FreeIPAとADの間に信頼関係を構築し、一部のADユーザーをFreeIPAサーバーに追加すると、それらのユーザーはすべてIPAサーバー側に正常にログインできます。ただし、IPAクライアントにログインできます。以下は、FreeIPAにワークステーションを追加するために使用したコマンドです。
ipa-client-install -U -f --enable-dns-updates --domain example.com --ntp-server=phoenix.example.com --server=phoenix.example.com -p EXAMPLE.COM -p admin -w '$EXAMPLE' --hostname=$HOSTNAME --automount-location=default --no-dns-sshfp --preserve-sssd
/var/log/messageそして 確認したら/var/log/secureこの警告が出ました
/var/log/secure:
Jan 24 15:19:00 greentag sshd[2092]: Received disconnect from 192.168.5.222: 11: disconnected by user
Jan 24 15:19:00 greentag sshd[2092]: pam_unix(sshd:session): session closed for user root
Jan 24 15:19:12 greentag sshd[3856]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 [email protected]
Jan 24 15:19:12 greentag sshd[3856]: pam_sss(sshd:auth): received for user [email protected]: 6 (Permission denied)
Jan 24 15:19:12 greentag sshd[3838]: error: PAM: Authentication failure for [email protected] from 192.168.5.222
Jan 24 15:19:16 greentag sshd[3892]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 [email protected]
Jan 24 15:19:16 greentag sshd[3892]: pam_sss(sshd:auth): received for user [email protected]: 6 (Permission denied)
Jan 24 15:19:16 greentag sshd[3838]: error: PAM: Authentication failure for [email protected] from 192.168.5.222
Jan 24 15:19:16 greentag sshd[3838]: Postponed keyboard-interactive for [email protected] from 192.168.5.222 port 45318 ssh2 [preauth]
Jan 24 15:19:19 greentag sshd[3895]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 [email protected]
Jan 24 15:19:19 greentag sshd[3895]: pam_sss(sshd:auth): received for user [email protected]: 6 (Permission denied)
Jan 24 15:19:19 greentag sshd[3838]: error: PAM: Authentication failure for [email protected] from 192.168.5.222
Jan 24 15:19:26 greentag sshd[3838]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 [email protected]
Jan 24 15:19:26 greentag sshd[3838]: pam_sss(sshd:auth): received for user [email protected]: 6 (Permission denied)
Jan 24 15:19:26 greentag sshd[3838]: Failed password for [email protected] from 192.168.5.222 port 45318 ssh2
Jan 24 15:19:30 greentag sshd[3838]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 [email protected]
Jan 24 15:19:30 greentag sshd[3838]: pam_sss(sshd:auth): received for user [email protected]: 6 (Permission denied)
Jan 24 15:19:30 greentag sshd[3838]: Failed password for [email protected] from 192.168.5.222 port 45318 ssh2
/var/log/message:
Jan 24 15:19:12 greentag [sssd[krb5_child[3889]]]: Cannot find KDC for realm "adexample.COM"
Jan 24 15:19:12 greentag [sssd[krb5_child[3889]]]: Cannot find KDC for realm "adexample.COM"
Jan 24 15:19:12 greentag [sssd[krb5_child[3890]]]: Cannot find KDC for realm "adexample.COM"
Jan 24 15:19:12 greentag [sssd[krb5_child[3890]]]: Cannot find KDC for realm "adexample.COM"
しかし、id と入力すると、[email protected]このユーザー情報が表示されます。
答え1
問題は解決しました。対応するポートを手動で開く必要があるようです。/etc/sysconfig/iptablesを編集し、以下を追加します。
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
# -A INPUT -s ad_ip_address -p tcp -m multiport --dports 389,636 -m state --state NEW,ESTABLISHED -j REJECT
-A INPUT -p tcp -m multiport --dports 80,88,443,389,636,88,464,53,138,139,445 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m multiport --dports 88,464,53,123,138,139,389,445 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p udp -j REJECT
-A INPUT -p tcp -j REJECT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT