我在FreeIPA和AD之間建立了信任關係，並在FreeIPA伺服器上新增了一些AD用戶，所有這些用戶都可以成功登入IPA伺服器端。但可以登入IPA客戶端。這是我用來為 FreeIPA 新增工作站的指令
ipa-client-install -U -f --enable-dns-updates --domain example.com --ntp-server=phoenix.example.com --server=phoenix.example.com -p EXAMPLE.COM -p admin -w '$EXAMPLE' --hostname=$HOSTNAME --automount-location=default --no-dns-sshfp --preserve-sssd
檢查後/var/log/message我 /var/log/secure收到了這個警告
/var/log/secure：
Jan 24 15:19:00 greentag sshd[2092]: Received disconnect from 192.168.5.222: 11: disconnected by user
Jan 24 15:19:00 greentag sshd[2092]: pam_unix(sshd:session): session closed for user root
Jan 24 15:19:12 greentag sshd[3856]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 [email protected]
Jan 24 15:19:12 greentag sshd[3856]: pam_sss(sshd:auth): received for user [email protected]: 6 (Permission denied)
Jan 24 15:19:12 greentag sshd[3838]: error: PAM: Authentication failure for [email protected] from 192.168.5.222
Jan 24 15:19:16 greentag sshd[3892]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 [email protected]
Jan 24 15:19:16 greentag sshd[3892]: pam_sss(sshd:auth): received for user [email protected]: 6 (Permission denied)
Jan 24 15:19:16 greentag sshd[3838]: error: PAM: Authentication failure for [email protected] from 192.168.5.222
Jan 24 15:19:16 greentag sshd[3838]: Postponed keyboard-interactive for [email protected] from 192.168.5.222 port 45318 ssh2 [preauth]
Jan 24 15:19:19 greentag sshd[3895]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 [email protected]
Jan 24 15:19:19 greentag sshd[3895]: pam_sss(sshd:auth): received for user [email protected]: 6 (Permission denied)
Jan 24 15:19:19 greentag sshd[3838]: error: PAM: Authentication failure for [email protected] from 192.168.5.222
Jan 24 15:19:26 greentag sshd[3838]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 [email protected]
Jan 24 15:19:26 greentag sshd[3838]: pam_sss(sshd:auth): received for user [email protected]: 6 (Permission denied)
Jan 24 15:19:26 greentag sshd[3838]: Failed password for [email protected] from 192.168.5.222 port 45318 ssh2
Jan 24 15:19:30 greentag sshd[3838]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 [email protected]
Jan 24 15:19:30 greentag sshd[3838]: pam_sss(sshd:auth): received for user [email protected]: 6 (Permission denied)
Jan 24 15:19:30 greentag sshd[3838]: Failed password for [email protected] from 192.168.5.222 port 45318 ssh2
/var/log/message：
Jan 24 15:19:12 greentag [sssd[krb5_child[3889]]]: Cannot find KDC for realm "adexample.COM"
Jan 24 15:19:12 greentag [sssd[krb5_child[3889]]]: Cannot find KDC for realm "adexample.COM"
Jan 24 15:19:12 greentag [sssd[krb5_child[3890]]]: Cannot find KDC for realm "adexample.COM"
Jan 24 15:19:12 greentag [sssd[krb5_child[3890]]]: Cannot find KDC for realm "adexample.COM"
但是當我輸入 id 時，[email protected]它會顯示這個使用者資訊。
答案1
問題解決了，看來我需要手動打開對應的連接埠。編輯 /etc/sysconfig/iptables，追加此內容
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
# -A INPUT -s ad_ip_address -p tcp -m multiport --dports 389,636 -m state --state NEW,ESTABLISHED -j REJECT
-A INPUT -p tcp -m multiport --dports 80,88,443,389,636,88,464,53,138,139,445 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m multiport --dports 88,464,53,123,138,139,389,445 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p udp -j REJECT
-A INPUT -p tcp -j REJECT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT