☰

尽管 wbinfo -u 成功，但 centos 6.4 上的 AD 帐户仍未显示

tag-icon • tag-icon windows-server-2008-r2 centos6 kerberos winbind
尽管 wbinfo -u 成功，但 centos 6.4 上的 AD 帐户仍未显示

我有一个装有 samba 3.6.9 的 centos 6.4 机器，我已将其连接到 MS server 2008 R2。这部分似乎工作正常，因为我可以使用 和 查看我的 AD 用户和组wbinfo -u。wbinfo -g不起作用的是使用 centos 机器上的 AD 用户。我已在 AD 上激活了“UNIX 身份管理”，以便用户拥有 UID、GID、homdir 和 shell。不幸的是，centos 上仍然只有本地用户。

id mytestuser给出“没有这样的用户”。进一步：

    myhost someone:~ $ wbinfo -i mytestuser
    failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
    Could not get info for user mytestuser

    myhost someone:~ $ wbinfo -a mytestuser
    Enter mytestuser's password:
    plaintext password authentication succeeded
    Enter mytestuser's password:
    challenge/response password authentication failed
    Could not authenticate user mytestuser with challenge/response

似乎有一个漏洞这似乎与我的问题相似，但据我所知，我已经在我的 samba 配置中加入了语法更改。

这是我的配置：

/etc/krb5.conf

    [logging]
     default = FILE:/var/log/krb5libs.log
     kdc = FILE:/var/log/krb5kdc.log
     admin_server = FILE:/var/log/kadmind.log

    [libdefaults]
     default_realm = ACME.ORG
     dns_lookup_realm = false
     dns_lookup_kdc = false
     ticket_lifetime = 24h
     renew_lifetime = 7d
     forwardable = true
     default_keytab_name = FILE:/etc/krb5.keytab

    [realms]
     ACME.ORG= {
      kdc = myadserver.acme.org
      admin_server = myadserver.acme.org
      default_domain = acme.org
     }

    [domain_realm]
     .acme.org = ACME.ORG
     acme.org = ACME.ORG

    [appdefaults]
     pam = {
       debug = false
       ticket_lifetime = 36000
       renew_lifetime = 36000
       forwardable = true
       krb4_convert = false
     }

klist列出有效的票证授予票。

我的 /etc/samba/smb.cnf

   [global]
            workgroup = ACME
            server string = my super suerver
            log level = 3
            log file = /var/log/samba/log.%m
            max log size = 50
            security = ADS
            encrypt passwords = yes
            passdb backend = tdbsam
            realm = ACME.ORG
            preferred master = no
            load printers = yes
            cups options = raw
            printcap name = cups
            printing = cups
            winbind enum users = Yes
            winbind enum groups = Yes
            winbind use default domain = Yes
            winbind nested groups = Yes
            winbind separator = +
            template shell = /bin/bash
            winbind nss info = rfc2307
            kerberos method = system keytab
            dedicated keytab file = /etc/krb5.keytab
            idmap config ACME:backend = rid
            idmap config ACME:base_rid = 10036
            idmap config ACME:range = 10036-1000000
    [homes]
            comment = Home Directories
            browseable = no
            writable = yes
            valid users = %S
            valid users = ACME\%S

我的 /etc/nsswitch.conf 的一部分

passwd:     files winbind
shadow:     files winbind
group:      files winbind

我的 /etc/pam.d/system-auth

    auth        required      pam_env.so
    auth        sufficient    pam_unix.so nullok try_first_pass
    auth        requisite     pam_succeed_if.so uid >= 500 quiet
    auth        required      pam_krb5.so
    auth        sufficient    pam_winbind.so use_first_pass
    auth        required      pam_deny.so

    account     required      pam_unix.so
    account     sufficient    pam_succeed_if.so uid < 500 quiet
    account     sufficient    pam_winbind.so use_first_pass
    account     required      pam_permit.so

    password    requisite     pam_cracklib.so try_first_pass retry=3
    password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
    password    sufficient    pam_winbind.so use_first_pass
    password    required      pam_krb5.so
    password    required      pam_deny.so

    session     optional      pam_keyinit.so revoke
    session     required      pam_limits.so
    session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
    session     required      pam_unix.so
    session     required      pam_mkhomedir.so
    session     required      pam_krb5.so
    session     required      pam_winbind.so use_first_pass

对我来说它看起来有点像这样漏洞。我该如何验证这个？有什么提示吗？

答案1

我终于让它工作了，感谢ssd 的。它不使用 winbind（这可能是它能工作的原因 :)）。整个设置在这篇博文。

相关内容