☰

Kerberos KDC 无法启动：凭据无效

tag-icon • tag-icon linux debian ldap openldap kerberos
Kerberos KDC 无法启动：凭据无效

我的 kerberos 服务器（LDAP 后端）出了问题。我想重新启动 KDC 服务，但失败了。它已经运行了好几个星期了。

由于我刚刚调整了 LDAP ACL，因此我尝试了以下命令：

$ slapacl -D cn=kdc-srv,ou=krb5,dc=example,dc=org -b ou=krb5,dc=example,dc=org entry/read
authcDN: "cn=kdc-srv,ou=krb5,dc=example,dc=org"
read access to entry: ALLOWED

-

$ ldapsearch -b ou=krb5,dc=example,dc=org -D 'cn=kdc-srv,ou=krb5,dc=example,dc=org' -W
Enter LDAP Password: 
ldap_bind: Invalid credentials (49)

-

第二条命令的结果对我来说毫无意义。它怎么能被允许却仍然失败呢？

编辑：如果我这样做：

ldapsearch -Y EXTERNAL -H ldapi:// -b ou=krb5,dc=example,dc=org -D 'cn=kdc-srv,ou=krb5,dc=example,dc=org' -W

我明白了No such object (32)。

-

我首先将 LDAP 目录中的 KDC DN 密码与存储的密码进行比较，/etc/krb5kdc/service.keyfile发现它们是相同的。

以下是尝试重新启动 KDC 时的日志：

systemd: Starting Kerberos 5 Key Distribution Center...
-- Subject: Unit krb5-kdc.service has begun start-up
-- Defined-By: systemd
-- Support: https://www.debian.org/support
-- 
-- Unit krb5-kdc.service has begun starting up.
krb5kdc: Couldn't open log file /var/log/krb5/kdc.log: Read-only file system
slapd: conn=1055 fd=14 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
slapd: conn=1055 op=0 BIND dn="" method=128
slapd: conn=1055 op=0 RESULT tag=97 err=0 text=
slapd: conn=1055 op=1 SRCH base="" scope=0 deref=0 filter="(objectClass=*)"
slapd: conn=1055 op=1 SRCH attr=supportedFeatures
slapd: conn=1055 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
slapd: conn=1055 op=2 UNBIND
slapd: conn=1055 fd=14 closed
slapd: conn=1056 fd=14 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
slapd: conn=1056 op=0 BIND dn="cn=kdc-srv,ou=krb5,dc=example,dc=org" method=128
slapd: conn=1056 op=0 RESULT tag=97 err=49 text=
krb5kdc: Cannot bind to LDAP server 'ldapi://' as 'cn=kdc-srv,ou=krb5,dc=example,dc=org': Invalid credentials - while initializing database for realm EXAMPLE.ORG
krb5kdc: krb5kdc: cannot initialize realm EXAMPLE.ORG - see log file for details
systemd: krb5-kdc.service: Control process exited, code=exited status=1
systemd: Failed to start Kerberos 5 Key Distribution Center.
-- Subject: Unit krb5-kdc.service has failed
-- Defined-By: systemd
-- Support: https://www.debian.org/support
-- 
-- Unit krb5-kdc.service has failed.
-- 
-- The result is failed.
systemd]: krb5-kdc.service: Unit entered failed state.
systemd: krb5-kdc.service: Failed with result 'exit-code'.
slapd: conn=1056 fd=14 closed (connection lost)

-

以下是 LDAP ACL：

olcAccess: {0}to dn.subtree="ou=krb5,dc=example,dc=org"
  by dn.exact="cn=adm-srv,ou=krb5,dc=example,dc=org" write
  by dn.exact="cn=kdc-srv,ou=krb5,dc=example,dc=org" read
  by * none
olcAccess: {1}to attrs=userPassword,shadowLastChange
  by dn.exact="cn=other,dc=example,dc=org" write
  by anonymous auth
  by * none
olcAccess: {2}to dn.subtree="ou=people,dc=example,dc=org"
  by dn.exact="cn=other,dc=example,dc=org" write
  ...
  by * none
...
olcAccess: {6}to dn.subtree="ou=systems,dc=example,dc=org"
  by dn.exact="cn=other,dc=example,dc=org" write
  ...
  by * none
olcAccess: {7}to dn.base=""
  by * read
olcAccess: {8}to *
  by dn.exact="cn=other,dc=example,dc= org" write
  by users search
  by * none

有任何想法吗？

答案1

ACL 错误。我by anonymous auth在第一行中添加了一行：

olcAccess: {0}to dn.subtree="ou=krb5,dc=example,dc=org"
  by dn.exact="cn=adm-srv,ou=krb5,dc=example,dc=org" write
  by dn.exact="cn=kdc-srv,ou=krb5,dc=example,dc=org" read
  by anonymous auth
  by * none

相关内容