我剛剛建立了一個運行 OpenSuSE 12.1 的測試伺服器，並試圖了解如何配置 sssd，但不確定從哪裡開始查找為什麼我的配置不允許我進行身份驗證。
server:/etc/sssd # cat sssd.conf
[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss,pam
domains = test.local
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
[pam]
reconnection_retries = 3
# Section created by YaST
[domain/test.local]
access_provider = ldap
ldap_uri = ldap://server.test.local
ldap_search_base = dc=test,dc=local
ldap_schema = rfc2307bis
id_provider = ldap
ldap_user_uuid = entryuuid
ldap_group_uuid = entryuuid
ldap_id_use_start_tls = True
enumerate = False
cache_credentials = True
chpass_provider = krb5
auth_provider = krb5
krb5_realm = TEST.LOCAL
krb5_kdcip = server.test.local
server:/etc # cat ldap.conf
base dc=test,dc=local
bind_policy soft
pam_lookup_policy yes
pam_password exop
nss_initgroups_ignoreusers root,ldap
nss_schema rfc2307bis
nss_map_attribute uniqueMember member
ssl start_tls
uri ldap://server.test.local
ldap_version 3
pam_filter objectClass=posixAccount
server:/etc # cat nsswitch.conf
passwd: compat sss
group: files sss
hosts: files dns
networks: files dns
services: files
protocols: files
rpc: files
ethers: files
netmasks: files
netgroup: files
publickey: files
bootparams: files
automount: files ldap
aliases: files
shadow: compat
server:/etc # cat krb5.conf
[libdefaults]
default_realm = TEST.LOCAL
clockskew = 300
[realms]
TEST.LOCAL = {
kdc = server.test.local
admin_server = server.test.local
database_module = ldap
default_domain = test.local
}
[logging]
kdc = FILE:/var/log/krb5/krb5kdc.log
admin_server = FILE:/var/log/krb5/kadmind.log
default = SYSLOG:NOTICE:DAEMON
[dbmodules]
ldap = {
db_library = kldap
ldap_kerberos_container_dn = cn=krbContainer,dc=test,dc=local
ldap_kdc_dn = cn=Administrator,dc=test,dc=local
ldap_kadmind_dn = cn=Administrator,dc=test,dc=local
ldap_service_password_file = /etc/openldap/ldap-pw
ldap_servers = ldaps://server.test.local
}
[domain_realm]
.test.local = TEST.LOCAL
[appdefaults]
pam = {
ticket_lifetime = 1d
renew_lifetime = 1d
forwardable = true
proxiable = false
minimum_uid = 1
clockskew = 300
external = sshd
use_shmem = sshd
}
如果我以 root 身分登入伺服器，我可以 su 進入 ldap 用戶，但是如果我嘗試本機控制台或遠端 ssh，我將無法進行身份驗證。
getent 不顯示使用者的 ldap 條目，我不確定是否需要查看 LDAP、nsswitch 或其他內容：
server:~ # ssh localhost -l test
Password:
Password:
Password:
Permission denied (publickey,keyboard-interactive).
server:~ # su test
test@server:/etc> id
uid=1000(test) gid=100(users) groups=100(users)
server:~ # tail /var/log/messages
Nov 24 09:36:44 server login[14508]: pam_sss(login:auth): system info: [Client not found in Kerberos database]
Nov 24 09:36:44 server login[14508]: pam_sss(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=/dev/ttyS1 ruser= rhost= user=test
Nov 24 09:36:44 server login[14508]: pam_sss(login:auth): received for user test: 4 (System error)
Nov 24 09:36:44 server login[14508]: FAILED LOGIN SESSION FROM /dev/ttyS1 FOR test, System error
server:~ # vi /etc/pam.d/common-auth
auth required pam_env.so
auth sufficient pam_unix2.so
auth required pam_sss.so use_first_pass
server:~ # vi /etc/pam.d/sshd
auth requisite pam_nologin.so
auth include common-auth
account requisite pam_nologin.so
account include common-account
password include common-password
session required pam_loginuid.so
session include common-session
session optional pam_lastlog.so silent noupdate showfailed
答案1
您尚未配置您的存取提供者。
您已配置access_provider = ldap，但尚未ldap_access_filter在任何地方進行配置。
從該選項的手冊頁ldap_access_filter：
如果access_provider = ldap且未設定此選項，將導致所有使用者被拒絕存取。
我會完全刪除該access_provider選項，直到您擁有有效的配置。從簡單開始，從那裡開始:-)
。
注意：也可能有 kerberos 問題。從您發布的錯誤日誌來看，這聽起來確實是這樣。但是，雖然我不知道 kerberos 是否導致了問題，但我確實知道這一點（這個答案涵蓋的內容）。
答案2
對我來說似乎是 PAM 配置問題。
確保使用 sssd 模組/etc/pam.d/sshd引用檔案（帶有指令）或直接包含它。@