☰

为什么 sssd 会破坏已加入 AD 的 CentOS 的 PTR 记录

tag-icon • tag-icon centos active-directory kerberos reverse-dns sssd
为什么 sssd 会破坏已加入 AD 的 CentOS 的 PTR 记录

我有一个加入了 AD 域的 CENTOS 7 盒子 - 称之为centosbox。

每当 SSSD 启动时，它都会更新 DNS 记录，这对我来说没问题，但它会破坏 PTR 记录，因为会使它们指向 justcentosbox.而不是centosbox.my.domain.ext.，这会破坏许多与 kerberos 相关的东西，因为现在反向 DNS 已经被破坏了。

此框中主机名的输出为：

#hostname -f
centosbox.my.domain.ext

我如何才能让它为 PTR 记录注册正确的值？

sssd.conf：

[sssd]
domains = my.domain.ext
config_file_version = 2
services = nss, pam, sudo

[domain/my.domain.ext]
ad_domain = my.domain.ext
krb5_realm = MY.DOMAIN.EXT
realmd_tags = joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%d/%u
access_provider = ad
sudo_provider = ldap

ldap_uri = ldap://my.domain.ext
ldap_tls_cacert = /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
ldap_group_search_base = DC=my,DC=domain,DC=ext    
ldap_sudo_search_base = OU=sudoers,DC=my,DC=domain,DC=ext
ldap_sasl_mech = GSSAPI
ldap_sasl_authid = [email protected]

[sudo]

krb5.conf：

includedir /etc/krb5.conf.d/

includedir /var/lib/sss/pubconf/krb5.include.d/
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_realm = true
 dns_lookup_kdc = true
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = true
 default_ccache_name = KEYRING:persistent:%{uid}

 default_realm = MY.DOMAIN.EXT
[realms]
 MY.DOMAIN.EXT = {
 }

[domain_realm]
 my.domain.ext = MY.DOMAIN.EXT
 .my.domain.ext = MY.DOMAIN.EXT

附加信息：

sssd ldap_child.log 文件包含大量以下内容：

(Mon Jun 18 21:01:40 2018) [[sssd[ldap_child[2245]]]] [ldap_child_get_tgt_sync] (0x0010): Failed to init credentials: Client 'host/[email protected]' not found in Kerberos database
(Mon Jun 18 21:01:40 2018) [[sssd[ldap_child[2246]]]] [ldap_child_get_tgt_sync] (0x0010): Failed to init credentials: Client 'host/[email protected]' not found in Kerberos database
(Mon Jun 18 21:01:40 2018) [[sssd[ldap_child[2247]]]] [ldap_child_get_tgt_sync] (0x0010): Failed to init credentials: Client 'host/[email protected]' not found in Kerberos database
(Mon Jun 18 21:02:51 2018) [[sssd[ldap_child[2256]]]] [ldap_child_get_tgt_sync] (0x0010): Failed to init credentials: Client 'host/[email protected]' not found in Kerberos database
(Mon Jun 18 21:02:51 2018) [[sssd[ldap_child[2257]]]] [ldap_child_get_tgt_sync] (0x0010): Failed to init credentials: Client 'host/[email protected]' not found in Kerberos database
(Mon Jun 18 21:02:51 2018) [[sssd[ldap_child[2258]]]] [ldap_child_get_tgt_sync] (0x0010): Failed to init credentials: Client 'host/[email protected]' not found in Kerberos database

好吧，这显然是错误的，因为：

[root@centosbox sssd]#klist -ke
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   4 [email protected] (arcfour-hmac)
   4 [email protected] (aes128-cts-hmac-sha1-96)
   4 [email protected] (aes256-cts-hmac-sha1-96)
   4 host/[email protected] (arcfour-hmac)
   4 host/[email protected] (aes128-cts-hmac-sha1-96)
   4 host/[email protected] (aes256-cts-hmac-sha1-96)
   4 host/[email protected] (arcfour-hmac)
   4 host/[email protected] (aes128-cts-hmac-sha1-96)
   4 host/[email protected] (aes256-cts-hmac-sha1-96)

这是怎么回事？

答案1

我怀疑您正遭受 Redhat 建议要求设置 FQDN 主机名的困扰：https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/networking_guide/ch-configure_host_names

SSSD 似乎要求从主机名函数返回一个 FQDN，而无需 -f 标志。

这是一个类似的问题 https://lists.fedorahosted.org/archives/list/[电子邮件保护]/线程/QHBRCO2JR36PT5F4ZPZNGUHCEE5E4G42/

相关内容