我正在测试 SSSD RedHat 7.2 与 Windows Server 2016 (AD) 的集成。我想使用特定组 (allow_ssh_admin) 中的 AD 用户通过 SSH 进行访问。我已经配置了一些文件,我可以在 AD 中看到机器,但我无法使用 SSH 连接进行访问。
配置
sssd.conf
[sssd]
domains = ad.domain.com
config_file_version = 2
services = nss, pam
[domain/ad.domain.com]
id_provider = ad
auth_provider = ad
access_provider = ad
default_shell = /bin/bash
fallback_homedir = /home/%d/%u
use_fully_qualified_names = True
# Uncomment if you want to use POSIX UIDs and GIDs set on the AD side
ldap_id_mapping = True
smb配置文件
[global]
workgroup = AD
security = ADS
# WARNING: The setting 'security=ads' should NOT be combined with the 'password server' parameter.
# password server = MACHINENAME.AD.DOMAIN.COM
realm = AD.DOMAIN.COM
log file = /var/log/samba/%m.log
max log size = 50
template shell = /bin/bash
# 'winbind separator = +' might cause problems with group membership.
# winbind separator = +
winbind enum users = Yes
winbind enum groups = Yes
winbind use default domain = Yes
template homedir = /home/%D/%U
idmap config AD : schema_mode = rfc2307
idmap config AD : range = 10000000-29999999
idmap config AD : default = yes
idmap config AD : backend = rid
idmap config * : range = 20000-29999
idmap config * : backend = tdb
nsswitch.conf
passwd: files sss winbind
shadow: files sss winbind
group: files sss winbind
hosts: files dns myhostname
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files sss
netgroup: files sss
publickey: nisplus
automount: files
aliases: files nisplus
此外,我在 AD 中创建了一个组 (allow_ssh_admin),并向该组分配了一个用户。我修改了 ssh conf 以允许访问该组:
sshd_配置
[...]
AllowGroups root DOMAIN\allow_ssh_admin
当我尝试通过 ssh 访问时......
login as: DOMAIN\User
DOMAIN\User@ip password:
我在安全日志上收到此错误:
Mar 27 05:21:13 machine sshd[20175]: User User from IP not allowed because none of user's groups are listed in AllowGroups
Mar 27 05:21:13 machine sshd[20175]: input_userauth_request: invalid user DOMAIN\\\\User [preauth]
Mar 27 05:21:23 machine sshd[20175]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=IP user=DOMAIN\User
Mar 27 05:21:23 machine sshd[20175]: pam_sss(sshd:auth): received for user DOMAIN\User: 10 (User not known to the underlying authentication module)
Mar 27 05:21:23 machine sshd[20175]: Failed password for invalid user DOMAIN\\User from IP port 53406 ssh2
还有一件事。我可以看到机器加入 AD,我可以以 root 用户身份访问,我可以使用wbinfo --域用户和wbinfo --域组我获得了用户和群组信息,所以......这很奇怪。
有人能帮助我吗?
多谢
答案1
问题是 Windows Server 2016 有三个接口和三个不同的 IP。(10.xxx、125.xxx、192.xxx)。
它没有任何 DNS 策略,因此如果它尝试连接到服务器,每次我启动 ping 时它都会通过不同的接口进行回复。
主机三次中有两次无法连接到服务器。
删除与其他网络(125.xxx 和 192.xxx)相关的 DNS 条目是可行的,因为我想要来自 10.xxx 的响应
谢谢