使用各种 Linux 主机对一台 AD 服务器进行相当简单的设置。我们使用以下命令将 linux 主机附加到我们的域：
realm discover domain.example.com
realm join domain.example.com -U user.adm
我们的 /etc/sssd/sssd.conf 如下所示：
[sssd]
domains = domain.example.com
config_file_version = 2
services = nss, pam
[domain/domain.example.com]
ad_domain = domain.example.com
krb5_realm = DOMAIN.EXAMPLE.COM
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = false
fallback_homedir = /home/%u@%d
access_provider = simple
simple_allow_groups = [email protected]
从这里我们可以作为 linuxaccess 组一部分的 AD 用户登录。我尝试重置密码，但得到：
[username.lin@hostname ~] passwd
Current Password:
New password:
Retype new password:
Password change failed. Server message: Access denied
passwd: Authentication token manipulation error
/var/log/secure 显示：
Oct 12 14:39:48 computer passwd: pam_unix(passwd:chauthtok): user "username.lin" does not exist in /etc/passwd
Oct 12 14:40:01 computer passwd: pam_unix(passwd:chauthtok): user "username.lin" does not exist in /etc/passwd
Oct 12 14:40:01 computer passwd: pam_sss(passwd:chauthtok): Password change failed for user username.lin: 20 (Authentication token manipulation error)
考虑一下为什么似乎不支持更改密码或者可能存在什么配置错误？猜测 pam.d 中的某些内容但不自信。