我在 centos 8 上配置了 sssd，在 centos 7 上配置了 ldap。我能够使用 getent passwd 和 getent group 获取有关 testuser 的详细信息，但在测试 getent shadow 时，我没有获取有关 testuser 的任何详细信息。这导致 testuser 登录失败。我不确定哪里配置错误了。
# cat /etc/sssd/sssd.conf
[sssd]
debug_level=7
config_file_version = 2
reconnection_retries = 3
enable_files_domain = False
services = nss, pam, ssh
domains = ldap.corp.com
[nss]
debug_level=7
reconnection_retries = 3
pwfield = x
homedir_substring = /home
[pam]
debug_level=7
reconnection_retries = 3
[ssh]
debug_level=7
debug_timestamps = True
[domain/ldap.corp.com]
debug_level=7
debug_timestamps = True
description = LDAP Client Login
enumeration = true
id_provider = ldap
auth_provider = ldap
access_provider = ldap
chpass_provider = ldap
ldap_access_order = filter
ldap_access_filter = (&(objectclass=posixAccount))
ldap_id_use_start_tls = True
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_tls_reqcert = allow
ldap_uri = ldap://ldap01.corp.com
ldap_search_base = dc=corp,dc=com
ldap_default_bind_dn = cn=ldapadm,dc=corp,dc=com
ldap_default_authtok_type = password
ldap_default_authtok = xxxxxxxxx
cache_credentials = true
ldap_group_search_base = ou=Group,dc=corp,dc=com
ldap_user_search_base = ou=Users,dc=corp,dc=com
#ldap_sudo_search_base = ou=sudoers,dc=corp,dc=com
ldap_user_object_class = posixAccount
ldap_group_object_class = posixGroup
ldap_group_member = memberUid
ldap_pwd_policy = shadow
# cat /etc/authselect/password-auth
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
auth [default=1 ignore=ignore success=ok] pam_localuser.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid
# getent passwd testuser1
testuser1:x:1005:1005:testuser1:/home/testuser1:/bin/bash
# getent group testuser1
testuser1:x:1005:
# getent shadow testuser1
#
# ssh testuser1@rhel01
testuser1@rhel01's password:
Connection closed by 192.168.10.11 port 22
#
# tail /var/log/secure
Jul 23 13:23:14 rhel01 sshd[2074]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.10.11 user=testuser1
Jul 23 13:23:14 rhel01 sshd[2074]: Failed password for testuser1 from 192.168.10.11 port 49462 ssh2
Jul 23 13:23:14 rhel01 sshd[2074]: fatal: Access denied for user testuser1 by PAM account configuration [preauth]
# cat /etc/authselect/password-auth
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
auth [default=1 ignore=ignore success=ok] pam_localuser.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid
password requisite pam_pwquality.so try_first_pass local_users_only
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so
Below is the Debug log from /var/log/secure:
答案1
你不需要阴影使用时映射ssd 的使用 LDAP 后端。出于安全原因，您绝对不应该尝试实现它。
这是因为通过 PAM 的密码检查是由ssd 的向 LDAP 服务器发送 LDAP 简单绑定请求。因此无需在影子映射中公开密码哈希值。