☰

屏幕锁定检查密码文件但不检查 Active Directory

tag-icon • tag-icon password screen-lock passwd shadow
屏幕锁定检查密码文件但不检查 Active Directory

我们有一个运行 Centos 7 的 Linux 系统，并且遇到屏幕锁定问题。我们有一个多用户环境，每个用户都有自己的帐户。身份验证使用我们大学的活动目录。只有本地帐户使用 passwd 和影子文件，实际上，如果本地帐户锁定屏幕，他们就可以解锁它。所有其他用户都使用 AD 进行身份验证，并在尝试时收到身份验证错误。

We are using sssd.
This from secure log:
Oct 30 08:59:54 b400 kcheckpass[94374]: pam_listfile(kscreensaver:auth): Refused user teach for service kscreensaver
Oct 30 08:59:55 b400 kcheckpass[94374]: pam_sss(kscreensaver:auth): authentication failure; logname=syin uid=1005 euid=1005 tty=:0 ruser= rhost= user=teach
Oct 30 08:59:55 b400 kcheckpass[94374]: pam_sss(kscreensaver:auth): received for user teach: 17 (Failure setting user credentials)
Oct 30 09:00:02 b400 gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by ouidad(uid=0)
Oct 30 09:00:03 b400 polkitd[663]: Registered Authentication Agent for unix-session:c243 (system bus name :1.20066 [/usr/bin/gnome-shell], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)

This from messages:
Oct 30 08:59:55 b400 [sssd[krb5_child[94379]]]: Preauthentication failed
Oct 30 08:59:55 b400 [sssd[krb5_child[94379]]]: Preauthentication failed
Oct 30 08:59:55 b400 [sssd[krb5_child[94379]]]: Preauthentication failed
Oct 30 08:59:55 b400 kcheckpass[94374]: Authentication failure for teach (invoked by uid 1005)

sssd 日志要么是空的，要么没有提供任何线索。我该怎么做才能确保在登录时检查 AD 而不是密码/影子文件以进行屏幕解锁？

答案1

我们发现了...位于 /etc/pam.d 中的 kscreensaver 文件在恢复更新期间配置错误。我们有 kscreensaver 配置文件的备份文件，并使用 cp 命令简单地将其复制到更新前的原始状态。

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
# auth      required      pam_listfile.so file=/etc/allowed.nmr.users item=user sense=allow onerr=fail
auth        required      pam_env.so
auth        sufficient    pam_fprintd.so
auth        [default=1 success=ok] pam_localuser.so
auth        [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success
auth        sufficient    pam_sss.so forward_pass
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 1000 quiet
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required      pam_permit.so

password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_sss.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
-session     optional      pam_systemd.so
session     optional      pam_oddjob_mkhomedir.so umask=0077
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_sss.so


systemctl rstart sssd

我们重新启动 sssd，恢复了 Active Directory 用户的解锁功能。

相关内容