![Apache 中的 Kerberos 不起作用](https://linux22.com/image/774170/Apache%20%E4%B8%AD%E7%9A%84%20Kerberos%20%E4%B8%8D%E8%B5%B7%E4%BD%9C%E7%94%A8.png)
我目前正在尝试在我们的 Apache 上配置 Kerberos,但不幸的是我无法继续。Apache 上的网站 (Typo3) 可通过 sub.domain.com 进行内部和外部访问,本地域为 intern.local
我创建了这样的 keytab 文件:
ktpass -princ HTTP/[email protected] -mapuser [email protected] -pass P@55w0rd -crypto ALL -ptype KRB5_NT_PRINCIPAL -out C:\temp\kerbkey.keytab
krb5.conf 文件如下所示:
[libdefaults]
default_realm = INTERN.LOCAL
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
[realms]
INTERN.LOCAL = {
kdc = dc01.intern.local
admin_server = dc01.intern.local
default_domain = intern.local
}
[domain_realm]
.sub.domain.com = INTERN.LOCAL
sub.domain.com = INTERN.LOCAL
intern.local = INTERN.LOCAL
.intern.local = INTERN.LOCAL
Apache vhost 如下所示:
<VirtualHost *:443>
ServerName sub.domain.com
ServerAdmin [email protected]
DocumentRoot /var/www/page
<Directory /var/www/page>
AllowOverride All
</Directory>
SSLEngine on
SSLCertificateFile /etc/apache2/ssl/wildcart-zert.crt
SSLCertificateKeyFile /etc/apache2/ssl/wildcart-key.key
<IfModule !mod_auth_gssapi.c>
LoadModule auth_kerb_module /usr/lib/apache2/modules/mod_auth_gssapi.so
</IfModule>
LimitRequestFieldSize 32768
<Location "/">
AuthName [email protected]
AuthType GSSAPI
GssapiBasicAuth On
GssapiCredStore keytab:/etc/apache2/krb5/kerbkey.keytab
Require valid-user
</Location>
ErrorLog ${APACHE_LOG_DIR}/page-ssl_error.log
CustomLog ${APACHE_LOG_DIR}/page-ssl_access.log combined
</VirtualHost>
现在的问题是,如果我像这样激活 vhost 配置,那么当我调用页面时https://sub.domain.com,我总是会弹出浏览器窗口要求输入用户名和密码。无论我在这里输入什么,我都无法进入网页,只会收到错误:
Unauthorized
This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required.
Apache/2.4.41 (Ubuntu) Server at sub.domain.com Port 443
apache 错误日志显示以下条目:
[auth_gssapi:error] [pid 1632875] [client x.x.x.x:65394] GSS ERROR In Negotiate Auth: gss_accept_sec_context() failed: [An unsupported mechanism was requested (Unknown error)]
答案1
apache 错误日志显示以下条目:
错误的登录凭证:
[auth_gssapi:error] [pid 945597] [client x.x.x.x:60415] GSS ERROR In Basic Auth: gss_acquire_cred_with_password() failed: [Unspecified GSS failure. Minor code may provide more information (Preauthentication failed)]
正确的登录凭证:
[auth_gssapi:error] [pid 945593] [client x.x.x.x:63197] GSS ERROR gss_init_sec_context(): [Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database)]
答案2
Chrome 浏览器需要将 URL 放在本地互联网列表中:控制面板->互联网选项->安全->本地互联网->站点。
由于你没有提到浏览器,希望它能帮助你