现在,如果我尝试添加一个不在大学的Kerberos领域的非系统用户,我会被提示输入Kerberos密码.显然没有输入密码,所以我只需按回车即可看到:
passwd: Authentication token manipulation error passwd: password unchanged
键入passwd newuser对同一消息有同样的问题.
我尝试使用pwconv,希望只需要一个影子条目,但它什么都没改变.
我希望能够添加不在域中的本地用户并为他们提供本地密码而不必担心Kerberos.
我在Ubuntu 10.04上.这是我的/etc/pam.d/common-*文件(Ubuntu的pam-auth-update软件包生成的默认值):
将/etc/pam.d/common-account
# here are the per-package modules (the "Primary" block) account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so # here's the fallback if no module succeeds account requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around account required pam_permit.so # and here are more per-package modules (the "Additional" block) account required pam_krb5.so minimum_uid=1000 # end of pam-auth-update config
将/etc/pam.d/common-auth
# here are the per-package modules (the "Primary" block) auth [success=2 default=ignore] pam_krb5.so minimum_uid=1000 auth [success=1 default=ignore] pam_unix.so nullok_secure try_first_pass # here's the fallback if no module succeeds auth requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around auth required pam_permit.so # and here are more per-package modules (the "Additional" block) # end of pam-auth-update config
/etc/pam.d/common-password
# here are the per-package modules (the "Primary" block) password requisite pam_krb5.so minimum_uid=1000 password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass sha512 # here's the fallback if no module succeeds password requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around password required pam_permit.so # and here are more per-package modules (the "Additional" block) # end of pam-auth-update config
/etc/pam.d/common-session
# here are the per-package modules (the "Primary" block) session [default=1] pam_permit.so # here's the fallback if no module succeeds session requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around session required pam_permit.so # and here are more per-package modules (the "Additional" block) session optional pam_krb5.so minimum_uid=1000 session required pam_unix.so # end of pam-auth-update config
解决方法
通过pam-auth-update命令暂时调整
>您可以使用pam-auth-update暂时停用Kerberos.所以它看起来像这样:
[] Kerberos身份验证
>然后,您可以添加用户/更改密码.
>完成后,使用pam-auth-update重新激活Kerberos.所以它看起来像这样:
[*] Kerberos身份验证
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。