☰

ldapsearch 傳回結果，但 getent 不回傳結果

tag-icon • tag-icon centos openldap ldap
ldapsearch 傳回結果，但 getent 不回傳結果

我正在設定一個新的 CentOS 7 伺服器，並且需要設定 LDAP 身份驗證，即已經存在一個對使用者進行身份驗證的伺服器，我們將其用於其他 GNU/Linux 伺服器。

例如，在 Windows 中，我可以使用 查詢 DC 的主機名稱和 IP nltest /dclist:X.Y。它傳回一個我可以確認正確的 DC 伺服器列表。

ldapsearch當我在 CentOS 7 伺服器上測試與這些 DC 伺服器的連接時，它可以工作：

ldapsearch -H ldap://<DCSERVER> -D <user>@X.Y -w

輸出是一長串訊息，包括DN資訊。

但是，使用時getent passwd，沒有輸出，並且我在 /var/log/messages 中看到錯誤：

Nov 24 16:09:37 XXXXXXXX nslcd[22440]: [16e9e8] <passwd(all)> ldap_result() failed: Operations error: 000004DC: LdapErr: DSID-0C09072B, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580

getent password在其他 CentOS 6 伺服器上運作良好，但它們使用 BeyondTrust，我想從中遷移，而且在安裝時我不是管理員。

相關設定檔：

/etc/openldap/ldap.conf包含：

#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

#BASE   dc=example,dc=com
#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT      12
#TIMELIMIT      15
#DEREF          never

TLS_CACERTDIR /etc/pki/tls/certs

# Turning this off breaks GSSAPI used with krb5 when rdns = false
SASL_NOCANON    on
URI ldap://<DCSERVER>
BASE DC=X,DC=Y

/etc/nsswitch.conf包含：

#
# /etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Valid entries include:
#
#       nisplus                 Use NIS+ (NIS version 3)
#       nis                     Use NIS (NIS version 2), also called YP
#       dns                     Use DNS (Domain Name Service)
#       files                   Use the local files
#       db                      Use the local database (.db) files
#       compat                  Use NIS on compat mode
#       hesiod                  Use Hesiod for user lookups
#       [NOTFOUND=return]       Stop searching if not found so far
#

# To use db, put the "db" in front of "files" for entries you want to be
# looked up first in the databases
#
# Example:
#passwd:    db files nisplus nis
#shadow:    db files nisplus nis
#group:     db files nisplus nis

passwd:     files ldap
shadow:     files ldap
group:      files ldap
#initgroups: files

#hosts:     db files nisplus nis dns
hosts:      files dns

# Example - obey only what nisplus tells us...
#services:   nisplus [NOTFOUND=return] files
#networks:   nisplus [NOTFOUND=return] files
#protocols:  nisplus [NOTFOUND=return] files
#rpc:        nisplus [NOTFOUND=return] files
#ethers:     nisplus [NOTFOUND=return] files
#netmasks:   nisplus [NOTFOUND=return] files

bootparams: nisplus [NOTFOUND=return] files

ethers:     files
netmasks:   files
networks:   files
protocols:  files
rpc:        files
services:   files sss

netgroup:   files sss

publickey:  nisplus

automount:  files sss
aliases:    files nisplus

/etc/nslcd.conf包含：

# This is the configuration file for the LDAP nameservice
# switch library's nslcd daemon. It configures the mapping
# between NSS names (see /etc/nsswitch.conf) and LDAP
# information in the directory.
# See the manual page nslcd.conf(5) for more information.

# The user and group nslcd should run as.
uid nslcd
gid ldap

# The uri pointing to the LDAP server to use for name lookups.
# Multiple entries may be specified. The address that is used
# here should be resolvable without using LDAP (obviously).
#uri ldap://127.0.0.1/
#uri ldaps://127.0.0.1/
#uri ldapi://%2fvar%2frun%2fldapi_sock/
# Note: %2f encodes the '/' used as directory separator
uri ldap://<DCSERVER>

# The LDAP version to use (defaults to 3
# if supported by client library)
#ldap_version 3

# The distinguished name of the search base.
base DC=X,DC=Y

# The distinguished name to bind to the server with.
# Optional: default is to bind anonymously.
#binddn cn=proxyuser,dc=example,dc=com

在此先感謝您的幫忙。

答案1

存在不符：如果您檢查 sssd 日誌，則表示您正在使用 sssd 守護程式。但是你應該在文件中配置它：

/etc/sssd/sssd.conf

不在 /etc/nslcd.conf 中（對於 pam-ldapd 守護程式有好處）。

而且：

  1. sssd.conf 和 nslcd.conf 的語法非常不同；
  2. 在 /etc/nsswitch.conf 中，sssd 守護程式透過「sss」鍵（而不是「ldap」）來引用。

答案2

我無法完全解決這個問題。

然而，檢查/var/log/sssd/sssd_DOMAIN.log顯示 SSS 正在工作，但可能有指定 DN 不正確的問題？

(Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!
(Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_process_result] (0x2000): Trace: sh[0x7fc9553ddde0], connected[1], ops[0x7fc9553ed2c0], ldap[0x7fc9553d0cb0]
(Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_get_generic_ext_done] (0x0400): Search result: Operations error(1), 000004DC: LdapErr: DSID-0C090724, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v23f0

最終，我選擇使用Beyond Trust的開源PBIS。幾分鐘後就工作了。

http://www.beyondtrust.com/Resources/OpenSourceDocumentation/

相關內容