シナリオは次のとおりです。
私は2台のマシンを持っています:
Ubuntu、LDAPを実行してユーザーを認証する
CentOs、winbindを使用してユーザーを認証
homedirをマウントするには、fstabとnfsの共有を使用します。
問題はこれです:
ubuntuでは、getent passwdでは、ユーザーは次のようになります。
john:x:3000052:1901:John Doe:/home/john:/bin/bash
しかし、CentOでは、同じユーザーがgetentpasswdで次のように使用します。
john:*:16777228:16777218:John Doe:/home/john:/bin/bash
ご覧のとおり、UIDとGIDが一致していないため、ユーザーがCentOSでホームフォラーにアクセスしようとすると、アクセス許可が拒否されます。 CDユーザーのために、CentOSにUbuntuとまったく同じUIDとGIDを持たせたいです。
Smb.confでidmapについて何かを見つけることができましたが、機能していません。
[global]
idmap workgroup = MOSEK
idmap config MOSEK:backend = rid
idmap config MOSEK:base_rid = 0
idmap config MOSEK:range = 3000040 - 4999999
#--authconfig--start-line--
# Generated by authconfig on 2014/09/30 08:26:52
# DO NOT EDIT THIS SECTION (delimited by --start-line--/--end-line--)
# Any modification may be deleted or altered by authconfig in future
workgroup = MOSEK
...autogenerated stuff
#--authconfig--end-line--
しかし、これは機能していません。
私がやろうとしていることを明確にしたいと思います
編集:
さて、これがauthconfigが私のために生成したものです。あなたの答えのおかげで、これは適切かもしれないと思います。
#--authconfig--start-line--
# Generated by authconfig on 2014/09/30 08:26:52
# DO NOT EDIT THIS SECTION (delimited by --start-line--/--end-line--)
# Any modification may be deleted or altered by authconfig in future
workgroup = MOSEK
password server = nyborg.mosek.zentyal
realm = MOSEK.ZENTYAL
security = ads
idmap config * : range = 1000-999999
template homedir = /home/%U
template Shell = /bin/bash
kerberos method = secrets only
winbind use default domain = true
winbind offline logon = false
winbind enum users = true
winbind enum groups = true
winbind cache time = 5
winbind nested groups = true
winbind enum users = true
winbind enum groups = true
winbind cache time = 5
winbind nested groups = true
winbind enum groups = true
winbind cache time = 5
winbind nested groups = true
winbind cache time = 5
winbind nested groups = true
winbind nested groups = true
winbind enum users = true
winbind enum groups = true
winbind cache time = 5
winbind nested groups = true
winbind enum groups = true
winbind cache time = 5
winbind nested groups = true
winbind cache time = 5
winbind nested groups = true
winbind nested groups = true
winbind enum groups = true
winbind cache time = 5
winbind nested groups = true
winbind cache time = 5
winbind nested groups = true
winbind nested groups = true
winbind cache time = 5
winbind nested groups = true
winbind nested groups = true
winbind nested groups = true
winbind enum users = true
winbind enum groups = true
winbind cache time = 5
winbind nested groups = true
winbind enum groups = true
winbind cache time = 5
winbind nested groups = true
winbind cache time = 5
winbind nested groups = true
winbind nested groups = true
winbind enum groups = true
winbind cache time = 5
winbind nested groups = true
winbind cache time = 5
winbind nested groups = true
winbind nested groups = true
winbind cache time = 5
winbind nested groups = true
winbind nested groups = true
winbind nested groups = true
winbind enum groups = true
winbind cache time = 5
winbind nested groups = true
winbind cache time = 5
winbind nested groups = true
winbind nested groups = true
winbind cache time = 5
winbind nested groups = true
winbind nested groups = true
winbind nested groups = true
winbind cache time = 5
winbind nested groups = true
winbind nested groups = true
winbind nested groups = true
winbind nested groups = true
winbind enum users = true
winbind enum groups = true
winbind cache time = 5
winbind nested groups = true
winbind enum groups = true
winbind cache time = 5
winbind nested groups = true
winbind cache time = 5
winbind nested groups = true
winbind nested groups = true
winbind enum groups = true
winbind cache time = 5
winbind nested groups = true
winbind cache time = 5
winbind nested groups = true
winbind nested groups = true
winbind cache time = 5
winbind nested groups = true
winbind nested groups = true
winbind nested groups = true
winbind enum groups = true
winbind cache time = 5
winbind nested groups = true
winbind cache time = 5
winbind nested groups = true
winbind nested groups = true
winbind cache time = 5
winbind nested groups = true
winbind nested groups = true
winbind nested groups = true
winbind cache time = 5
winbind nested groups = true
winbind nested groups = true
winbind nested groups = true
winbind nested groups = true
winbind enum groups = true
winbind cache time = 5
winbind nested groups = true
winbind cache time = 5
winbind nested groups = true
winbind nested groups = true
winbind cache time = 5
winbind nested groups = true
winbind nested groups = true
winbind nested groups = true
winbind cache time = 5
winbind nested groups = true
winbind nested groups = true
winbind nested groups = true
winbind nested groups = true
winbind cache time = 5
winbind nested groups = true
winbind nested groups = true
winbind nested groups = true
winbind nested groups = true
winbind nested groups = true
#--authconfig--end-line--
EDIT2:sssd.confに適切なアクセス許可を与えようとすると、新しいエラーが発生しました:
[root@centosy sssd]# journalctl -xn
-- Logs begin at Mon 2014-10-06 10:14:59 CEST, end at Tue 2014-10-07 10:28:42 CEST. --
Oct 07 10:28:36 centosy.mosek.zentyal sssd[be[5567]: Starting up
Oct 07 10:28:38 centosy.mosek.zentyal sssd[be[5568]: Starting up
Oct 07 10:28:41 centosy.mosek.zentyal sssd[5570]: Starting up
Oct 07 10:28:41 centosy.mosek.zentyal sssd[5569]: Starting up
Oct 07 10:28:41 centosy.mosek.zentyal sssd[5571]: Starting up
Oct 07 10:28:41 centosy.mosek.zentyal sssd[5572]: Starting up
Oct 07 10:28:42 centosy.mosek.zentyal sssd[be[5573]: Starting up
Oct 07 10:28:42 centosy.mosek.zentyal systemd[1]: sssd.service: control process exited, code=exited status=1
Oct 07 10:28:42 centosy.mosek.zentyal systemd[1]: Failed to start System Security Services Daemon.
-- Subject: Unit sssd.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit sssd.service has failed.
--
-- The result is failed.
Oct 07 10:28:42 centosy.mosek.zentyal systemd[1]: Unit sssd.service entered failed state.
EDIT3:
さて、私はあなたのガイドに従いました、そしてこれが私が最初から最後までしたことです:
[root@centosy sssd]# authconfig --update --disableldap --ldapbasedn="dc=mosek,dc=zentyal" --ldapserver="ldap://172.16.0.5" --enablerfc2307bis --disablekrb5 --enablekrb5kdcdns --krb5realm=mosek.zentyal --enablesssd --enablesssdauth --enablemkhomedir --enablepamaccess --enablelocauthorize --smbrealm=mosek.zentyal --smbservers=nyborg.mosek.zentyal --smbworkgroup=MOSEK --smbsecurity=ads
getsebool: SELinux is disabled
[root@centosy sssd]# net ads join createupn=Host/`hostname -f`@MOSEK.ZENTYAL -U tomas
Ignoring unknown parameter "idmap workgroup"
Ignoring unknown parameter "idmap workgroup"
Enter tomas's password:
Using short domain name -- MOSEK
Joined 'CENTOSY' to dns domain 'mosek.zentyal'
これが私のsssd.confです:
[sssd]
config_file_version = 2
domains = mosek.zentyal
services = nss, pam
debug_level = 0
[nss]
[pam]
[domain/mosek.zentyal]
debug_level = 5
cache_credentials = false
enumerate = false
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
access_provider = ldap
ldap_sasl_mech = GSSAPI
ldap_sasl_authid = Host/[email protected]
ldap_sasl_canonicalize = false
ldap_user_search_base = ou=Users,dc=mosek,dc=zentyal
ldap_user_object_class = user
ldap_user_home_directory = unixHomeDirectory
ldap_user_name = sAMAccountName
ldap_user_Shell = loginShell
ldap_group_name = msSFU30Name
ldap_group_object_class = group
ldap_group_search_base = ou=Groups,dc=mosek,dc=zentyal
ldap_access_order = expire
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = true
ldap_disable_referrals = true
ldap_id_mapping = false
ldap_schema = rfc2307bis
krb5_realm = MOSEK.ZENTYAL
krb5_canonicalize = false
krb5_server = mosek.zentyal
だから今私はsssdを再起動します:
[root@centosy sssd]# service sssd restart
Redirecting to /bin/systemctl restart sssd.service
編集4:
これは私のnsswitch.confです:
passwd: files sss
shadow: files sss
group: files sss
hosts: files dns
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files sss
netgroup: files sss
publickey: nisplus
automount: files sss
aliases: files nisplus
あなたが抱えている問題は、rid
idmapの使用です。
これは、アルゴリズムを使用して、範囲内で設定した制限の間でUIDの乱数を生成します。これは、ホスト間で常に異なります。
必要なのはads
idmapですが、これはIDがADとldapに存在する必要があることを意味します。
UNIXグループと基本属性へのアクセスのみに関心があり、すべてのADグループにアクセスする必要がない場合は、winbindは必要ありません。
入力するKerberosを構成します/etc/krb5.conf
そしてsmb.conf
次のようになります。
[global] workgroup = ADIRE client signing = yes client use spnego = yes kerberos method = secrets and keytab log file = /var/log/samba/%m.log password server = adire.XXX.XX.uk realm = ADIRE.XXX.XXX.UK security = ads client ldap sasl wrapping = sign
これを簡単にするために、sssdにすべてを制御させることができますが、最初にこれを機能させてください!
あなたが持っているオプションの良い一般的な考えは [〜#〜]ここ[〜#〜] です。
LDAP属性でAD認証を使用するようにCentOSホストを構成するには、次のauthconfigコマンドを使用できます(ドメインの詳細を置き換えます)。
authconfig --update --disableldap --ldapbasedn="dc=adire,dc=domain,dc=co,dc=uk" --ldapserver="ldap://ad1.adire.domain.co.uk:ldap://ad2.adire.domain.co.uk" --enablerfc2307bis --disablekrb5 --enablekrb5kdcdns --krb5realm=ADIRE.DOMAIN.CO.UK --enablesssd --enablesssdauth --enablemkhomedir --enablepamaccess --enablelocauthorize --smbrealm=ADIRE.DOMAIN.CO.UK --smbservers="ad1.adire.domain.co.uk ad2.adire.domain.co.uk" --smbworkgroup=ADIRE --smbsecurity=ads
次に、ホストをドメインに参加させ、Kerberosを作成します/etc/krb5.keytab
ファイル:
net ads join createupn=Host/`hostname -f`@ADIRE.DOMAIN.CO.UK -U priviledged_user
kinit @ADIRE.DOMAIN.CO.UK
net ads keytab create
net ads keytab add Host/`hostname -f`@ADIRE.DOMAIN.CO.UK
これにより、sssd
が有効になり、すべてのマッピングを(/etc/sssd/sssd.conf
):
[sssd]
config_file_version = 2
domains = adire.domain.co.uk
services = nss, pam
debug_level = 0
[nss]
[pam]
[domain/adire.domain.co.uk]
debug_level = 5
cache_credentials = false
enumerate = false
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
access_provider = ldap
ldap_sasl_mech = GSSAPI
ldap_sasl_authid = Host/[email protected]
ldap_sasl_canonicalize = false
ldap_user_search_base = OU=User Accounts,DC=adire,DC=domain,DC=co,DC=uk
ldap_user_object_class = user
ldap_user_home_directory = unixHomeDirectory
ldap_user_name = sAMAccountName
ldap_user_Shell = loginShell
ldap_group_name = msSFU30Name
ldap_group_object_class = group
ldap_group_search_base = OU=Groups,DC=adire,DC=domain,DC=co,DC=uk
ldap_access_order = expire
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = true
ldap_disable_referrals = true
ldap_id_mapping = false
ldap_schema = rfc2307bis
krb5_realm = ADIRE.DOMAIN.CO.UK
krb5_canonicalize = false
krb5_server = adire.domain.co.uk
sssd
が起動時に開始するように設定されており、authconfigコマンドを実行してドメインに参加した後に再起動されることを確認します。