需要帮助验证加入子域的 linux (Ubuntu) 服务器。我可以在域控制器上看到服务器名称，并且能够成功运行身份验证测试，但是我无法使用我的域帐户登录。似乎 SSSD 或 KRB5 配置的某个配置设置需要指定子域。这也不是域信任问题，因为加入子域的 Windows 服务器正在接受来自父帐户的凭据。
kinit -V [email protected]
Authenticated to Kerberos v5
root@SERVER:/var/log/sssd# systemctl status sssd
Oct 22 17:55:09 SERVER [sssd[ldap_child[27928]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client '[email protected]' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection.
SSSD 日志文件中的错误
Fri Oct 22 17:32:51 2021) [sssd[be[DOMAIN.SYS]]] [confdb_get_domain_internal] (0x0010): Unknown domain [CHILD.DOMAIN.SYS]
(Fri Oct 22 17:32:51 2021) [sssd[be[DOMAIN.SYS]]] [confdb_get_domains] (0x0010): Error (2 [No such file or directory]) retrieving domain [CHILD.DOMAIN.SYS], skipping!
固态硬盘配置
root@SERVER:cat /etc/sssd/sssd.conf
[sssd]
services = nss, pam
config_file_version = 2
domains = DOMAIN.SYS, CHILD.DOMAIN.SYS
[nss]
default_shell = /bin/bash
[domain/DOMAIN.SYS]
id_provider = ad
access_provider = ad
override_homedir = /home/%d/%u
ad_hostname = server.child.domain.sys
#ad_server = dc.child.domain.sys
#ad_domain = DOMAIN.SYS
KRB5 配置
root@SERVER: cat /etc/krb5.conf
[libdefaults]
default_realm = DOMAIN.SYS
ticket_lifetime = 24h #
renew_lifetime = 7d
rdns = false
The following krb5.conf variables are only for MIT Kerberos.
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true