☰

Centos 7 加入了 AWS 简单广告但无法查询用户

tag-icon • tag-icon active-directory centos7 sssd aws-directory-service
Centos 7 加入了 AWS 简单广告但无法查询用户

出于对一切神圣事物的热爱——我已经连续坚持了整整 12 个小时。

我已将我的 centos 机器添加到 AWS 中的简单 AD 服务中。按照此处概述的步骤操作

https://docs.aws.amazon.com/directoryservice/latest/adminguide/join_windows_instance.html

然后在这里添加了一个“testuser” https://aws.amazon.com/blogs/security/how-to-manage-identities-in-simple-ad-directories/

我可以看到该领域已正确配置

[root@testhost home]# realm discover corp.example.com
  type: kerberos
  realm-name: CORP.EXAMPLE.COM
  domain-name: corp.example.com
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd
  required-package: adcli
  required-package: samba-common-tools
  login-formats: %[email protected]
  login-policy: allow-realm-logins

realm list命令也有效并显示相同的信息

我可以通过以下方式查看我的用户列表

[root@testhost home]# net ads user -S corp.example.com
AWSAdminD-97672D7BEE
Administrator
testuser
krbtgt
Guest

但是当使用 id 命令查询用户时

[root@testhost home]# id [email protected]
id: [email protected]: no such user

我的 krb5.conf 是

 [libdefaults]
  dns_lookup_realm = false
  dns_lookup_kdc = false
  ticket_lifetime = 24h
  renew_lifetime = 7d
  forwardable = true
  rdns = false
  pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
  default_ccache_name = KEYRING:persistent:%{uid}
  default_realm = CORP.EXAMPLE.COM

 [realms]
   CORP.EXAMPLE.COM = {
    default_domain = corp.example.com
      kdc = corp.example.com
      admin_server = corp.example.com
   }

  [domain_realm]
    corp.example.com = CORP.EXAMPLE.COM
   .corp.example.com = CORP.EXAMPLE.COM

我的 SSSD.conf 是

 [sssd]
 domains = corp.example.com
 config_file_version = 2
 services = nss, pam
 debug_level = 9
 default_domain_suffix = corp.example.com

 [domain/corp.example.com]
 enumerate = True
 ad_server = corp.example.com
 ad_domain = corp.example.com
 krb5_realm = CORP.EXAMPLE.COM
 realmd_tags = manages-system joined-with-adcli
 cache_credentials = False
 id_provider = ad
 krb5_store_password_if_offline = True
 default_shell = /bin/bash
 ldap_id_mapping = True
 use_fully_qualified_names = True
 fallback_homedir = /home/%u@%d
 access_provider = ad
 debug_level = 9

我的日志在 /var/log/messages 中显示了这一点 - 可能是个幌子……不确定

sssd[be[corp.example.com]]: GSSAPI 错误：未指定的 GSS 故障。次要代码可能提供更多信息（Kerberos 数据库中未找到服务器）

/var/log/sssd/sssd_corp.example.com.log当我为用户发出 ID 请求时，显示以下内容

(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_attach_req] (0x0400): DP Request [Account #145]: New request. Flags [0x0001].
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_attach_req] (0x0400): Number of active DP request: 1
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [sss_domain_get_state] (0x1000): Domain corp.example.com is Active
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [_dp_req_recv] (0x0400): DP Request [Account #145]: Receiving request data.
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_req_reply_gen_error] (0x0080): DP Request [Account #145]: Finished. Backend is currently offline.
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:1::corp.example.com:[email protected]] from reply table
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_req_destructor] (0x0400): DP Request [Account #145]: Request removed.
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_req_destructor] (0x0400): Number of active DP request: 0
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [sbus_dispatch] (0x4000): dbus conn: 0x56430d094580
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [sbus_dispatch] (0x4000): Dispatching.
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [sbus_message_handler] (0x2000): Received SBUS method org.freedesktop.sssd.dataprovider.getAccountInfo on path /org/freedesktop/sssd/dataprovider
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][[email protected]]
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_attach_req] (0x0400): DP Request [Account #146]: New request. Flags [0x0001].
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_attach_req] (0x0400): Number of active DP request: 1
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [sss_domain_get_state] (0x1000): Domain corp.example.com is Active
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [_dp_req_recv] (0x0400): DP Request [Account #146]: Receiving request data.
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_req_reply_gen_error] (0x0080): DP Request [Account #146]: Finished. Backend is currently offline.
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:1:U:corp.example.com:[email protected]] from reply table

为什么添加到领域后我无法列出来自 AD 的用户？

答案1

通过将 DNS 服务器添加到

/etc/resolv.conf

nameserver <dns1>
nameserver <dns2>

而不是将域 corp.example.com 映射到内部的 KDC/AD 目录地址的 IP/etc/hosts

相关内容