![Centos 7 加入了 AWS 简单广告但无法查询用户](https://linux22.com/image/739675/Centos%207%20%E5%8A%A0%E5%85%A5%E4%BA%86%20AWS%20%E7%AE%80%E5%8D%95%E5%B9%BF%E5%91%8A%E4%BD%86%E6%97%A0%E6%B3%95%E6%9F%A5%E8%AF%A2%E7%94%A8%E6%88%B7.png)
出于对一切神圣事物的热爱——我已经连续坚持了整整 12 个小时。
我已将我的 centos 机器添加到 AWS 中的简单 AD 服务中。按照此处概述的步骤操作
https://docs.aws.amazon.com/directoryservice/latest/adminguide/join_windows_instance.html
然后在这里添加了一个“testuser” https://aws.amazon.com/blogs/security/how-to-manage-identities-in-simple-ad-directories/
我可以看到该领域已正确配置
[root@testhost home]# realm discover corp.example.com
type: kerberos
realm-name: CORP.EXAMPLE.COM
domain-name: corp.example.com
configured: kerberos-member
server-software: active-directory
client-software: sssd
required-package: oddjob
required-package: oddjob-mkhomedir
required-package: sssd
required-package: adcli
required-package: samba-common-tools
login-formats: %[email protected]
login-policy: allow-realm-logins
realm list
命令也有效并显示相同的信息
我可以通过以下方式查看我的用户列表
[root@testhost home]# net ads user -S corp.example.com
AWSAdminD-97672D7BEE
Administrator
testuser
krbtgt
Guest
但是当使用 id 命令查询用户时
[root@testhost home]# id [email protected]
id: [email protected]: no such user
我的 krb5.conf 是
[libdefaults]
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
default_ccache_name = KEYRING:persistent:%{uid}
default_realm = CORP.EXAMPLE.COM
[realms]
CORP.EXAMPLE.COM = {
default_domain = corp.example.com
kdc = corp.example.com
admin_server = corp.example.com
}
[domain_realm]
corp.example.com = CORP.EXAMPLE.COM
.corp.example.com = CORP.EXAMPLE.COM
我的 SSSD.conf 是
[sssd]
domains = corp.example.com
config_file_version = 2
services = nss, pam
debug_level = 9
default_domain_suffix = corp.example.com
[domain/corp.example.com]
enumerate = True
ad_server = corp.example.com
ad_domain = corp.example.com
krb5_realm = CORP.EXAMPLE.COM
realmd_tags = manages-system joined-with-adcli
cache_credentials = False
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
debug_level = 9
我的日志在 /var/log/messages 中显示了这一点 - 可能是个幌子……不确定
sssd[be[corp.example.com]]: GSSAPI 错误:未指定的 GSS 故障。次要代码可能提供更多信息(Kerberos 数据库中未找到服务器)
/var/log/sssd/sssd_corp.example.com.log
当我为用户发出 ID 请求时,显示以下内容
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_attach_req] (0x0400): DP Request [Account #145]: New request. Flags [0x0001].
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_attach_req] (0x0400): Number of active DP request: 1
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [sss_domain_get_state] (0x1000): Domain corp.example.com is Active
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [_dp_req_recv] (0x0400): DP Request [Account #145]: Receiving request data.
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_req_reply_gen_error] (0x0080): DP Request [Account #145]: Finished. Backend is currently offline.
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:1::corp.example.com:[email protected]] from reply table
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_req_destructor] (0x0400): DP Request [Account #145]: Request removed.
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_req_destructor] (0x0400): Number of active DP request: 0
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [sbus_dispatch] (0x4000): dbus conn: 0x56430d094580
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [sbus_dispatch] (0x4000): Dispatching.
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [sbus_message_handler] (0x2000): Received SBUS method org.freedesktop.sssd.dataprovider.getAccountInfo on path /org/freedesktop/sssd/dataprovider
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][[email protected]]
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_attach_req] (0x0400): DP Request [Account #146]: New request. Flags [0x0001].
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_attach_req] (0x0400): Number of active DP request: 1
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [sss_domain_get_state] (0x1000): Domain corp.example.com is Active
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [_dp_req_recv] (0x0400): DP Request [Account #146]: Receiving request data.
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_req_reply_gen_error] (0x0080): DP Request [Account #146]: Finished. Backend is currently offline.
(Sat Jun 29 20:27:21 2019) [sssd[be[corp.example.com]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:1:U:corp.example.com:[email protected]] from reply table
为什么添加到领域后我无法列出来自 AD 的用户?
答案1
通过将 DNS 服务器添加到
/etc/resolv.conf
nameserver <dns1>
nameserver <dns2>
而不是将域 corp.example.com 映射到内部的 KDC/AD 目录地址的 IP/etc/hosts