AskOverflow.Dev

AskOverflow.Dev Logo AskOverflow.Dev Logo

AskOverflow.Dev Navigation

  • 主页
  • 系统&网络
  • Ubuntu
  • Unix
  • DBA
  • Computer
  • Coding
  • LangChain

Mobile menu

Close
  • 主页
  • 系统&网络
    • 最新
    • 热门
    • 标签
  • Ubuntu
    • 最新
    • 热门
    • 标签
  • Unix
    • 最新
    • 标签
  • DBA
    • 最新
    • 标签
  • Computer
    • 最新
    • 标签
  • Coding
    • 最新
    • 标签
主页 / ubuntu / 问题

问题[kerberos](ubuntu)

Martin Hope
eekfonky
Asked: 2019-09-08 02:18:29 +0800 CST

通过 krb5 在 fstab 上共享 CIFS

  • 1

我跟着;https://warlord0blog.wordpress.com/2018/03/27/access-dfs-shares-from-linux/

通过这个我可以手动挂载 cifs 共享,但是当我尝试通过 kerberos 将它挂载到 fstab 时;

//windows/share/filepath   /home/Drive cifs user,uid=me,gid=metoo,vers=3.0,rw,sec=krb5  0 0

我明白了

➜  ~ sudo mount -a      
mount error(2): No such file or directory
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)

然后我将其更改为:

//windows/share/filepath   /home/Drive cifs _netdev,sec=krb5,noserverino,user,uid=myname,cruid=myname,gid=mygroup,rw  0 0

它现在在启动时失败,但在我运行后工作;

sudo mount -a
fstab cifs kerberos
  • 1 个回答
  • 3395 Views
Martin Hope
Hunter Lowe
Asked: 2019-02-01 02:56:31 +0800 CST

编辑 Sudoers 文件以允许对 AD 域组的 sudo 权限

  • 5

我最近设法让我的 Ubuntu Server 18.04 机器连接到我公司的 Windows AD。我可以使用我的 AD 凭据登录,但我想更进一步......

这是我为了让我的 Ubuntu 18.04 机器进入 windows 域而遵循的文章,注意我没有做任何配置来限制 ssh 登录到域组,因为我仍在努力。 https://www.smbadmin.com/2018/06/connecting-ubuntu-server-1804-to-active.html?showComment=1548915938955#c6716393705599388679

然而....

我想要实现的目标如下:

  • 在 /etc/sudoers 文件中添加一行,指定我组织内的 AD 组。
  • 该组成员应该在我们组织的 Linux 机器上具有 sudo 访问权限。

我做了什么:

  • 我尝试添加如下行:
  • "nameofdomain\nameofgroup ALL=(ALL:ALL) ALL"
  • 还有更多……但是,每当我尝试与我知道在组中的用户进行 sudo 时,我都会收到通常的“……用户不在 sudoers 中……将报告事件……”

这可能是什么原因?可能是由于我在将机器连接到 AD 域时指定的配置?

该组的完整路径如下: - domainname/Groups/Elab/Elab-Level3

这是我用于加入 AD 域的文件的配置:

krb5.conf

[libdefaults]
    default_realm = MYREALM
dns_lookup_kdc = true
dns_lookup_realm = true

......文件的其余部分............

领域配置文件

[users]
 default-home = /home/%D/%U
 default-shell = /bin/bash

[active-directory]
 default-client = sssd
 os-name = Ubuntu Server
 os-version = 18.04

[service]
 automatic-install = no

[mydomain]
 fully-qualified-names = yes
 automatic-id-mapping = no
 user-principal = yes
 manage-system = yes

sssd.conf

[sssd] 
domains = mydomain config_file_version = 2
services = nss, pam, ssh

[domain/mydomain]
ad_domain = mydomain
krb5_realm = MYDOMAIN
realmd_tags = manages-system joined-with-adcli 
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /home/%u@%d
access_provider = ad
ldap_user_ssh_public_key = altSecurityIdentities

我真的希望这里有人有答案,我已经搜索了很多线程并且无法破解这个坚果

groups active-directory kerberos 18.04 sssd
  • 4 个回答
  • 18974 Views
Martin Hope
Oscar
Asked: 2018-12-13 08:52:10 +0800 CST

Kerberos 和 Ubuntu 18

  • 1

我正在尝试在我的 Ubuntu 工作站上配置自动加入域。我已准备就绪(至少我相信以下命令可以正常工作)

net ads join -U <username>

现在我有两个问题。有人可以向我解释一下 -k 或 --kerberos 选项的作用以及何时可以使用它吗?还有人成功地自动化了这个过程吗?到目前为止,我已经设置了 puppet 来部署所有配置文件(krb、sssd、samba。所有这些都是在手动完成时配置和工作)并在最后运行网络广告连接,但是它似乎失败了(不足为奇,因为我没有提供它带有凭据)有人向我提到要使用 -k 选项运行上述命令,但这似乎也失败了。

active-directory kerberos 18.04
  • 2 个回答
  • 323 Views
Martin Hope
Little Mitch
Asked: 2018-11-12 21:16:18 +0800 CST

包 krb5-kdc 不可用[重复]

  • 0
这个问题在这里已经有了答案:
尝试使用 APT 安装软件包时“无法找到软件包” 7 个答案
3年前关闭。

Ubuntu 服务器 18.04 试过:

~$ sudo apt-get update
Hit:1 http://archive.ubuntu.com/ubuntu bionic InRelease
Get:2 http://archive.ubuntu.com/ubuntu bionic-security InRelease [83.2 kB]
Get:3 http://archive.ubuntu.com/ubuntu bionic-updates InRelease [88.7 kB]
Get:4 http://archive.ubuntu.com/ubuntu bionic/main Translation-en [516 kB]
Get:5 http://archive.ubuntu.com/ubuntu bionic-security/main Translation-en [78.1 kB]
Get:6 http://archive.ubuntu.com/ubuntu bionic-updates/main Translation-en [161 kB]
Fetched 927 kB in 1s (628 kB/s)
Reading package lists... Done

:~$ sudo apt-get install krb5-kdc krb5-admin-server
Reading package lists... Done
Building dependency tree
Reading state information... Done
Package krb5-kdc is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source

E: Package 'krb5-kdc' has no installation candidate
E: Unable to locate package krb5-admin-server

Ubuntu 文档有:

sudo apt install krb5-kdc krb5-admin-server

结果相同。

有一篇关于 Ubuntu 14 的旧帖子...更新解决了他的问题,而不是我的问题。

software-installation updates apt kerberos 18.04
  • 1 个回答
  • 1940 Views
Martin Hope
michele_ub
Asked: 2018-05-06 05:52:53 +0800 CST

带有 Kerberos 身份验证的 SSH

  • 3

我遇到了以下问题:我正在尝试使用带有 Kerberos 身份验证的 SSH 从客户端 VM 连接到服务器 VM,但 SSH 仍然要求我输入密码。显然,我/etc/ssh/sshd_config在服务器端修改了文件以启用:GSSAPIAuthentication yes和GSSAPICleanupCredentials yes. 在客户端机器上,我在/etc/ssh/ssh_config文件中做了同样的事情。关于 Kerberos:我使用 kadmin.local 添加了一个主体,称为host/[email protected]其中“server”是服务器机器的主机名,SERVER.COM 是领域的名称。为 SSH 服务创建该主体后,我使用ktadd -k command添加位于/etc/krb5.keytab. 的输出sudo klist -ke /etc/krb5.keytab是

Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   1 host/[email protected] (aes256-cts-hmac-sha1-96) 
   1 host/[email protected] (aes128-cts-hmac-sha1-96) 
   1 host/[email protected] (aes256-cts-hmac-sha1-96) 
   1 host/[email protected] (aes128-cts-hmac-sha1-96) 
   1 host/[email protected] (aes256-cts-hmac-sha1-96) 
   1 host/[email protected] (aes128-cts-hmac-sha1-96) 
   1 [email protected] (aes256-cts-hmac-sha1-96) 
   1 [email protected] (aes128-cts-hmac-sha1-96) 
   1 host/[email protected] (aes256-cts-hmac-sha1-96) 
   1 host/[email protected] (aes128-cts-hmac-sha1-96) 

所以,keytab的创建就OK了。好吧,在服务器机器上,我还添加了一个名为 michele 的用户(甚至在上面的列表中列出并显然添加为主体),并且在客户端机器上创建了相同的用户。sudo /usr/sbin/sshd -p 9001 -D -dd 我在客户端和服务器上都以调试模式键入了 ssh 命令,得到以下信息:

1)对于服务器端:

debug2: load_server_config: filename /etc/ssh/sshd_config
debug2: load_server_config: done config len = 370
debug2: parse_server_config: config /etc/ssh/sshd_config len 370
debug1: sshd version OpenSSH_7.5, OpenSSL 1.0.2g  1 Mar 2016
debug1: private host key #0: ssh-rsa SHA256:Uu0sgKAMRqoKGBxZ+pLywmfCH8Fby+3p/rgJ5TSn45w
debug1: private host key #1: ecdsa-sha2-nistp256 SHA256:ycCOVyRMzFst+8uwleIs1VtvhsoN+3GZE/Tjj7i/MlA
debug1: private host key #2: ssh-ed25519 SHA256:I1PpnUol1xHFKTiM+yTGN0C3h6PSjgo34VjkFtUH6Uk
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-p'
debug1: rexec_argv[2]='9001'
debug1: rexec_argv[3]='-D'
debug1: rexec_argv[4]='-dd'
debug1: Set /proc/self/oom_score_adj from 0 to -1000
debug2: fd 3 setting O_NONBLOCK
debug1: Bind to port 9001 on 0.0.0.0.
Server listening on 0.0.0.0 port 9001.
debug2: fd 4 setting O_NONBLOCK
debug1: Bind to port 9001 on ::.
Server listening on :: port 9001.
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: inetd sockets after dupping: 3, 3
Connection from 192.168.56.5 port 60904 on 192.168.56.4 port 9001
debug1: Client protocol version 2.0; client software version OpenSSH_7.5p1 Ubuntu-10ubuntu0.1
debug1: match: OpenSSH_7.5p1 Ubuntu-10ubuntu0.1 pat OpenSSH* compat 0x04000000
debug1: Local version string SSH-2.0-OpenSSH_7.5p1 Ubuntu-10ubuntu0.1
debug1: Enabling compatibility mode for protocol 2.0
debug2: fd 3 setting O_NONBLOCK
debug2: Network child is on pid 4541
debug1: permanently_set_uid: 122/65534 [preauth]
debug1: list_hostkey_types: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
debug1: SSH2_MSG_KEXINIT sent [preauth]
debug1: SSH2_MSG_KEXINIT received [preauth]
debug2: local server KEXINIT proposal [preauth]
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1 [preauth]
debug2: host key algorithms: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected] [preauth]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected] [preauth]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
debug2: compression ctos: none,[email protected] [preauth]
debug2: compression stoc: none,[email protected] [preauth]
debug2: languages ctos:  [preauth]
debug2: languages stoc:  [preauth]
debug2: first_kex_follows 0  [preauth]
debug2: reserved 0  [preauth]
debug2: peer client KEXINIT proposal [preauth]
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c [preauth]
debug2: host key algorithms: [email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa [preauth]
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],aes128-cbc,aes192-cbc,aes256-cbc [preauth]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],aes128-cbc,aes192-cbc,aes256-cbc [preauth]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
debug2: compression ctos: none,[email protected],zlib [preauth]
debug2: compression stoc: none,[email protected],zlib [preauth]
debug2: languages ctos:  [preauth]
debug2: languages stoc:  [preauth]
debug2: first_kex_follows 0  [preauth]
debug2: reserved 0  [preauth]
debug1: kex: algorithm: curve25519-sha256 [preauth]
debug1: kex: host key algorithm: ecdsa-sha2-nistp256 [preauth]
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none [preauth]
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none [preauth]
debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
debug2: monitor_read: 6 used once, disabling now
debug2: set_newkeys: mode 1 [preauth]
debug1: rekey after 134217728 blocks [preauth]
debug1: SSH2_MSG_NEWKEYS sent [preauth]
debug1: expecting SSH2_MSG_NEWKEYS [preauth]
debug1: SSH2_MSG_NEWKEYS received [preauth]
debug2: set_newkeys: mode 0 [preauth]
debug1: rekey after 134217728 blocks [preauth]
debug1: KEX done [preauth]
debug1: userauth-request for user michele service ssh-connection method none [preauth]
debug1: attempt 0 failures 0 [preauth]
debug2: parse_server_config: config reprocess config len 370
debug2: monitor_read: 8 used once, disabling now
debug2: input_userauth_request: setting up authctxt for michele [preauth]
debug1: PAM: initializing for "michele"
debug1: PAM: setting PAM_RHOST to "192.168.56.5"
debug1: PAM: setting PAM_TTY to "ssh"
debug2: monitor_read: 100 used once, disabling now
debug2: monitor_read: 4 used once, disabling now
debug2: input_userauth_request: try method none [preauth]
debug1: userauth-request for user michele service ssh-connection method password [preauth]
debug1: attempt 1 failures 0 [preauth]
debug2: input_userauth_request: try method password [preauth]
debug1: PAM: password authentication accepted for michele
debug1: do_pam_account: called
Accepted password for michele from 192.168.56.5 port 60904 ssh2
debug1: monitor_child_preauth: michele has been authenticated by privileged process
debug1: monitor_read_log: child log fd closed
debug1: temporarily_use_uid: 1004/1004 (e=0/0)
debug1: ssh_gssapi_storecreds: Not a GSSAPI mechanism
debug1: restore_uid: 0/0
debug1: PAM: establishing credentials
User child is on pid 4618
debug1: SELinux support disabled
debug1: PAM: establishing credentials
debug1: permanently_set_uid: 1004/1004
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: ssh_packet_set_postauth: called
debug1: Entering interactive session for SSH2.
debug2: fd 6 setting O_NONBLOCK
debug2: fd 8 setting O_NONBLOCK
debug1: server_init_dispatch
debug1: server_input_channel_open: ctype session rchan 0 win 1048576 max 16384
debug1: input_session_request
debug1: channel 0: new [server-session]
debug2: session_new: allocate (allocated 0 max 10)
debug1: session_new: session 0
debug1: session_open: channel 0
debug1: session_open: session 0: link with channel 0
debug1: server_input_channel_open: confirm session
debug1: server_input_global_request: rtype [email protected] want_reply 0
debug1: server_input_channel_req: channel 0 request pty-req reply 1
debug1: session_by_channel: session 0 channel 0
debug1: session_input_channel_req: session 0 req pty-req
debug1: Allocating pty.
debug2: session_new: allocate (allocated 0 max 10)
debug1: session_new: session 0
debug1: SELinux support disabled
debug1: session_pty_req: session 0 alloc /dev/pts/1
debug1: server_input_channel_req: channel 0 request env reply 0
debug1: session_by_channel: session 0 channel 0
debug1: session_input_channel_req: session 0 req env
debug2: Setting env 0: LANG=it_IT.UTF-8
debug1: server_input_channel_req: channel 0 request shell reply 1
debug1: session_by_channel: session 0 channel 0
debug1: session_input_channel_req: session 0 req shell
Starting session: shell on pts/1 for michele from 192.168.56.5 port 60904 id 0
debug2: fd 3 setting TCP_NODELAY
debug1: Setting controlling tty using TIOCSCTTY.
debug2: channel 0: rfd 11 isatty
debug2: fd 11 setting O_NONBLOCK

对于客户端:

~$ ssh -p 9001 -vv [email protected]
OpenSSH_7.5p1 Ubuntu-10ubuntu0.1, OpenSSL 1.0.2g  1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: resolving "192.168.56.4" port 9001
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to 192.168.56.4 [192.168.56.4] port 9001.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/michele/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/michele/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/michele/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/michele/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/michele/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/michele/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/michele/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/michele/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.5p1 Ubuntu-10ubuntu0.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.5p1 Ubuntu-10ubuntu0.1
debug1: match: OpenSSH_7.5p1 Ubuntu-10ubuntu0.1 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 192.168.56.4:9001 as 'michele'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c
debug2: host key algorithms: [email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],aes128-cbc,aes192-cbc,aes256-cbc
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],aes128-cbc,aes192-cbc,aes256-cbc
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected],zlib
debug2: compression stoc: none,[email protected],zlib
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
debug2: host key algorithms: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected]
debug2: compression stoc: none,[email protected]
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:ycCOVyRMzFst+8uwleIs1VtvhsoN+3GZE/Tjj7i/MlA
debug1: checking without port identifier
debug1: Host '192.168.56.4' is known and matches the ECDSA host key.
debug1: Found key in /home/michele/.ssh/known_hosts:1
debug1: found matching key w/out port
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug1: pubkey_prepare: ssh_get_authentication_socket: Permission denied
debug2: key: /home/michele/.ssh/id_rsa ((nil))
debug2: key: /home/michele/.ssh/id_dsa ((nil))
debug2: key: /home/michele/.ssh/id_ecdsa ((nil))
debug2: key: /home/michele/.ssh/id_ed25519 ((nil))
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug2: we did not send a packet, disable method
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1002)

debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1002)

debug2: we did not send a packet, disable method
debug1: Next authentication method: publickey
debug1: Trying private key: /home/michele/.ssh/id_rsa
debug1: Trying private key: /home/michele/.ssh/id_dsa
debug1: Trying private key: /home/michele/.ssh/id_ecdsa
debug1: Trying private key: /home/michele/.ssh/id_ed25519
debug2: we did not send a packet, disable method
debug1: Next authentication method: password
[email protected]'s password: 
debug2: we sent a password packet, wait for reply
debug1: Authentication succeeded (password).
Authenticated to 192.168.56.4 ([192.168.56.4]:9001).
debug1: channel 0: new [client-session]
debug2: channel 0: send open
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype [email protected] want_reply 0
debug2: callback start
debug2: fd 3 setting TCP_NODELAY
debug2: client_session2_setup: id 0
debug2: channel 0: request pty-req confirm 1
debug1: Sending environment.
debug1: Sending env LANG = it_IT.UTF-8
debug2: channel 0: request env confirm 0
debug2: channel 0: request shell confirm 1
debug2: callback done
debug2: channel 0: open confirm rwindow 0 rmax 32768
debug2: channel_input_status_confirm: type 99 id 0
debug2: PTY allocation request accepted on channel 0
debug2: channel 0: rcvd adjust 2097152
debug2: channel_input_status_confirm: type 99 id 0
debug2: shell request accepted on channel 0
Welcome to Ubuntu 17.10 (GNU/Linux 4.13.0-39-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage


0 pacchetti possono essere aggiornati.
0 sono aggiornamenti di sicurezza.

Failed to connect to http://changelogs.ubuntu.com/meta-release. Check your Internet connection or proxy settings

Last login: Sat May  5 12:45:11 2018 from 192.168.56.5
Environment:
  LANG=it_IT.UTF-8
  USER=michele
  LOGNAME=michele
  HOME=/home/michele
  PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games
  MAIL=/var/mail/michele
  SHELL=/bin/bash
  SSH_CLIENT=192.168.56.5 60904 9001
  SSH_CONNECTION=192.168.56.5 60904 192.168.56.4 9001
  SSH_TTY=/dev/pts/1
  TERM=xterm-256color
  XDG_SESSION_ID=39
  XDG_RUNTIME_DIR=/run/user/1004
  DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1004/bus

从客户端来看,似乎存在有关凭据的 GSSAPI 失败。我想在不输入密码的情况下在我的服务器中进行 ssh。你能帮我吗?谢谢!

ssh authentication kerberos
  • 1 个回答
  • 8172 Views
Martin Hope
user2149308
Asked: 2018-04-19 23:49:07 +0800 CST

CIFS 挂载和 Kerberos - 访问权限或最佳实践

  • 10

目前,我们的 Ubuntu 客户端在系统启动期间通过 /etc/fstab 连接到 cifs 共享。这有以下缺点:

  • 密码以纯文本形式作为挂载选项写入
  • 密码应该过期,但如果过期,则必须在每个客户端上更改 /etc/fstab。因此,大多数用于挂载的密码目前都不会过期
  • CIFS 共享安装在连接用户及其权限下,因此不会显示在 Ubuntu 上实际使用该共享的用户。副作用是权限模糊,因为 Ubuntu 用户未列在 Windows 文件系统权限中。

我已经在我们的 Ubuntu-Clients 上成功测试的内容:在用户登录时使用 kerberos 身份验证 - 所以有一个 kerberos 票可供用户使用。

使用该 kerberos 票证 (sudo) 在 systemd 用户服务中安装 cifs 共享

  • PRO:适用于图形登录以及 ssh
  • PRO:共享可以像本地文件系统一样访问
  • CON:如果我挂载在像 /servers/mymount 这样的全局挂载点上,我必须小心,不要覆盖多个用户的挂载。然后,连接用户将是任何后续用户都将使用其权限的用户。

使用该 kerberos 票证从文件浏览器 nautilus 和 thunar 动态挂载共享

  • PRO:如果通过文件浏览器建立与共享的连接,则不需要额外的脚本或服务
  • PRO:共享已安装到用户上下文中,因此绝对需要用户许可。如果用户没有权限,仍然有可能将共享连接到另一个用户。
  • PRO:安装可以通过 /etc/profile 使用 gvfs-mount 自动化
  • PRO:不需要 sudo 权限,用户可以根据需要 gvfs-mount 和 -unmount,通过文件浏览器非常直观
  • 缺点:没有实际的挂载点,ls、cp 等标准 unix 命令不起作用。我将不得不使用 gvfs-* 替代品。此时,上述带有 mount.cifs 的解决方案似乎更好。

所以我想要像访问 nfs 共享一样访问 cifs 共享。

  • 挂载期间未使用密码
  • 应使用访问用户的权限
  • 文件系统的行为应该像本地文件系统(标准的 unix 命令应该可以工作)

我可以多次将 CIFS 共享挂载到每个用户的主目录中,但是

有没有办法在引导期间由用户 root 挂载 CIFS 共享,而不是指定连接用户,然后使用访问用户的权限(例如通过 kerberos 票证)?

提前谢谢你,巴斯蒂安

permissions mount cifs kerberos
  • 1 个回答
  • 13574 Views

Sidebar

Stats

  • 问题 205573
  • 回答 270741
  • 最佳答案 135370
  • 用户 68524
  • 热门
  • 回答
  • Marko Smith

    如何运行 .sh 脚本?

    • 16 个回答
  • Marko Smith

    如何安装 .tar.gz(或 .tar.bz2)文件?

    • 14 个回答
  • Marko Smith

    如何列出所有已安装的软件包

    • 24 个回答
  • Marko Smith

    无法锁定管理目录 (/var/lib/dpkg/) 是另一个进程在使用它吗?

    • 25 个回答
  • Martin Hope
    Flimm 如何在没有 sudo 的情况下使用 docker? 2014-06-07 00:17:43 +0800 CST
  • Martin Hope
    Ivan 如何列出所有已安装的软件包 2010-12-17 18:08:49 +0800 CST
  • Martin Hope
    La Ode Adam Saputra 无法锁定管理目录 (/var/lib/dpkg/) 是另一个进程在使用它吗? 2010-11-30 18:12:48 +0800 CST
  • Martin Hope
    David Barry 如何从命令行确定目录(文件夹)的总大小? 2010-08-06 10:20:23 +0800 CST
  • Martin Hope
    jfoucher “以下软件包已被保留:”为什么以及如何解决? 2010-08-01 13:59:22 +0800 CST
  • Martin Hope
    David Ashford 如何删除 PPA? 2010-07-30 01:09:42 +0800 CST

热门标签

10.10 10.04 gnome networking server command-line package-management software-recommendation sound xorg

Explore

  • 主页
  • 问题
    • 最新
    • 热门
  • 标签
  • 帮助

Footer

AskOverflow.Dev

关于我们

  • 关于我们
  • 联系我们

Legal Stuff

  • Privacy Policy

Language

  • Pt
  • Server
  • Unix

© 2023 AskOverflow.DEV All Rights Reserve