Construyo una relación de confianza entre FreeIPA y AD, y agrego algunos usuarios de AD al servidor FreeIPA, todos esos usuarios pueden iniciar sesión exitosamente en el lado del servidor IPA. Pero puedo iniciar sesión en el cliente IPA. Aquí está el comando que usé para agregar estaciones de trabajo a FreeIPA
ipa-client-install -U -f --enable-dns-updates --domain example.com --ntp-server=phoenix.example.com --server=phoenix.example.com -p EXAMPLE.COM -p admin -w '$EXAMPLE' --hostname=$HOSTNAME --automount-location=default --no-dns-sshfp --preserve-sssd
/var/log/messageY después de comprobarlo, /var/log/securerecibí esta advertencia.
/var/log/secure:
Jan 24 15:19:00 greentag sshd[2092]: Received disconnect from 192.168.5.222: 11: disconnected by user
Jan 24 15:19:00 greentag sshd[2092]: pam_unix(sshd:session): session closed for user root
Jan 24 15:19:12 greentag sshd[3856]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 [email protected]
Jan 24 15:19:12 greentag sshd[3856]: pam_sss(sshd:auth): received for user [email protected]: 6 (Permission denied)
Jan 24 15:19:12 greentag sshd[3838]: error: PAM: Authentication failure for [email protected] from 192.168.5.222
Jan 24 15:19:16 greentag sshd[3892]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 [email protected]
Jan 24 15:19:16 greentag sshd[3892]: pam_sss(sshd:auth): received for user [email protected]: 6 (Permission denied)
Jan 24 15:19:16 greentag sshd[3838]: error: PAM: Authentication failure for [email protected] from 192.168.5.222
Jan 24 15:19:16 greentag sshd[3838]: Postponed keyboard-interactive for [email protected] from 192.168.5.222 port 45318 ssh2 [preauth]
Jan 24 15:19:19 greentag sshd[3895]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 [email protected]
Jan 24 15:19:19 greentag sshd[3895]: pam_sss(sshd:auth): received for user [email protected]: 6 (Permission denied)
Jan 24 15:19:19 greentag sshd[3838]: error: PAM: Authentication failure for [email protected] from 192.168.5.222
Jan 24 15:19:26 greentag sshd[3838]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 [email protected]
Jan 24 15:19:26 greentag sshd[3838]: pam_sss(sshd:auth): received for user [email protected]: 6 (Permission denied)
Jan 24 15:19:26 greentag sshd[3838]: Failed password for [email protected] from 192.168.5.222 port 45318 ssh2
Jan 24 15:19:30 greentag sshd[3838]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 [email protected]
Jan 24 15:19:30 greentag sshd[3838]: pam_sss(sshd:auth): received for user [email protected]: 6 (Permission denied)
Jan 24 15:19:30 greentag sshd[3838]: Failed password for [email protected] from 192.168.5.222 port 45318 ssh2
/var/log/message:
Jan 24 15:19:12 greentag [sssd[krb5_child[3889]]]: Cannot find KDC for realm "adexample.COM"
Jan 24 15:19:12 greentag [sssd[krb5_child[3889]]]: Cannot find KDC for realm "adexample.COM"
Jan 24 15:19:12 greentag [sssd[krb5_child[3890]]]: Cannot find KDC for realm "adexample.COM"
Jan 24 15:19:12 greentag [sssd[krb5_child[3890]]]: Cannot find KDC for realm "adexample.COM"
Pero cuando escribo id [email protected]me mostrará esta información de usuario.
Respuesta1
Problema resuelto, parece que necesito abrir el puerto correspondiente manualmente. Edite /etc/sysconfig/iptables, agregue esto
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
# -A INPUT -s ad_ip_address -p tcp -m multiport --dports 389,636 -m state --state NEW,ESTABLISHED -j REJECT
-A INPUT -p tcp -m multiport --dports 80,88,443,389,636,88,464,53,138,139,445 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m multiport --dports 88,464,53,123,138,139,389,445 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p udp -j REJECT
-A INPUT -p tcp -j REJECT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT