☰

centos 8-sssd 配置未获取 ldap 用户的影子内容

tag-icon • tag-icon ssh ldap openldap sssd centos8
centos 8-sssd 配置未获取 ldap 用户的影子内容

我在 centos 8 上配置了 sssd，在 centos 7 上配置了 ldap。我能够使用 getent passwd 和 getent group 获取有关 testuser 的详细信息，但在测试 getent shadow 时，我没有获取有关 testuser 的任何详细信息。这导致 testuser 登录失败。我不确定哪里配置错误了。


# cat /etc/sssd/sssd.conf
[sssd]
debug_level=7
config_file_version = 2
reconnection_retries = 3
enable_files_domain = False
services = nss, pam, ssh
domains = ldap.corp.com

[nss]
debug_level=7
reconnection_retries = 3
pwfield = x
homedir_substring = /home

[pam]
debug_level=7
reconnection_retries = 3

[ssh]
debug_level=7
debug_timestamps = True

[domain/ldap.corp.com]
debug_level=7
debug_timestamps = True
description = LDAP Client Login

enumeration = true
id_provider = ldap
auth_provider = ldap
access_provider = ldap
chpass_provider = ldap

ldap_access_order = filter
ldap_access_filter = (&(objectclass=posixAccount))
ldap_id_use_start_tls = True
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_tls_reqcert = allow
ldap_uri = ldap://ldap01.corp.com
ldap_search_base = dc=corp,dc=com
ldap_default_bind_dn = cn=ldapadm,dc=corp,dc=com
ldap_default_authtok_type = password
ldap_default_authtok = xxxxxxxxx
cache_credentials = true

ldap_group_search_base = ou=Group,dc=corp,dc=com
ldap_user_search_base = ou=Users,dc=corp,dc=com
#ldap_sudo_search_base = ou=sudoers,dc=corp,dc=com
ldap_user_object_class = posixAccount
ldap_group_object_class = posixGroup
ldap_group_member = memberUid
ldap_pwd_policy = shadow

# cat /etc/authselect/password-auth
auth        required                                     pam_env.so
auth        required                                     pam_faildelay.so delay=2000000
auth        [default=1 ignore=ignore success=ok]         pam_succeed_if.so uid >= 1000 quiet
auth        [default=1 ignore=ignore success=ok]         pam_localuser.so
auth        sufficient                                   pam_unix.so nullok try_first_pass
auth        requisite                                    pam_succeed_if.so uid >= 1000 quiet_success
auth        sufficient                                   pam_sss.so forward_pass
auth        required                                     pam_deny.so

account     required                                     pam_unix.so
account     sufficient                                   pam_localuser.so
account     sufficient                                   pam_succeed_if.so uid 

# getent passwd testuser1
testuser1:x:1005:1005:testuser1:/home/testuser1:/bin/bash
# getent group testuser1
testuser1:x:1005:
# getent shadow testuser1
#

# ssh testuser1@rhel01
testuser1@rhel01's password:
Connection closed by 192.168.10.11 port 22
#

# tail /var/log/secure
Jul 23 13:23:14 rhel01 sshd[2074]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.10.11 user=testuser1
Jul 23 13:23:14 rhel01 sshd[2074]: Failed password for testuser1 from 192.168.10.11 port 49462 ssh2
Jul 23 13:23:14 rhel01 sshd[2074]: fatal: Access denied for user testuser1 by PAM account configuration [preauth]




# cat /etc/authselect/password-auth
auth        required                                     pam_env.so
auth        required                                     pam_faildelay.so delay=2000000
auth        [default=1 ignore=ignore success=ok]         pam_succeed_if.so uid >= 1000 quiet
auth        [default=1 ignore=ignore success=ok]         pam_localuser.so
auth        sufficient                                   pam_unix.so nullok try_first_pass
auth        requisite                                    pam_succeed_if.so uid >= 1000 quiet_success
auth        sufficient                                   pam_sss.so forward_pass
auth        required                                     pam_deny.so

account     required                                     pam_unix.so
account     sufficient                                   pam_localuser.so
account     sufficient                                   pam_succeed_if.so uid 

password    requisite                                    pam_pwquality.so try_first_pass local_users_only
password    sufficient                                   pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient                                   pam_sss.so use_authtok
password    required                                     pam_deny.so

session     optional                                     pam_keyinit.so revoke
session     required                                     pam_limits.so
-session    optional                                     pam_systemd.so
session     [success=1 default=ignore]                   pam_succeed_if.so service in crond quiet use_uid
session     required                                     pam_unix.so
session     optional                                     pam_sss.so

Below is the Debug log from /var/log/secure:


Jul 23 15:08:24 rhel01 sshd[3024]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.10.11 user=testuser1
Jul 23 15:08:24 rhel01 sshd[3024]: debug1: PAM: password authentication accepted for testuser1
Jul 23 15:08:24 rhel01 sshd[3024]: debug3: mm_answer_authpassword: sending result 1
Jul 23 15:08:24 rhel01 sshd[3024]: debug3: mm_request_send entering: type 13
Jul 23 15:08:24 rhel01 sshd[3024]: debug3: mm_request_receive_expect entering: type 102
Jul 23 15:08:24 rhel01 sshd[3024]: debug3: mm_request_receive entering
Jul 23 15:08:24 rhel01 sshd[3024]: debug1: do_pam_account: called
Jul 23 15:08:24 rhel01 sshd[3024]: debug2: do_pam_account: auth information in SSH_AUTH_INFO_0
Jul 23 15:08:24 rhel01 sshd[3024]: debug3: PAM: do_pam_account pam_acct_mgmt = 9 (Authentication service cannot retrieve authentication info)
Jul 23 15:08:24 rhel01 sshd[3024]: debug3: mm_request_send entering: type 103
Jul 23 15:08:24 rhel01 sshd[3024]: Failed password for testuser1 from 192.168.10.11 port 49554 ssh2
Jul 23 15:08:24 rhel01 sshd[3024]: debug3: mm_auth_password: user authenticated [preauth]
Jul 23 15:08:24 rhel01 sshd[3024]: debug3: user_specific_delay: user specific delay 0.000ms [preauth]
Jul 23 15:08:24 rhel01 sshd[3024]: debug3: ensure_minimum_time_since: elapsed 107.666ms, delaying 14.497ms (requested 7.635ms) [preauth]
Jul 23 15:08:24 rhel01 sshd[3024]: debug3: mm_do_pam_account entering [preauth]
Jul 23 15:08:24 rhel01 sshd[3024]: debug3: mm_request_send entering: type 102 [preauth]
Jul 23 15:08:24 rhel01 sshd[3024]: debug3: mm_request_receive_expect entering: type 103 [preauth]
Jul 23 15:08:24 rhel01 sshd[3024]: debug3: mm_request_receive entering [preauth]
Jul 23 15:08:24 rhel01 sshd[3024]: debug3: mm_do_pam_account returning 0 [preauth]
Jul 23 15:08:24 rhel01 sshd[3024]: fatal: Access denied for user testuser1 by PAM account configuration [preauth]
Jul 23 15:08:24 rhel01 sshd[3024]: debug1: do_cleanup [preauth]
Jul 23 15:08:24 rhel01 sshd[3024]: debug3: PAM: sshpam_thread_cleanup entering [preauth]
Jul 23 15:08:24 rhel01 sshd[3024]: debug3: mm_request_send entering: type 124 [preauth]

答案1

你不需要阴影使用时映射ssd 的使用 LDAP 后端。出于安全原因，您绝对不应该尝试实现它。

这是因为通过 PAM 的密码检查是由ssd 的向 LDAP 服务器发送 LDAP 简单绑定请求。因此无需在影子映射中公开密码哈希值。

相关内容