我有x2go 服务器安装在 CentOS 7 上。我可以使用本地系统用户帐户毫无问题地创建 x2go 客户端会话。该服务器还允许通过以下方式登录 Active DirectoryPBIS 公开赛我可以使用 Active Directory 帐户 ssh 到服务器。但是，如果我尝试使用 AD 帐户启动 x2go 会话，该会话就会挂起。
以下是 /var/log/secure 的内容：
Jun 11 12:11:57 my-server sshd[20288]: Connection from x.x.x.x port 37844 on y.y.y.y port 22
Jun 11 12:11:57 my-server sshd[20288]: Postponed keyboard-interactive for <username> from x.x.x.x port 37844 ssh2 [preauth]
Jun 11 12:11:57 my-server sshd[20478]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.x.x.x user=<username>
Jun 11 12:11:58 my-server sshd[20288]: Postponed keyboard-interactive/pam for <username> from x.x.x.x port 37844 ssh2 [preauth]
Jun 11 12:11:58 my-server sshd[20288]: Accepted keyboard-interactive/pam for <username> from x.x.x.x port 37844 ssh2
Jun 11 12:11:58 my-server sshd[20288]: pam_unix(sshd:session): session opened for user <username> by (uid=0)
Jun 11 12:11:58 my-server sshd[20288]: User child is on pid 21148
Jun 11 12:11:58 my-server sshd[21148]: Starting session: command for <username> from x.x.x.x port 37844
Jun 11 12:11:59 my-server sshd[21148]: Starting session: command for <username> from x.x.x.x port 37844
这是我的 /etc/pam.d/sshd：
auth required pam_sepermit.so
auth substack password- auth
auth include postlogin
# Used with polkit to re authorize users in remote sessions
-auth optional pam_re authorize.so prepare
account required pam_nologin.so
account include password- auth
password include password- auth
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session required pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session required pam_selinux.so open env_params
session required pam_namespace.so
session optional pam_keyinit.so force revoke
session include password- auth
session include postlogin
# Used with polkit to re authorize users in remote sessions
-session optional pam_re authorize.so prepare
session sufficient pam_lsass.so
这是我的 /etc/pam.d/system-auth-ac：
auth required pam_env.so
auth requisite pam_lsass.so smartcard_prompt try_first_pass
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_lsass.so try_first_pass
auth required pam_deny.so
account required pam_lsass.so unknown_ok
account sufficient pam_lsass.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account required pam_permit.so
password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_ authtok
password sufficient pam_lsass.so try_first_pass use_ authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
我认为这是我的 PAM 设置的问题，因为 /var/log/secure 中的身份验证失败行，但我无论如何也搞不清楚发生了什么，因为会话似乎启动了，但随后失败了。任何建议都将不胜感激！
答案1
好吧，PAM 身份验证失败实际上是一个转移注意力的借口，因为会话仍在进行身份验证。问题是由于我们在创建会话时使用了数字 AD 用户名，而这些用户名已被 x2go 过滤掉，因此它会挂起。
根据 Martyn Welch 的建议这里，我编辑了sanitizer子目录中的第 67 行/usr/lib64/x2go/x2gosqlitewrapper.pl，并将其从
if ($string =~ /^([a-zA-Z\_][a-zA-Z0-9\_\-\.\@]{0,47}[\$]?)\-([\d]{2,4})\-([\d]{9,12})\_[a-zA-Z0-9\_\-\.]*\_dp[\d]{1,2}$/) {
到
if ($string =~ /^([a-zA-Z0-9\_][a-zA-Z0-9\_\-\.\@]{0,47}[\$]?)\-([\d]{2,4})\-([\d]{9,12})\_[a-zA-Z0-9\_\-\.]*\_dp[\d]{1,2}$/) {
正则表达式的开头有一个多余的“0-9”。谢谢 Martyn Welch，你让我免于更多心痛的日子！