kerberos-ldap linux账户集中管理认证

本文主要是介绍kerberos-ldap linux账户集中管理认证，对大家解决编程问题具有一定的参考价值，需要的程序猿们随着小编来一起学习吧！

#part1 install and config kerberos
yum -y install krb5-server

vi /etc/krb5.conf

# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/

[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
default_realm = EXAMPLE.COM
default_ccache_name = KEYRING:persistent:%{uid}

[realms]
EXAMPLE.COM = {
kdc = cenvm01.example.com
admin_server = cenvm01.example.com
}

[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM

[root@cenvm01 ~]# vi /var/kerberos/krb5kdc/kdc.conf
[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88

[realms]
EXAMPLE.COM = {
#master_key_type = aes256-cts
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
}

[root@cenvm01 ~]# vi /var/kerberos/krb5kdc/kadm5.acl
*/admin@EXAMPLE.COM *

[root@cenvm01 ~]# kdb5_util create -s -r EXAMPLE.COM
Loading random data
Initializing database '/var/kerberos/krb5kdc/principal' for realm 'EXAMPLE.COM',
master key name 'K/M@EXAMPLE.COM'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key:
Re-enter KDC database master key to verify:
[root@cenvm01 ~]#

systemctl enable kadmin
systemctl enable krb5kdc

systemctl start kadmin
systemctl start krb5kdc

systemctl status kadmin
systemctl status krb5kdc

firewall-cmd --get-services | grep kerberos --color
firewall-cmd --permanent --add-service kerberos
firewall-cmd --reload

#add client set

[root@cenvm01 ~]# kadmin.local
Authenticating as principal root/admin@EXAMPLE.COM with password.
kadmin.local: addprinc -randkey host/cenvm02.example.com
WARNING: no policy specified for host/cenvm02.example.com@EXAMPLE.COM; defaulting to no policy
Principal "host/cenvm02.example.com@EXAMPLE.COM" created.
kadmin.local: addprinc -randkey host/cenvm03.example.com
WARNING: no policy specified for host/cenvm03.example.com@EXAMPLE.COM; defaulting to no policy
Principal "host/cenvm03.example.com@EXAMPLE.COM" created.
kadmin.local: ktadd -k /tmp/cenvm02.keytab host/cenvm02.example.com
Entry for principal host/cenvm02.example.com with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab WRFILE:/tmp/cenvm02.keytab.
Entry for principal host/cenvm02.example.com with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:/tmp/cenvm02.keytab.
Entry for principal host/cenvm02.example.com with kvno 2, encryption type des3-cbc-sha1 added to keytab WRFILE:/tmp/cenvm02.keytab.
Entry for principal host/cenvm02.example.com with kvno 2, encryption type arcfour-hmac added to keytab WRFILE:/tmp/cenvm02.keytab.
Entry for principal host/cenvm02.example.com with kvno 2, encryption type camellia256-cts-cmac added to keytab WRFILE:/tmp/cenvm02.keytab.
Entry for principal host/cenvm02.example.com with kvno 2, encryption type camellia128-cts-cmac added to keytab WRFILE:/tmp/cenvm02.keytab.
Entry for principal host/cenvm02.example.com with kvno 2, encryption type des-hmac-sha1 added to keytab WRFILE:/tmp/cenvm02.keytab.
Entry for principal host/cenvm02.example.com with kvno 2, encryption type des-cbc-md5 added to keytab WRFILE:/tmp/cenvm02.keytab.
kadmin.local: ktadd -k /tmp/cenvm03.keytab host/cenvm03.example.com
Entry for principal host/cenvm03.example.com with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab WRFILE:/tmp/cenvm03.keytab.
Entry for principal host/cenvm03.example.com with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:/tmp/cenvm03.keytab.
Entry for principal host/cenvm03.example.com with kvno 2, encryption type des3-cbc-sha1 added to keytab WRFILE:/tmp/cenvm03.keytab.
Entry for principal host/cenvm03.example.com with kvno 2, encryption type arcfour-hmac added to keytab WRFILE:/tmp/cenvm03.keytab.
Entry for principal host/cenvm03.example.com with kvno 2, encryption type camellia256-cts-cmac added to keytab WRFILE:/tmp/cenvm03.keytab.
Entry for principal host/cenvm03.example.com with kvno 2, encryption type camellia128-cts-cmac added to keytab WRFILE:/tmp/cenvm03.keytab.
Entry for principal host/cenvm03.example.com with kvno 2, encryption type des-hmac-sha1 added to keytab WRFILE:/tmp/cenvm03.keytab.
Entry for principal host/cenvm03.example.com with kvno 2, encryption type des-cbc-md5 added to keytab WRFILE:/tmp/cenvm03.keytab.
kadmin.local: listprincs
K/M@EXAMPLE.COM
host/cenvm02.example.com@EXAMPLE.COM
host/cenvm03.example.com@EXAMPLE.COM
kadmin/admin@EXAMPLE.COM
kadmin/cenvm01@EXAMPLE.COM
kadmin/changepw@EXAMPLE.COM
kiprop/cenvm01@EXAMPLE.COM
krbtgt/EXAMPLE.COM@EXAMPLE.COM
kadmin.local: quit
[root@cenvm01 ~]#

scp /tmp/cenvm02.keytab cenvm02:/tmp/
scp /etc/krb5.conf cenvm02:/tmp/

scp /tmp/cenvm03.keytab cenvm03:/tmp/
scp /etc/krb5.conf cenvm03:/tmp/

#add cenvm02 client

cenvm02:

yum -y install pam_krb5 krb5-workstation

\cp /tmp/krb5.conf /etc/krb5.conf

[root@cenvm02 ~]# ktutil
ktutil: rkt /tmp/cenvm02.keytab
ktutil: wkt /etc/krb5.keytab
ktutil: list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
1 2 host/cenvm02.example.com@EXAMPLE.COM
2 2 host/cenvm02.example.com@EXAMPLE.COM
3 2 host/cenvm02.example.com@EXAMPLE.COM
4 2 host/cenvm02.example.com@EXAMPLE.COM
5 2 host/cenvm02.example.com@EXAMPLE.COM
6 2 host/cenvm02.example.com@EXAMPLE.COM
7 2 host/cenvm02.example.com@EXAMPLE.COM
8 2 host/cenvm02.example.com@EXAMPLE.COM
ktutil: quit
[root@cenvm02 ~]#

cenvm03:

yum -y install pam_krb5 krb5-workstation

\cp /tmp/krb5.conf /etc/krb5.conf

[root@cenvm03 ~]# ktutil
ktutil: rkt /tmp/cenvm03.keytab
ktutil: wkt /etc/krb5.keytab
ktutil: list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
1 2 host/cenvm03.example.com@EXAMPLE.COM
2 2 host/cenvm03.example.com@EXAMPLE.COM
3 2 host/cenvm03.example.com@EXAMPLE.COM
4 2 host/cenvm03.example.com@EXAMPLE.COM
5 2 host/cenvm03.example.com@EXAMPLE.COM
6 2 host/cenvm03.example.com@EXAMPLE.COM
7 2 host/cenvm03.example.com@EXAMPLE.COM
8 2 host/cenvm03.example.com@EXAMPLE.COM
ktutil: quit
[root@cenvm03 ~]#

###part2 install and openldap

cenvm01

yum -y install openldap-servers openldap-clients migrationtools

[root@cenvm01 ~]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
[root@cenvm01 ~]# chown -R ldap. /var/lib/ldap/
[root@cenvm01 ~]# id ldap
uid=55(ldap) gid=55(ldap) groups=55(ldap)
[root@cenvm01 ~]# slappasswd
New password:
Re-enter new password:
{SSHA}hV7t0ej8dgXNjJcF1nMT+aSGeRiwTx27
[root@cenvm01 ~]# cd /etc/openldap/slapd.d/cn\=config
[root@cenvm01 cn=config]# vi olcDatabase\=\{0\}config.ldif

# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 709b5a17
dn: olcDatabase={0}config
objectClass: olcDatabaseConfig
olcDatabase: {0}config
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern
al,cn=auth" manage by * none
structuralObjectClass: olcDatabaseConfig
entryUUID: 181b5bb4-1dee-1038-9f9f-d702330f7fe2
creatorsName: cn=config
createTimestamp: 20180717091821Z
entryCSN: 20180717091821.466480Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20180717091821Z
olcRootPW: {SSHA}hV7t0ej8dgXNjJcF1nMT+aSGeRiwTx27 #add

[root@cenvm01 cn=config]# vi olcDatabase\=\{2\}hdb.ldif
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 2dd10505
dn: olcDatabase={2}hdb
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {2}hdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=example,dc=com
olcRootDN: cn=Manager,dc=example,dc=com
olcRootPW: {SSHA}hV7t0ej8dgXNjJcF1nMT+aSGeRiwTx27 #add
olcDbIndex: objectClass eq,pres
olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
structuralObjectClass: olcHdbConfig
entryUUID: 181b6ece-1dee-1038-9fa1-d702330f7fe2
creatorsName: cn=config
createTimestamp: 20180717091821Z
entryCSN: 20180717091821.466969Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20180717091821Z
#add
olcAccess: {0}to attrs=userPassword by self write by dn.base="cn=Manager,dc=example,dc=com" write by anonymous auth by * none
olcAccess: {1}to * by dn.base="cn=Manager,dc=example,dc=com" write by self write by * read

[root@cenvm01 cn=config]# vi olcDatabase\=\{1\}monitor.ldif
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 52d29cfe
dn: olcDatabase={1}monitor
objectClass: olcDatabaseConfig
olcDatabase: {1}monitor
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern
al,cn=auth" read by dn.base="cn=Manager,dc=example,dc=com" read by * none
structuralObjectClass: olcDatabaseConfig
entryUUID: 181b6906-1dee-1038-9fa0-d702330f7fe2
creatorsName: cn=config
createTimestamp: 20180717091821Z
entryCSN: 20180717091821.466820Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20180717091821Z

[root@cenvm01 cn=config]# systemctl enable slapd
Created symlink from /etc/systemd/system/multi-user.target.wants/slapd.service to /usr/lib/systemd/system/slapd.service.
[root@cenvm01 cn=config]# systemctl start slapd
[root@cenvm01 cn=config]# netstat -nltp

[root@cenvm01 cn=config]# firewall-cmd --get-services|grep ldap --color
RH-Satellite-6 amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec iscsi-target kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp open*** pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind rsyncd samba samba-client smtp ssh telnet tftp tftp-client transmission-client vdsm vnc-server wbem-https

[root@cenvm01 cn=config]# firewall-cmd --permanent --add-service=ldap
success
[root@cenvm01 cn=config]# firewall-cmd --reload
success
[root@cenvm01 cn=config]# ll /etc/openldap/schema/
total 312
-r--r--r--. 1 root root 2036 May 16 17:56 collective.ldif
-r--r--r--. 1 root root 6190 May 16 17:56 collective.schema
-r--r--r--. 1 root root 1845 May 16 17:56 corba.ldif
-r--r--r--. 1 root root 8063 May 16 17:56 corba.schema
-r--r--r--. 1 root root 20612 May 16 17:56 core.ldif
-r--r--r--. 1 root root 20499 May 16 17:56 core.schema
-r--r--r--. 1 root root 12006 May 16 17:56 cosine.ldif
-r--r--r--. 1 root root 73994 May 16 17:56 cosine.schema
-r--r--r--. 1 root root 4842 May 16 17:56 duaconf.ldif
-r--r--r--. 1 root root 10388 May 16 17:56 duaconf.schema
-r--r--r--. 1 root root 3330 May 16 17:56 dyngroup.ldif
-r--r--r--. 1 root root 3289 May 16 17:56 dyngroup.schema
-r--r--r--. 1 root root 3481 May 16 17:56 inetorgperson.ldif
-r--r--r--. 1 root root 6267 May 16 17:56 inetorgperson.schema
-r--r--r--. 1 root root 2979 May 16 17:56 java.ldif
-r--r--r--. 1 root root 13901 May 16 17:56 java.schema
-r--r--r--. 1 root root 2082 May 16 17:56 misc.ldif
-r--r--r--. 1 root root 2387 May 16 17:56 misc.schema
-r--r--r--. 1 root root 6809 May 16 17:56 nis.ldif
-r--r--r--. 1 root root 7640 May 16 17:56 nis.schema
-r--r--r--. 1 root root 3308 May 16 17:56 openldap.ldif
-r--r--r--. 1 root root 1514 May 16 17:56 openldap.schema
-r--r--r--. 1 root root 6904 May 16 17:56 pmi.ldif
-r--r--r--. 1 root root 20467 May 16 17:56 pmi.schema
-r--r--r--. 1 root root 4570 May 16 17:56 ppolicy.ldif
-r--r--r--. 1 root root 20489 May 16 17:56 ppolicy.schema

[root@cenvm01 cn=config]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=cosine,cn=schema,cn=config"

[root@cenvm01 cn=config]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=nis,cn=schema,cn=config"

[root@cenvm01 cn=config]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=inetorgperson,cn=schema,cn=config"

[root@cenvm01 cn=config]# cd
[root@cenvm01 ~]# vi base.ldif
dn: dc=example,dc=com
objectClass: dcObject
objectClass: organization
dc: example
o : example

dn: ou=People,dc=example,dc=com
objectClass: organizationalUnit
ou: People

dn: ou=Group,dc=example,dc=com
objectClass: organizationalUnit
ou: Group

[root@cenvm01 ~]# ldapadd -x -D cn=Manager,dc=example,dc=com -W -f base.ldif #密码不能用特殊字符
Enter LDAP Password:
adding new entry "dc=example,dc=com"

adding new entry "ou=People,dc=example,dc=com"

adding new entry "ou=Group,dc=example,dc=com"

[root@cenvm01 ~]# ldapsearch -x -D cn=Manager,dc=example,dc=com -W -b dc=example,dc=com
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <dc=example,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# example.com
dn: dc=example,dc=com
objectClass: dcObject
objectClass: organization
dc: example
o: example

# People, example.com
dn: ou=People,dc=example,dc=com
objectClass: organizationalUnit
ou: People

# Group, example.com
dn: ou=Group,dc=example,dc=com
objectClass: organizationalUnit
ou: Group

# search result
search: 2
result: 0 Success

# numResponses: 4
# numEntries: 3

#add demouser
[root@cenvm01 ~]# useradd demouser1
[root@cenvm01 ~]# useradd demouser2
[root@cenvm01 ~]# id demouser1
uid=1000(demouser1) gid=1000(demouser1) groups=1000(demouser1)
[root@cenvm01 ~]# id demouser2
uid=1001(demouser2) gid=1001(demouser2) groups=1001(demouser2)
[root@cenvm01 ~]# cd /usr/share/migrationtools/
[root@cenvm01 migrationtools]# vi migrate_common.ph

# Default DNS domain
$DEFAULT_MAIL_DOMAIN = "panda.tv";

# Default base
$DEFAULT_BASE = "dc=example,dc=com";

# such as person.
$EXTENDED_SCHEMA = 1;

[root@cenvm01 migrationtools]# grep demo /etc/passwd >/tmp/users
[root@cenvm01 migrationtools]# grep demo /etc/group >/tmp/groups
[root@cenvm01 migrationtools]# ./migrate_passwd.pl /tmp/users /tmp/users.ldif
[root@cenvm01 migrationtools]# ./migrate_group.pl /tmp/groups /tmp/groups.ldif
[root@cenvm01 migrationtools]# cat /tmp/groups.ldif
dn: cn=demouser1,ou=Group,dc=example,dc=com
objectClass: posixGroup
objectClass: top
cn: demouser1
userPassword: {crypt}x
gidNumber: 1000

dn: cn=demouser2,ou=Group,dc=example,dc=com
objectClass: posixGroup
objectClass: top
cn: demouser2
userPassword: {crypt}x
gidNumber: 1001

[root@cenvm01 migrationtools]# ldapadd -x -D cn=Manager,dc=example,dc=com -W -f /tmp/groups.ldif
Enter LDAP Password:
adding new entry "cn=demouser1,ou=Group,dc=example,dc=com"

adding new entry "cn=demouser2,ou=Group,dc=example,dc=com"

[root@cenvm01 migrationtools]# ldapadd -x -D cn=Manager,dc=example,dc=com -W -f /tmp/users.ldif
Enter LDAP Password:
adding new entry "uid=demouser1,ou=People,dc=example,dc=com"

adding new entry "uid=demouser2,ou=People,dc=example,dc=com"

#cenvm02 cenvm03

yum -y install nss-pam-ldapd

[root@cenvm02 ~]# authconfig-tui

#add
use ldap
use kerberos

next

│ [ ] Use TLS
│ Server: ldap://cenvm01.example.com/│
│ Base DN: dc=example,dc=com

next

│
│ Realm: EXAMPLE.COM_____________________________ │
│ KDC: cenvm01.example.com_____________________ │
│ Admin Server: cenvm01.example.com_____________________ │
│ [*] Use DNS to resolve hosts to realms │
│ [ ] Use DNS to locate KDCs for realms
ok

[root@cenvm03 ~]# cat /etc/nsswitch.conf

passwd: files sss ldap
shadow: files sss ldap
group: files sss ldap

[root@cenvm02 ~]# grep demo /etc/passwd
[root@cenvm02 ~]# getent passwd |grep demo
demouser1:x:1000:1000:demouser1:/home/demouser1:/bin/bash
demouser2:x:1001:1001:demouser2:/home/demouser2:/bin/bash

设置密码

[root@cenvm01 ~]# kadmin.local
Authenticating as principal root/admin@EXAMPLE.COM with password.
kadmin.local: addprinc demouser1
WARNING: no policy specified for demouser1@EXAMPLE.COM; defaulting to no policy
Enter password for principal "demouser1@EXAMPLE.COM":
Re-enter password for principal "demouser1@EXAMPLE.COM":
Principal "demouser1@EXAMPLE.COM" created.
kadmin.local: addprinc demouser2
WARNING: no policy specified for demouser2@EXAMPLE.COM; defaulting to no policy
Enter password for principal "demouser2@EXAMPLE.COM":
Re-enter password for principal "demouser2@EXAMPLE.COM":
Principal "demouser2@EXAMPLE.COM" created.
kadmin.local: quit

#part 3 install nfs

cenvm01

yum -y install nfs-utils

vi /etc/exports

/home *(rw,sync)

systemctl enable rpcbind
systemctl enable nfs-server
systemctl start rpcbind
systemctl start nfs-server

firewall-cmd --permanent --add-service=nfs
firewall-cmd --reload

showmount -e

#cenvm02 cenvm03
yum install nfs-utils autofs

vi /etc/auto.master

#add
/home /etc/auto.autofs --timeout=600

vi /etc/auto.autofs

#add
* cenvm01:/home/&

systemctl enable autofs
systemctl start autofs
systemctl restart autofs

vi /etc/ssh/ssh_config
GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes

vi /etc/ssh/sshd_config
GSSAPIAuthentication yes

systemctl reload sshd

ssh demouser1@cenvm02
ssh demouser2@cenvm02
ssh demouser1@cenvm03
ssh demouser2@cenvm03

id
pwd
mount |grep demo
klist

这篇关于kerberos-ldap linux账户集中管理认证的文章就介绍到这儿，希望我们推荐的文章对大家有所帮助，也希望大家多多支持为之网！