我正在尝试在 SLE 15 SP2 主机上配置 Active Directory 身份验证。 AD域存在多个DC/AD服务器。
我遵循了这些指南： https://www.suse.com/c/the-sssd-active-directory-and-sles-12-and-15/ https://www.suse.com/support/kb/doc/?id=000019549
当我将主机配置为使用一台特定的 AD 服务器时，一切正常。但是，当我将主机配置为获取不同的服务器时，它也可以正常工作一段时间，然后就停止工作。我可以通过 SSH 验证组中的 AD 帐户，没有任何问题，但 SSSD 服务给出了多行以下错误:
“10 月 12 日 08:46:45 主机 sssd[15569]：tkey 查询失败：GSSAPI 错误：主要 = 未指定的 GSS 故障。次要代码可能提供更多信息，次要 = 在 Kerberos 数据库中找不到服务器。”
我尝试了来自不同站点的多个配置，但没有一个对我有帮助。我究竟做错了什么？
谢谢！
配置文件：
SSD配置文件
[sssd]
config_file_version = 2
services = nss,pam
domains = dom-ain.domain.com
[nss]
filter_users = root
filter_groups = root
[pam]
[domain/dom-ain.domain.com]
debug_level=6
id_provider = ad
auth_provider = ad
cache_credentials = false
enumerate = false
override_homedir = /home/%d/%u
case_sensitive = true
ad_hostname = host.dom-ain.domain.com
simple_allow_groups = [email protected]
access_provider = simple
krb5.conf
includedir /etc/krb5.conf.d
[libdefaults]
dns_canonicalize_hostname = false
rdns = false
default_realm = DOM-AIN.DOMAIN.COM
default_ccache_name = /tmp/krb5cc_%{uid}
dns_lookup_realm = false
dns_lookup_kdc = true
allow_weak_crypto = false
[domain_realm]
.dom-ain.domain.com = DOM-AIN.DOMAIN.COM
dom-ain.domain.com = DOM-AIN.DOMAIN.COM
[logging]
kdc = FILE:/var/log/krb5/krb5kdc.log
admin_server = FILE:/var/log/krb5/kadmind.log
default = SYSLOG:NOTICE:DAEMO
[realms]
DOM-AIN.DOMAIN.COM = {
default_domain = dom-ain.domain.com
}
LDAP配置文件
#
# LDAP Defaults
#
# See ldap.conf(5) for details
# This file should be world readable but not world writable.
#BASE dc=example,dc=com
#URI ldap://ldap.example.com ldap://ldap-master.example.com:666
URI ldap:// dom-ain.domain.com
BASE dc=doma-ain,dc=domain,dc=com
REFERRALS FF
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
nsswitch.conf
#
# /etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Legal entries are:
#
# compat Use compatibility setup
# nisplus Use NIS+ (NIS version 3)
# nis Use NIS (NIS version 2), also called YP
# dns Use DNS (Domain Name Service)
# files Use the local files
# [NOTFOUND=return] Stop searching if not found so far
#
# For more information, please read the nsswitch.conf.5 manual page.
#
passwd: compat sss
group: compat sss
shadow: compat
hosts: files dns
networks: files dns
services: files
protocols: files
rpc: files
ethers: files
netmasks: files
netgroup: files nis
publickey: files
bootparams: files
automount: files nis
aliases: files
smb配置文件
# smb.conf is the main Samba configuration file. You find a full commented
# version at /usr/share/doc/packages/samba/examples/smb.conf.SUSE if the
# samba-doc package is installed.
#[global]
# workgroup = DOM-AIN
# passdb backend = tdbsam
# printing = cups
# printcap name = cups
# printcap cache time = 750
# cups options = raw
# map to guest = Bad User
# logon path = \\%L\profiles\.msprofile
# logon home = \\%L\%U\.9xprofile
# logon drive = P:
# usershare allow guests = Yes
[global]
workgroup = DOM-AIN
client signing = yes
client use spnego = yes
kerberos method = secrets and keytab
realm = DOM-AIN.DOMAIN.COM
security = ADS
create krb5 conf = no
[homes]
comment = Home Directories
valid users = %S, %D%w%S
browseable = No
read only = No
inherit acls = Yes
[profiles]
comment = Network Profiles Service
path = %H
read only = No
store dos attributes = Yes
create mask = 0600
directory mask = 0700
[users]
comment = All users
path = /home
read only = No
inherit acls = Yes
veto files = /aquota.user/groups/shares/
[groups]
comment = All groups
path = /home/groups
read only = No
inherit acls = Yes
[printers]
comment = All Printers
path = /var/tmp
printable = Yes
create mask = 0600
browseable = No
[print$]
comment = Printer Drivers
path = /var/lib/samba/drivers
write list = @ntadmin root
force group = ntadmin
create mask = 0664
directory mask = 0775