
我已对其进行调整rsyslog以记录*.debug到/var/log/debug，其输出如下。
如果我尝试使用 登录ssh，我会得到：
Jun 6 23:13:05 foo-machine sshd[13965]: Invalid user roy from 204.28.116.34
Jun 6 23:13:05 foo-machine sshd[13965]: input_userauth_request: invalid user roy [preauth]
Jun 6 23:13:06 foo-machine sshd[13965]: pam_krb5(sshd:auth): pam_sm_authenticate: entry (nonull)
Jun 6 23:13:06 foo-machine sshd[13965]: pam_krb5(sshd:auth): (user roy) attempting authentication as [email protected]
Jun 6 23:13:06 foo-machine sshd[13965]: pam_krb5(sshd:auth): (user roy) krb5_get_init_creds_password: Decrypt integrity check failed
Jun 6 23:13:06 foo-machine sshd[13965]: pam_krb5(sshd:auth): authentication failure; logname=roy uid=0 euid=0 tty=ssh ruser= rhost=204.28.116.34
Jun 6 23:13:06 foo-machine sshd[13965]: pam_krb5(sshd:auth): pam_sm_authenticate: exit (failure)
Jun 6 23:13:06 foo-machine sshd[13965]: pam_unix(sshd:auth): check pass; user unknown
Jun 6 23:13:06 foo-machine sshd[13965]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=204.28.116.34
Jun 6 23:13:06 foo-machine sshd[13965]: Libgcrypt warning: missing initialization - please fix the application
Jun 6 23:13:07 foo-machine sshd[13965]: Failed password for invalid user roy from 204.28.116.34 port 30760 ssh2
（请注意，我很清楚“解密完整性检查失败”意味着“密码不正确”。我提供的密码是正确的。）
如果我尝试使用 登录login，我会得到：
Jun 6 22:55:58 foo-machine login[13003]: pam_krb5(login:auth): pam_sm_authenticate: entry
Jun 6 22:56:00 foo-machine login[13003]: pam_krb5(login:auth): (user roy) attempting authentication as [email protected]
Jun 6 22:56:00 foo-machine login[13003]: pam_krb5(login:auth): user roy authenticated as [email protected]
Jun 6 22:56:00 foo-machine login[13003]: pam_krb5(login:auth): (user roy) temporarily storing credentials in /tmp/krb5cc_pam_98AyqH
Jun 6 22:56:00 foo-machine login[13003]: pam_krb5(login:auth): pam_sm_authenticate: exit (success)
Jun 6 22:56:00 foo-machine login[13003]: Libgcrypt warning: missing initialization - please fix the application
Jun 6 22:56:00 foo-machine login[13003]: pam_krb5(login:account): pam_sm_acct_mgmt: entry
Jun 6 22:56:00 foo-machine login[13003]: pam_krb5(login:account): (user roy) retrieving principal from cache
Jun 6 22:56:00 foo-machine login[13003]: pam_krb5(login:account): pam_sm_acct_mgmt: exit (success)
Jun 6 22:56:00 foo-machine login[13003]: pam_mail(login:session): user unknown
Jun 6 22:56:00 foo-machine login[13003]: pam_umask(login:session): account for roy not found
Jun 6 22:56:00 foo-machine login[13003]: pam_krb5(login:session): (user roy) getpwnam failed for roy
Jun 6 22:56:00 foo-machine login[13003]: pam_unix(login:session): session opened for user roy by root(uid=0)
Jun 6 22:56:00 foo-machine login[13003]: User not known to the underlying authentication module
如果我尝试使用 进行身份验证kinit，一切顺利：
# kinit -V [email protected]
Using default cache: /tmp/krb5cc_0
Using principal: [email protected]
Password for [email protected]:
Authenticated to Kerberos v5
#
/etc/pam.d/common-account：
# here are the per-package modules (the "Primary" block)
account [success=2 new_authtok_reqd=done default=ignore] pam_krb5.so minimum_uid=1000 debug
account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so
# here's the fallback if no module succeeds
account requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account required pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config
请注意，我在这里做了修改；account ... pam_krb5之前是在“附加块”中，但鉴于pam_deny设置为requisite，我不清楚如何pam_krb5才能达到。因此，我将其上移。接下来的两个文件我没有动过：
/etc/pam.d/common-auth：
# here are the per-package modules (the "Primary" block)
auth [success=4 default=ignore] pam_krb5.so minimum_uid=1000 debug
auth [success=3 default=ignore] pam_unix.so nullok_secure try_first_pass
auth [success=2 default=ignore] pam_ccreds.so minimum_uid=1000 action=validate use_first_pass
auth [default=ignore] pam_ccreds.so minimum_uid=1000 action=update
# here's the fallback if no module succeeds
auth requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth required pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth optional pam_ccreds.so minimum_uid=1000 action=store
auth optional pam_cap.so
# end of pam-auth-update config
/etc/pam.d/common-session：
# here are the per-package modules (the "Primary" block)
session [default=1] pam_permit.so
# here's the fallback if no module succeeds
session requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session required pam_permit.so
# The pam_umask module will set the umask according to the system default in
# /etc/login.defs and user settings, solving the problem of different
# umask settings with different shells, display managers, remote sessions etc.
# See "man pam_umask".
session optional pam_umask.so
# and here are more per-package modules (the "Additional" block)
session [success=1 default=ignore] pam_krb5.so minimum_uid=1000
session required pam_unix.so
session optional pam_systemd.so
# end of pam-auth-update config
顺便提一下，Apache DS 是我的 LDAP 和 KDC 服务器。（/etc/krb5.conf指向它。）（正如 OpenLDAP/“普通” Kerberos 所证明的那样不可能的设置；Apache 已经变得更容易了，但是遗憾的是它仍然不起作用。)
为何我无法登录？
答案1
你的 SSH 服务器是否配置了 kerberos？例如
KerberosAuthentication yes
KerberosTicketCleanup yes
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
UseDNS yes
从我上面看到的情况来看，SSH 正在尝试使用凭据登录，而不是通过出示 kerberos 票证（您可以通过在客户端使用 kinit 获得）。当然，正如您上面指出的那样，kinit 可以在您的客户端上运行，这很好。您可以发布 SSH/SSHD 调试日志吗？