主页 / server / 问题 / 855859
Accepted
arne.z
Asked: 2017-06-15 14:58:29 +0800 CST

MIT Kerberos 在对 OpenSSH 进行身份验证时不断要求输入密码

  • 772

我正在尝试设置一个简单的 Kerberos 环境，该环境由 Kerberos 服务器 (KDC)、客户端计算机和运行 OpenSSH 守护程序的服务器计算机组成。在与服务器机器建立 SSH 连接时，客户端应该通过 Kerberos 进行身份验证。

我要验证的 Kerberos 用户的名称是krbuser. 此用户存在于服务计算机上，并且具有 uid 1001。奇怪的是我用SSH登录的时候需要输入Kerberos用户的密码。每次我登录。不仅是我的第一次连接。这看起来很奇怪，因为 Kerberos 的全部意义在于无需密码即可进行身份验证。

我在身份验证过程中进行了 tcpdump，并注意到客户端正在使用 cname 对 KDC 执行 AS-REQ root。这个 Kerberos 用户名没有，我不知道客户端为什么使用这个名称。正如预期的那样，KDC 以eRR-C-PRINCIPAL-UNKNOWN消息响应，因为数据库中没有root用户。

对我来说，主要问题似乎是客户端尝试以身份验证root而不是krbuser.

我将在下面发布有关我当前配置的一些信息。如果您需要任何其他信息，请告诉我。

在 KDC 上：

/etc/krb5.conf

[logging]
    default = FILE:/usr/local/krb5/var/log/krb5lib.log 
    kdc = FILE:/usr/local/krb5/var/log/krb5kdc.log
    admin_server = FILE:/usr/local/krb5/var/log/kadmin.log

[libdefaults]
    default_realm = metz.prac.os3.nl
    rdns = false

# The following krb5.conf variables are only for MIT Kerberos.
    krb4_config = /etc/krb.conf
    krb4_realms = /etc/krb.realms
    kdc_timesync = 1
    ccache_type = 4
    forwardable = true
    proxiable = true

[realms]
    metz.prac.os3.nl = {
        kdc = krb-0.metz.prac.os3.nl
        admin_server = krb-0.metz.prac.os3.nl
    }

在服务机器上：

/etc/ssh/sshd config（摘录）

# Kerberos options
KerberosAuthentication yes
# KerberosGetAFSToken no
# KerberosOrLocalPasswd no
# KerberosTicketCleanup yes

# GSSAPI options
GSSAPIAuthentication yes
# GSSAPICleanupCredentials yes

在 SSH 身份验证期间捕获的日志文件：

debug1: rekey after 4294967296 blocks [preauth]
debug1: SSH2_MSG_NEWKEYS received [preauth]
debug1: KEX done [preauth]
debug1: userauth-request for user root service ssh-connection method none [preauth]
debug1: attempt 0 failures 0 [preauth]
debug1: PAM: initializing for "root"
debug1: PAM: setting PAM_RHOST to "218.65.30.30"
debug1: PAM: setting PAM_TTY to "ssh"
debug1: userauth-request for user root service ssh-connection method password [preauth]
debug1: attempt 1 failures 0 [preauth]
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: restore_uid: 0/0
debug1: Kerberos password authentication failed: Client '[email protected]' not found in Kerberos database
debug1: krb5_cleanup_proc called
debug1: inetd sockets after dupping: 5, 5
Connection from 145.100.110.115 port 51946 on 145.100.110.116 port 22
debug1: Client protocol version 2.0; client software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.2
debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.2 pat OpenSSH* compat 0x04000000
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.2
debug1: permanently_set_uid: 106/65534 [preauth]
debug1: list_hostkey_types: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
debug1: SSH2_MSG_KEXINIT sent [preauth]
debug1: SSH2_MSG_KEXINIT received [preauth]
debug1: kex: algorithm: [email protected] [preauth]
debug1: kex: host key algorithm: ecdsa-sha2-nistp256 [preauth]
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none [preauth]
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none [preauth]
debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
debug1: rekey after 134217728 blocks [preauth]
debug1: SSH2_MSG_NEWKEYS sent [preauth]
debug1: expecting SSH2_MSG_NEWKEYS [preauth]
debug1: rekey after 134217728 blocks [preauth]
debug1: SSH2_MSG_NEWKEYS received [preauth]
debug1: KEX done [preauth]
debug1: userauth-request for user krbuser service ssh-connection method none [preauth]
debug1: attempt 0 failures 0 [preauth]
debug1: PAM: initializing for "krbuser"
debug1: PAM: setting PAM_RHOST to "145.100.110.115"
debug1: PAM: setting PAM_TTY to "ssh"
debug1: userauth-request for user krbuser service ssh-connection method gssapi-with-mic [preauth]
debug1: attempt 1 failures 0 [preauth]
debug1: PAM: password authentication failed for root: Authentication failure
Failed password for root from 218.65.30.30 port 18460 ssh2
debug1: userauth-request for user root service ssh-connection method password [preauth]
debug1: attempt 2 failures 1 [preauth]
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: restore_uid: 0/0
debug1: Kerberos password authentication failed: Client '[email protected]' not found in Kerberos database
debug1: krb5_cleanup_proc called
debug1: PAM: password authentication failed for root: Authentication failure
Failed password for root from 218.65.30.30 port 18460 ssh2
debug1: userauth-request for user root service ssh-connection method password [preauth]
debug1: attempt 3 failures 2 [preauth]
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: restore_uid: 0/0
debug1: Kerberos password authentication failed: Client '[email protected]' not found in Kerberos database
debug1: krb5_cleanup_proc called
debug1: PAM: password authentication failed for root: Authentication failure
Failed password for root from 218.65.30.30 port 18460 ssh2
debug1: userauth-request for user krbuser service ssh-connection method password [preauth]
debug1: attempt 2 failures 0 [preauth]
debug1: temporarily_use_uid: 1001/1001 (e=0/0)
debug1: restore_uid: 0/0
debug1: temporarily_use_uid: 1001/1001 (e=0/0)
debug1: restore_uid: 0/0
debug1: do_pam_account: called
Accepted password for krbuser from 145.100.110.115 port 51946 ssh2
debug1: monitor_child_preauth: krbuser has been authenticated by privileged process
debug1: monitor_read_log: child log fd closed
debug1: temporarily_use_uid: 1001/1001 (e=0/0)
debug1: ssh_gssapi_storecreds: Not a GSSAPI mechanism
debug1: restore_uid: 0/0
debug1: PAM: establishing credentials
User child is on pid 20617
debug1: SELinux support disabled
debug1: PAM: establishing credentials
debug1: permanently_set_uid: 1001/1001
debug1: rekey after 134217728 blocks
debug1: rekey after 134217728 blocks
debug1: ssh_packet_set_postauth: called
debug1: Entering interactive session for SSH2.
debug1: server_init_dispatch_20
debug1: server_input_channel_open: ctype session rchan 0 win 1048576 max 16384
debug1: input_session_request
debug1: channel 0: new [server-session]
debug1: session_new: session 0
debug1: session_open: channel 0
debug1: session_open: session 0: link with channel 0
debug1: server_input_channel_open: confirm session
debug1: server_input_global_request: rtype [email protected] want_reply 0
debug1: server_input_channel_req: channel 0 request pty-req reply 1
debug1: session_by_channel: session 0 channel 0
debug1: session_input_channel_req: session 0 req pty-req
debug1: Allocating pty.
debug1: session_new: session 0
debug1: SELinux support disabled
debug1: session_pty_req: session 0 alloc /dev/pts/2
debug1: server_input_channel_req: channel 0 request env reply 0
debug1: session_by_channel: session 0 channel 0
debug1: session_input_channel_req: session 0 req env
debug1: server_input_channel_req: channel 0 request env reply 0
debug1: session_by_channel: session 0 channel 0
debug1: session_input_channel_req: session 0 req env
debug1: server_input_channel_req: channel 0 request env reply 0
debug1: session_by_channel: session 0 channel 0
debug1: session_input_channel_req: session 0 req env
debug1: server_input_channel_req: channel 0 request env reply 0
debug1: session_by_channel: session 0 channel 0
debug1: session_input_channel_req: session 0 req env
debug1: server_input_channel_req: channel 0 request env reply 0
debug1: session_by_channel: session 0 channel 0
debug1: session_input_channel_req: session 0 req env
debug1: server_input_channel_req: channel 0 request env reply 0
debug1: session_by_channel: session 0 channel 0
debug1: session_input_channel_req: session 0 req env
debug1: server_input_channel_req: channel 0 request env reply 0
debug1: session_by_channel: session 0 channel 0
debug1: session_input_channel_req: session 0 req env
debug1: server_input_channel_req: channel 0 request env reply 0
debug1: session_by_channel: session 0 channel 0
debug1: session_input_channel_req: session 0 req env
debug1: server_input_channel_req: channel 0 request env reply 0
debug1: session_by_channel: session 0 channel 0
debug1: session_input_channel_req: session 0 req env
debug1: server_input_channel_req: channel 0 request env reply 0
debug1: session_by_channel: session 0 channel 0
debug1: session_input_channel_req: session 0 req env
debug1: server_input_channel_req: channel 0 request shell reply 1
debug1: session_by_channel: session 0 channel 0
debug1: session_input_channel_req: session 0 req shell
Starting session: shell on pts/2 for krbuser from 145.100.110.115 port 51946 id 0
debug1: Setting controlling tty using TIOCSCTTY.
debug1: userauth-request for user root service ssh-connection method password [preauth]
debug1: attempt 4 failures 3 [preauth]
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: restore_uid: 0/0
debug1: Kerberos password authentication failed: Client '[email protected]' not found in Kerberos database
debug1: krb5_cleanup_proc called
debug1: PAM: password authentication failed for root: Authentication failure
Failed password for root from 218.65.30.30 port 18460 ssh2
debug1: userauth-request for user root service ssh-connection method password [preauth]
debug1: attempt 5 failures 4 [preauth]
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: restore_uid: 0/0
debug1: Kerberos password authentication failed: Client '[email protected]' not found in Kerberos database
debug1: krb5_cleanup_proc called
debug1: PAM: password authentication failed for root: Authentication failure
Failed password for root from 218.65.30.30 port 18460 ssh2
debug1: userauth-request for user root service ssh-connection method password [preauth]
debug1: attempt 6 failures 5 [preauth]
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: restore_uid: 0/0
debug1: Kerberos password authentication failed: Client '[email protected]' not found in Kerberos database
debug1: krb5_cleanup_proc called
debug1: PAM: password authentication failed for root: Authentication failure
Failed password for root from 218.65.30.30 port 18460 ssh2
maximum authentication attempts exceeded for root from 218.65.30.30 port 18460 ssh2 [preauth]
Disconnecting: Too many authentication failures [preauth]
debug1: do_cleanup [preauth]
debug1: monitor_read_log: child log fd closed
debug1: do_cleanup
debug1: PAM: cleanup
debug1: Killing privsep child 20604
debug1: audit_event: unhandled event 12
debug1: inetd sockets after dupping: 5, 5
Connection from 218.65.30.30 port 58146 on 145.100.110.116 port 22
debug1: Client protocol version 2.0; client software version nsssh2_4.0.0032 NetSarang Computer, Inc.
debug1: no match: nsssh2_4.0.0032 NetSarang Computer, Inc.
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.2
debug1: permanently_set_uid: 106/65534 [preauth]
debug1: list_hostkey_types: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
debug1: SSH2_MSG_KEXINIT sent [preauth]
debug1: SSH2_MSG_KEXINIT received [preauth]
debug1: kex: algorithm: diffie-hellman-group14-sha1 [preauth]
debug1: kex: host key algorithm: ssh-rsa [preauth]
debug1: kex: client->server cipher: aes128-ctr MAC: hmac-sha1 compression: none [preauth]
debug1: kex: server->client cipher: aes128-ctr MAC: hmac-sha1 compression: none [preauth]
debug1: expecting SSH2_MSG_KEXDH_INIT [preauth]

在客户端机器上：

kinit和klist认证之前：

$ kinit -p krbuser
$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: [email protected]

Valid starting     Expires            Service principal
06/15/17 00:24:05  06/15/17 10:24:05  krbtgt/[email protected]
    renew until 06/16/17 00:23:56

/etc/ssh/ssh config（摘录）：

    GSSAPIAuthentication yes
    GSSAPIDelegateCredentials yes
#   GSSAPIKeyExchange no
#   GSSAPITrustDNS no

最后是 SSH 身份验证：

$ ssh [email protected] -vvv
...
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: resolving "service-0.metz.prac.os3.nl" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to service-0.metz.prac.os3.nl [145.***.***.***] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/client/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/client/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/client/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/client/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/client/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/client/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/client/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/client/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.2
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.2
...
debug1: Found key in /home/client/.ssh/known_hosts:3
debug3: send packet: type 21
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS received
debug2: key: /home/client/.ssh/id_rsa ((nil))
debug2: key: /home/client/.ssh/id_dsa ((nil))
debug2: key: /home/client/.ssh/id_ecdsa ((nil))
debug2: key: /home/client/.ssh/id_ed25519 ((nil))
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup gssapi-keyex
debug3: remaining preferred: gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-keyex
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug2: we did not send a packet, disable method
debug3: authmethod_lookup gssapi-with-mic
debug3: remaining preferred: publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug3: send packet: type 50
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug3: send packet: type 50
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug3: send packet: type 50
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug3: send packet: type 50
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we did not send a packet, disable method
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
...
debug1: Next authentication method: password
[email protected]'s password: <entering PW of Kerberos user> !!!
debug3: send packet: type 50
debug2: we sent a password packet, wait for reply
debug3: receive packet: type 52
debug1: Authentication succeeded (password).
Authenticated to service-0.metz.prac.os3.nl ([145.***.***.***]:22).
debug1: channel 0: new [client-session]
debug3: ssh_session2_open: channel_new: 0
debug2: channel 0: send open
debug3: send packet: type 90
debug1: Requesting [email protected]
debug3: send packet: type 80
debug1: Entering interactive session.
debug1: pledge: network
debug3: receive packet: type 80
debug1: client_input_global_request: rtype [email protected] want_reply 0
debug3: receive packet: type 91
debug2: callback start
debug2: fd 3 setting TCP_NODELAY
debug3: ssh_packet_set_tos: set IP_TOS 0x10
debug2: client_session2_setup: id 0
debug2: channel 0: request pty-req confirm 1
debug3: send packet: type 98
...
debug3: Ignored env _
debug2: channel 0: request shell confirm 1
debug3: send packet: type 98
debug2: callback done
debug2: channel 0: open confirm rwindow 0 rmax 32768
debug3: receive packet: type 99
debug2: channel_input_status_confirm: type 99 id 0
debug2: PTY allocation request accepted on channel 0
debug2: channel 0: rcvd adjust 2097152
debug3: receive packet: type 99
debug2: channel_input_status_confirm: type 99 id 0
debug2: shell request accepted on channel 0
Last login: Thu Jun 15 00:28:57 2017

Connection established

现在klist显示以下票证：

$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: [email protected]

Valid starting     Expires            Service principal
06/15/17 00:24:05  06/15/17 10:24:05  krbtgt/[email protected]
    renew until 06/16/17 00:23:56
06/15/17 00:27:37  06/15/17 10:24:05  host/service-0.metz.prac.os3.nl@
    renew until 06/16/17 00:23:56
06/15/17 00:27:37  06/15/17 10:24:05  host/[email protected]
    renew until 06/16/17 00:23:56

因此，总结一下：客户端上的 Kerberos 用户可以通过输入其 Kerberos (!) 密码来建立与服务器的 SSH 会话。不是它的 UNIX 密码。tcpdump 显示客户端验证为root不是 Kerberos 用户，我不知道为什么它使用此用户名而不是krbuser. 这是我与kinit命令一起使用的那个。

谁能告诉我为什么此身份验证无法正常工作？如果您需要更多信息，请告诉我。我试图保持简短。

ubuntu

3 个回答

  1. Best Answer

    根登录

    从您提供的日志文件来看，我会说尝试的 root 登录不是您的问题。请注意，所有以 root 身份进行的身份验证尝试都来自218.65.30.30，一个简单的whois命令告诉我们这是来自中国的 IP。成功参与此身份验证的其他 IP145.100.110.11{5,6}都来自同一个（大学管理的）网络块。我假设这些是您感兴趣的机器。我也非常推荐安装类似的东西fail2ban来阻止试图暴力破解你的 IP。

    SSH

    现在让我们着手解决您的 Kerberos 问题。我最近建立了一个 Kerberos 环境，这充满了困难，所以我感到你的痛苦！您的 SSH 配置看起来不错，因此我们可以排除这种情况。GSSAPIDelegateCredentials yes尽管从安全角度来看，您可能需要考虑，但 /etc/ssh/ssh_config实际上是否需要设置？虽然方便，但此选项会将您的 TGT 公开给您通过 SSH 连接的任何机器。

    Keberos 警告

    kerberos 设置对时间偏差和名称解析很敏感的两个主要问题。我认为时间偏差不太可能是您的问题。不过，使用您的 kerberos 日志更容易确认这一点。大多数现代 GNU/Linux 发行版都已经设置了网络时间。您可以使用类似的东西来验证这一点timedatectl。您还应该确保为您环境中的每台主机正确设置了正向和反向 DNS。

    关于领域的旁白——虽然并不总是严格要求，但惯例是让您的领域保持大写。当您在混合 GNU/Linux 和 Windows 环境中工作时，这是绝对必须的，有时这会导致完全无法工作。如果您总体上坚持这一点，您将使自己的生活更轻松。

    主机名是否匹配 DNS 名称和 keytab 名称？

    对我来说最突出的主要事情是您拥有的空域服务票，即来自 SPN 的服务票host/service-0.metz.prac.os3.nl@。对我来说，这听起来像是您的网络设置正在发生一些时髦的事情。看起来您default_realm的设置正确，所以我认为最终主机有问题。要对此进行调试，我建议使用额外的日志记录 ( sudo /usr/sbin/sshd -p 9001 -D -dd) 在服务上启动一个新的 sshd 实例，然后尝试从客户端连接 ( ssh -p 9001 -vv [email protected])。这将从双方准确地向您展示身份验证期间发生的情况以及实际使用了哪些 SPN。

    我最近遇到了一个问题，因为我连接的服务不知道它自己的 FQDN（即服务试图找到 keytab 条目host/service-0@REALM而不是host/service-0.rest.of.domain@REALM），所以身份验证失败。您可以使用 进行检查hostname --fqdn，如果这不返回系统的完整 DNS 名称，那么您可以编辑/etc/hosts。确保输出hostname --fqdn与 DNS 中的内容匹配。

    最后，确保每个具有正确 SPN 的主机都有一个 keytab 文件。这应该看起来像host/service-0.rest.of.domain@REALM。您可以使用 . 检查 keytab 文件的内容klist -k /path/to/keytab。调试愉快！我知道 Kerberos 有多么令人沮丧。

    核选项

    如果您仍处于设置阶段的早期阶段，那么用火杀死设置并从头开始可能会更容易:)。从长远来看，牢记所有这些并遵循良好的指南可能会为您节省一些时间。

    • 6

  2. 有几件事情需要考虑：

    1.你能在你的客户端机器上得到服务票吗？

    验证您是否可以获得要使用的服务的票证。对于 SSH，这通常是 host/@REALM，或者在您的情况下是 host/[email protected]。如果您kvno host/[email protected]在客户端计算机上运行（您还运行 ssh），它应该会告诉您一个密钥版本号，并且票证应该显示在您的klist.

    2. 你的时间同步正确吗？

    确保两台机器的时间和时区相同（否则时间可能相同，但时区不同）。在所有执行 kerberos 的机器上设置 NTP 可能是最简单的

    3. 您是否将主机的主体添加到/etc/krb5.keytab 中？

    在您要连接的机器上，必须有主机主体 (host/@REALM) 的条目以及正确的密钥版本号（您在步骤 1 中确定的那个）。该文件也必须可以被 sshd 读取

    4. 你的基本网络正确吗？

    Kerberos 非常喜欢正向 DNS和反向 DNS。事实上，到目前为止，我必须调试的 Kerberos 最奇怪的问题与 DNS 解析损坏、反向 DNS 未指向主机 FQDN、主机名配置错误等有关。

    确保所有主机都可以正向和反向解析所有其他主机。还要确保在所有机器上正确配置主机名（使用域名）。命令hostname、hostname -f和应该返回合理的结果hostname -s。hostname -i

    说了这么多：请考虑重命名您的领域。kerberos 领域的事实标准是 ALL.CAPS。因此，当您重建实验室或从生产环境开始时，它应该是 ALL.IN.UPPER.CASE，因此是“METZ.PRAC.OS3.NL”。这只是一个约定，但也许有人依赖它。此外，您现在只需查看即可将您的 DNS 域与您的领域区分开来:)

    • 1

  3. 您是否已将客户端计算机名称添加到主体？
    我们可以使用此命令listprincs或list_principals列出这些信息，如下所示： 在此处输入图像描述

    此外，我们应该将用户帐户添加krbuser到 KDC、client1 和 client2，这样我们就可以使用客户端 1 通过 kerberos 对客户端 2 进行 ssh。

    这是我的实验室：
    服务器：kerberos.example.com
    客户端：client.example.com 客户端
    2：client2.example.com

    KDC 服务器：
    /etc/krb5.conf 

    [logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
 default_realm = EXAMPLE.COM
 default_ccache_name = KEYRING:persistent:%{uid}

[realms]
 EXAMPLE.COM = {
  kdc = kerberos.example.com
  admin_server = kerberos.example.com
 }

[domain_realm]
 .example.com = EXAMPLE.COM
 example.com = EXAMPLE.COM

    /var/kerberos/krb5kdc/kdc.conf 

    [kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88

[realms]
 EXAMPLE.COM = {
  master_key_type = aes256-cts
  default_principal_flags = +preauth  
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
 }

    /etc/ssh/sshd_conf

    # Kerberos options
#KerberosAuthentication yes
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
#KerberosUseKuserok yes

# GSSAPI options
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no
#GSSAPIEnablek5users no

    客户：

    /etc/krb5.conf 与服务器相同，或者您可以将服务器的 krb5.conf 复制到此客户端。与服务器
    /etc/ssh/sshd_conf 相同。

    客户2：

    /etc/krb5.conf 与服务器相同，或者您可以将服务器的 krb5.conf 复制到此客户端。与服务器
    /etc/ssh/sshd_conf 相同。

    结果：

    我们应该将用户帐户添加到服务器、客户端和客户端 2，在我的测试中，我添加user01到服务器、客户端和客户端 2。

    服务器：

    [user01@kerberos ~]$ klist
Ticket cache: KEYRING:persistent:1001:1001
Default principal: [email protected]

Valid starting       Expires              Service principal
06/16/2017 07:18:18  06/17/2017 07:18:18  krbtgt/[email protected]

    客户

    [root@client ~]# su - user01
Last login: Fri Jun 16 08:16:28 UTC 2017 from client2.example.com on pts/1
[user01@client ~]$ klist
Ticket cache: KEYRING:persistent:1001:1001
Default principal: [email protected]

Valid starting       Expires              Service principal
06/16/2017 08:16:27  06/17/2017 08:16:27  krbtgt/[email protected]

    客户2

    [root@client2 jason]# su - user01
Last login: Fri Jun 16 08:18:51 UTC 2017 on pts/0
[user01@client2 ~]$ klist
Ticket cache: KEYRING:persistent:1003:1003
Default principal: [email protected]

Valid starting       Expires              Service principal
06/16/2017 08:18:58  06/17/2017 08:18:54  krbtgt/[email protected]

    之后，我们可以使用user01ssh 从 client2 到 client：

    [root@client2 jason]# ssh [email protected]
Password: 
Last login: Fri Jun 16 08:17:59 2017
[user01@client ~]$

    笔记：

    使用 kerberos 我们应该使用相同的时间，我们应该为它们设置NTP，在我的实验室中，我在 Azure 中创建它们，它们具有相同的时间。

    此外，我们应该将客户端机器名称添加到 principals。

    • 0

相关问题