![SSSD 身份验证](https://linux22.com/image/568139/SSSD%20%E8%BA%AB%E4%BB%BD%E9%AA%8C%E8%AF%81.png)
我刚刚构建了一个运行 OpenSuSE 12.1 的测试服务器,并正在尝试学习如何配置 sssd,但不确定从哪里开始查找为什么我的配置不允许我进行身份验证。
server:/etc/sssd # cat sssd.conf
[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss,pam
domains = test.local
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
[pam]
reconnection_retries = 3
# Section created by YaST
[domain/test.local]
access_provider = ldap
ldap_uri = ldap://server.test.local
ldap_search_base = dc=test,dc=local
ldap_schema = rfc2307bis
id_provider = ldap
ldap_user_uuid = entryuuid
ldap_group_uuid = entryuuid
ldap_id_use_start_tls = True
enumerate = False
cache_credentials = True
chpass_provider = krb5
auth_provider = krb5
krb5_realm = TEST.LOCAL
krb5_kdcip = server.test.local
server:/etc # cat ldap.conf
base dc=test,dc=local
bind_policy soft
pam_lookup_policy yes
pam_password exop
nss_initgroups_ignoreusers root,ldap
nss_schema rfc2307bis
nss_map_attribute uniqueMember member
ssl start_tls
uri ldap://server.test.local
ldap_version 3
pam_filter objectClass=posixAccount
server:/etc # cat nsswitch.conf
passwd: compat sss
group: files sss
hosts: files dns
networks: files dns
services: files
protocols: files
rpc: files
ethers: files
netmasks: files
netgroup: files
publickey: files
bootparams: files
automount: files ldap
aliases: files
shadow: compat
server:/etc # cat krb5.conf
[libdefaults]
default_realm = TEST.LOCAL
clockskew = 300
[realms]
TEST.LOCAL = {
kdc = server.test.local
admin_server = server.test.local
database_module = ldap
default_domain = test.local
}
[logging]
kdc = FILE:/var/log/krb5/krb5kdc.log
admin_server = FILE:/var/log/krb5/kadmind.log
default = SYSLOG:NOTICE:DAEMON
[dbmodules]
ldap = {
db_library = kldap
ldap_kerberos_container_dn = cn=krbContainer,dc=test,dc=local
ldap_kdc_dn = cn=Administrator,dc=test,dc=local
ldap_kadmind_dn = cn=Administrator,dc=test,dc=local
ldap_service_password_file = /etc/openldap/ldap-pw
ldap_servers = ldaps://server.test.local
}
[domain_realm]
.test.local = TEST.LOCAL
[appdefaults]
pam = {
ticket_lifetime = 1d
renew_lifetime = 1d
forwardable = true
proxiable = false
minimum_uid = 1
clockskew = 300
external = sshd
use_shmem = sshd
}
如果我以 root 身份登录到服务器,我可以 su 到 ldap 用户,但是如果我尝试在本地进行控制台操作或远程进行 ssh 操作,则无法进行身份验证。
getent 不显示用户的 ldap 条目,我不确定是否需要查看 LDAP、nsswitch 或其他什么:
server:~ # ssh localhost -l test
Password:
Password:
Password:
Permission denied (publickey,keyboard-interactive).
server:~ # su test
test@server:/etc> id
uid=1000(test) gid=100(users) groups=100(users)
server:~ # tail /var/log/messages
Nov 24 09:36:44 server login[14508]: pam_sss(login:auth): system info: [Client not found in Kerberos database]
Nov 24 09:36:44 server login[14508]: pam_sss(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=/dev/ttyS1 ruser= rhost= user=test
Nov 24 09:36:44 server login[14508]: pam_sss(login:auth): received for user test: 4 (System error)
Nov 24 09:36:44 server login[14508]: FAILED LOGIN SESSION FROM /dev/ttyS1 FOR test, System error
server:~ # vi /etc/pam.d/common-auth
auth required pam_env.so
auth sufficient pam_unix2.so
auth required pam_sss.so use_first_pass
server:~ # vi /etc/pam.d/sshd
auth requisite pam_nologin.so
auth include common-auth
account requisite pam_nologin.so
account include common-account
password include common-password
session required pam_loginuid.so
session include common-session
session optional pam_lastlog.so silent noupdate showfailed
答案1
您尚未配置您的接入提供商。
您已配置access_provider = ldap
,但尚未ldap_access_filter
在任何地方进行配置。
从该选项的手册页中ldap_access_filter
:
如果 access_provider = ldap 且未设置此选项,则导致所有用户被拒绝访问。
我会完全删除该access_provider
选项,直到您拥有一个可用的配置。从简单开始,然后逐步构建 :-)
。
注意:可能还存在 kerberos 问题。从您发布的错误日志来看,情况确实如此。但尽管我不知道 kerberos 是否导致了问题,但我知道这是(此答案涵盖的内容)。
答案2
在我看来,这看起来像是 PAM 配置问题。
确保引用带有 sssd 模块的/etc/pam.d/sshd
文件(带有@
指令)或直接包含它。