getent 组失败,但 getent passwd 可以工作

getent 组失败,但 getent passwd 可以工作

我在服务器 2019 上运行一个 AD 服务器。我刚刚设置了一个 Linux 机箱并配置了 samba,出于某种原因,我无法让 getent 组“域管理员”显示任何内容。如果我执行 getent passwd Administrator,它确实有效,并且 wbinfo -u 或 wbinfo --domain-groups 也能正常工作。

服务管理控制台

[global]
        server role = MEMBER SERVER
        security = ADS
        realm = TESTLAB.COM
        workgroup = TESTLAB
        dedicated keytab file = /etc/krb5.keytab
        kerberos method = secrets and keytab
        server string = Samba 4 %h
        log file = /var/log/samba/%m.log
        log level = 5
        idmap config * : backend = tdb
        idmap config * : range = 10000-20000
        idmap config TESTLAB : backend = rid
        idmap config TESTLAB : range = 30000-40000
        idmap config TESTLAB : backend = ad
        password server = adsrv1.testlab.com
        encrypt passwords = yes
        winbind refresh tickets = yes
        winbind offline logon = yes
        winbind enum users = yes
        winbind enum groups = yes
        winbind nested groups = yes
        winbind expand groups = 4
        winbind use default domain = yes
        #winbind normalize name = yes
        os level = 20
        domain master = no
        local master = yes
        preferred master = no
        map to guest = bad user
        host msdfs = no
        netbios name = smbsrv
        client min protocol = SMB2
        client max protocol = SMB3
        client ldap sasl wrapping = plain
        hosts allow = 10.0.0.0/16
        unix extensions = no
        reset on zero vc = yes
        veto files = /.bash_logout/.bash_profile/.bash_history/.bashrc/
        hide unreadable = yes
        acl group control = yes
        acl map full control = true
        ea support = yes
        vfs objects = acl_xattr
        store dos attributes = yes
        #dos flemode = yes
        dos filetimes = yes
        enable privileges = yes
        restrict anonymous = 2
        strict allocate = yes
        guest ok = no
        load printers = no
        printing = bsd
        printcap name = /dev/null
        disable spoolss = yes
        username map = /etc/samba/user.map
        template shell = /bin/bash
        template homedir = /home/TESTLAB/%U
[Data]
        comment = "User Data"
        path = /mnt/data
        create mask = 0770
        browseable = yes
        writable = yes
        valid users = @"Domain Admins" @"Domain Users"
        write list = @"Domain Admins" @"Domain Users"

NS交换机配置文件

passwd:         compat files winbind sss
group:          compat files windind sss
shadow:         compat files sss
gshadow:        files

hosts:          files dns mdns4_minimal [NOTFOUND=return] mdns4
networks:       files

protocols:      db files
services:       db files sss
ethers:         db files
rpc:            db files

netgroup:       nis sss
sudoers:        files sss

KRB5配置文件

[libdefaults]
        default_realm = testlab.com
        dns_lookup_realm = false
        dns_lookup_kdc = true

# The following krb5.conf variables are only for MIT Kerberos.
        kdc_timesync = 1
        ccache_type = 4
        forwardable = true
        proxiable = true

# The following libdefaults parameters are only for Heimdal Kerberos.
        fcc-mit-ticketflags = true

[realms]
        testlab.com = {
                kdc = adsrv1.testlab.com
                admin_server = adsrv1.testlab.com
        }
        ATHENA.MIT.EDU = {
                kdc = kerberos.mit.edu
                kdc = kerberos-1.mit.edu
                kdc = kerberos-2.mit.edu:88
                admin_server = kerberos.mit.edu
                default_domain = mit.edu
        }
        ZONE.MIT.EDU = {
                kdc = casio.mit.edu
                kdc = seiko.mit.edu
                admin_server = casio.mit.edu
        }
        CSAIL.MIT.EDU = {
                admin_server = kerberos.csail.mit.edu
                default_domain = csail.mit.edu
        }
        IHTFP.ORG = {
                kdc = kerberos.ihtfp.org
                admin_server = kerberos.ihtfp.org
        }
        1TS.ORG = {
                kdc = kerberos.1ts.org
                admin_server = kerberos.1ts.org
        }
        ANDREW.CMU.EDU = {
                admin_server = kerberos.andrew.cmu.edu
                default_domain = andrew.cmu.edu
        }
        CS.CMU.EDU = {
                kdc = kerberos-1.srv.cs.cmu.edu
                kdc = kerberos-2.srv.cs.cmu.edu
                kdc = kerberos-3.srv.cs.cmu.edu
                admin_server = kerberos.cs.cmu.edu
        }
        DEMENTIA.ORG = {
                kdc = kerberos.dementix.org
                kdc = kerberos2.dementix.org
                admin_server = kerberos.dementix.org
        }
        stanford.edu = {
                kdc = krb5auth1.stanford.edu
                kdc = krb5auth2.stanford.edu
                kdc = krb5auth3.stanford.edu
                master_kdc = krb5auth1.stanford.edu
                admin_server = krb5-admin.stanford.edu
                default_domain = stanford.edu
        }
        UTORONTO.CA = {
                kdc = kerberos1.utoronto.ca
                kdc = kerberos2.utoronto.ca
                kdc = kerberos3.utoronto.ca
                admin_server = kerberos1.utoronto.ca
                default_domain = utoronto.ca
        }

[domain_realm]
        .mit.edu = ATHENA.MIT.EDU
        mit.edu = ATHENA.MIT.EDU
        .media.mit.edu = MEDIA-LAB.MIT.EDU
        media.mit.edu = MEDIA-LAB.MIT.EDU
        .csail.mit.edu = CSAIL.MIT.EDU
        csail.mit.edu = CSAIL.MIT.EDU
        .whoi.edu = ATHENA.MIT.EDU
        whoi.edu = ATHENA.MIT.EDU
        .stanford.edu = stanford.edu
        .slac.stanford.edu = SLAC.STANFORD.EDU
        .toronto.edu = UTORONTO.CA
        .utoronto.ca = UTORONTO.CA
        .testlab.com = TESTLAB.COM

SSSD配置文件

[sssd]
config_file_version = 2
services = nss, pam
domains = TESTLAB
# SSSD will not start if you do not configure any domains.
# Add new domain configurations as [domain/<NAME>] sections, and
# then add the list of domains (in the order you want them to be
# queried) to the "domains" attribute below and uncomment it.
; domains = LDAP

[nss]

[pam]

# Example LDAP domain
[TESTLAB.COM/LDAP]
id_provider = ldap
auth_provider = ldap
# ldap_schema can be set to "rfc2307", which stores group member names in the
# "memberuid" attribute, or to "rfc2307bis", which stores group member DNs in
# the "member" attribute. If you do not know this value, ask your LDAP
# administrator.
ldap_schema = rfc2307
ldap_uri = ldap://ldap.testlab.com
ldap_search_base = dc=testlab,dc=com
# Note that enabling enumeration will have a moderate performance impact.
# Consequently, the default value for enumeration is FALSE.
# Refer to the sssd.conf man page for full details.
enumerate = true
# Allow offline logins by locally storing password hashes (default: false).
cache_credentials = true

# An example Active Directory domain. Please note that this configuration
# works for AD 2003R2 and AD 2008, because they use pretty much RFC2307bis
# compliant attribute names. To support UNIX clients with AD 2003 or older,
# you must install Microsoft Services For Unix and map LDAP attributes onto
# msSFU30* attribute names.
[domain/TESTLAB]
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5

ldap_uri = ldap://ldap.testlab.com
ldap_search_base = dc=testlab,dc=com
ldap_schema = rfc2307bis
ldap_sasl_mech = GSSAPI
ldap_user_object_class = user
ldap_group_object_class = group
ldap_user_home_directory = unixHomeDirectory
ldap_user_principal = userPrincipalName
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = true

krb5_server = 10.0.0.10
krb5_realm = TESTLAB.COM

答案1

首先要尝试的是纠正 nsswitch.conf 文件中组解析的拼写错误。

group:          compat files windind sss

...应该...

group:          compat files winbind sss

相关内容