active-directory – SSSD Kerberos AD Centos故障排除

我按照RedHat AD集成中的配置3( https://access.redhat.com/sites/default/files/attachments/rhel-ad-integration-deployment-guidelines-v1.5.pdf);但我被卡住了.

我在Centos 6.8上.

我有一个有效的AD连接：

service sssd stop
 rm -r /var/lib/sss/db/*
 rm -r /var/lib/sss/mc/*
 service sssd start
 getent passwd robau@MYNETWORK.LOCAL

这返回了一条明智的路线：

robau:*:102201201:102200513:Rob Audenaerde:/:

但是,当我尝试通过SSH连接时,我无法登录.我在sssd.conf中的所有组件级别5上启用了SSSD调试.

我看到的错误(在var / log / sssd / krb5_child.log中)是：

(Fri Jun 17 17:23:18 2016) [[sssd[krb5_child[3561]]]] [validate_tgt] (0x0020): TGT failed verification using key for [host/server-new.mynetwork.nl@MYNETWORK.LOCAL].
(Fri Jun 17 17:23:18 2016) [[sssd[krb5_child[3561]]]] [get_and_save_tgt] (0x0020): 1240: [-1765328377][Server not found in Kerberos database]
(Fri Jun 17 17:23:18 2016) [[sssd[krb5_child[3561]]]] [map_krb5_error] (0x0020): 1301: [-1765328377][Server not found in Kerberos database]
(Fri Jun 17 17:23:18 2016) [[sssd[krb5_child[3561]]]] [k5c_send_data] (0x0200): Received error code 1432158209

服务器在DNS中,我可以使用nslookup找到它

nslookup server-new.mynetwork.nl

   Server:  192.168.110.56
   Address: 192.168.110.56#53

   Name:    server-new.mynetwork.nl
   Address: 192.168.210.94

和

kvno host/server-new.mynetwork.nl@MYNETWORK.LOCAL
kvno: Server not found in Kerberos database while getting credentials for host/server-new.mynetwork.nl@MYNETWORK.LOCAL

有关故障排除的任何提示/提示？

[编辑]
我用authconfig来设置必要的pam和nss东西：

authconfig --enablesssdauth --enablesssd --enablemkhomedir --update

输出klist -kte：

25 06/20/16 10:56:24 host/server-new.mynetwork.nl@MYNETWORK.LOCAL (des-cbc-crc) 
  25 06/20/16 10:56:24 host/server-new.mynetwork.nl@MYNETWORK.LOCAL (des-cbc-md5) 
  25 06/20/16 10:56:24 host/server-new.mynetwork.nl@MYNETWORK.LOCAL (aes128-cts-hmac-sha1-96) 
  25 06/20/16 10:56:24 host/server-new.mynetwork.nl@MYNETWORK.LOCAL (aes256-cts-hmac-sha1-96) 
  25 06/20/16 10:56:24 host/server-new.mynetwork.nl@MYNETWORK.LOCAL (arcfour-hmac) 
  25 06/20/16 10:56:24 host/server-new@MYNETWORK.LOCAL (des-cbc-crc) 
  25 06/20/16 10:56:24 host/server-new@MYNETWORK.LOCAL (des-cbc-md5) 
  25 06/20/16 10:56:25 host/server-new@MYNETWORK.LOCAL (aes128-cts-hmac-sha1-96) 
  25 06/20/16 10:56:25 host/server-new@MYNETWORK.LOCAL (aes256-cts-hmac-sha1-96) 
  25 06/20/16 10:56:25 host/server-new@MYNETWORK.LOCAL (arcfour-hmac) 
  25 06/20/16 10:56:25 SERVER-NEW$@MYNETWORK.LOCAL (des-cbc-crc) 
  25 06/20/16 10:56:25 SERVER-NEW$@MYNETWORK.LOCAL (des-cbc-md5) 
  25 06/20/16 10:56:25 SERVER-NEW$@MYNETWORK.LOCAL (aes128-cts-hmac-sha1-96) 
  25 06/20/16 10:56:25 SERVER-NEW$@MYNETWORK.LOCAL (aes256-cts-hmac-sha1-96) 
  25 06/20/16 10:56:26 SERVER-NEW$@MYNETWORK.LOCAL (arcfour-hmac)

输出klist

Ticket cache: FILE:/tmp/krb5cc_0
Default principal: SERVER-NEW$@MYNETWORK.LOCAL

Valid starting     Expires            Service principal
06/20/16 10:56:41  06/20/16 20:56:41  krbtgt/MYNETWORK.LOCAL@MYNETWORK.LOCAL
    renew until 06/27/16 10:56:41
06/20/16 11:36:07  06/20/16 20:56:41  ldap/my-ad.mynetwork.local@MYNETWORK.LOCAL
    renew until 06/27/16 10:56:41

[编辑2]

如果我在sssd.conf部分[domain / mynetwork.local]的末尾添加krb5_validate,那么我就可以登录了.但是,我还设置了另一台不需要这个步骤的服务器,所以我不愿意这样做.

[编辑3]
在网络广告加入-k期间,我收到错误/警告：

DNS Update for failed: ERROR_DNS_GSS_ERROR 
DNS update failed!

[编辑4]
我看到网络广告信息的输出没有使用我在配置文件中指定的主域控制器(并且是2003R2而不是2008R2).有没有办法“强制”网络广告加入-k使用特定的域控制器？

尝试安装并运行msktutil(可通过EPEL获得).

安装：

yum -y --enablerepo=epel install msktutil

要运行它：

msktutil --auto-update --server my-ad --verbose

然后运行一个kinit：

kinit -k server-new$

此外,您应该每隔6个小时左右执行这两项工作.这样你的门票就不会过期.

回答EDIT4：你应该能够指定一个带有网络广告的服务器加入-k -S,但默认情况下它会在你的DNS中搜索SRV记录.哪个好.除非你不想那样.如果您希望特定站点使用不同的DC,请查看Active Directory站点&服务.

active-directory – SSSD Kerberos AD Centos故障排除

相关推荐