Kerberos 인증을 사용하여 SSH를 통해 Linux VM에 로그인하려고 합니다.
내 Linux VM은 realmd/sssd 방법을 사용하여 내 AD에 성공적으로 연결되었습니다.
sshd_config 설정을 다음과 같이 변경했습니다.
PasswordAuthentication yes
ChallengeResponseAuthentication no
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
UsePAM yes
클라이언트 측의 Mac OS 10.12, .ssh/config에는 다음이 포함됩니다.
GSSAPIAuthentication yes
GSSAPIKeyExchange yes
GSSAPIDelegateCredentials yes
Linux VM에 -v ssh를 사용하면 출력은 다음과 같습니다.
OpenSSH_7.5p1, OpenSSL 1.0.2n 7 Dec 2017
debug1: Reading configuration data /Users/alex/.ssh/config
debug1: Reading configuration data /usr/local/etc/ssh/ssh_config
debug1: Connecting to plex [192.168.1.23] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /Users/alex/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/alex/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/alex/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/alex/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/alex/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/alex/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/alex/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/alex/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.5
debug1: Remote protocol version 2.0, remote software version
OpenSSH_7.4p1 Debian-10+deb9u2
debug1: match: OpenSSH_7.4p1 Debian-10+deb9u2 pat OpenSSH* compat
0x04000000
debug1: Authenticating to plex:22 as 'alex'
debug1: An invalid name was supplied
unknown mech-code 0 for mech 1 2 752 43 14 2
debug1: Miscellaneous failure (see text)
unknown mech-code 0 for mech 1 3 6 1 5 5 14
debug1: Miscellaneous failure (see text)
unknown mech-code 2 for mech 1 3 6 1 4 1 311 2 2 10
debug1: An unsupported mechanism was requested
unknown mech-code 0 for mech 1 3 5 1 5 2 7
debug1: Miscellaneous failure (see text)
unknown mech-code 0 for mech 1 3 6 1 5 2 5
debug1: Offering GSSAPI proposal: gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g==,gss-group1-sha1-toWM5Slw5Ew8Mqkay+al2g==,gss-group14-sha1-toWM5Slw5Ew8Mqkay+al2g==
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256
SHA256:gLapxwxzqzjnfD7CZhnkEkcVeWRPUeh1XnCwKzV8YMs
debug1: Host 'plex' is known and matches the ECDSA host key.
debug1: Found key in /Users/alex/.ssh/known_hosts:2
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug1: Next authentication method: gssapi-with-mic
debug1: Delegating credentials
debug1: Delegating credentials
debug1: Miscellaneous failure (see text)
The ticket isn't for us
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug1: An invalid name was supplied
unknown mech-code 0 for mech 1 2 752 43 14 2
debug1: Miscellaneous failure (see text)
unknown mech-code 0 for mech 1 3 6 1 5 5 14
debug1: Miscellaneous failure (see text)
unknown mech-code 2 for mech 1 3 6 1 4 1 311 2 2 10
debug1: An unsupported mechanism was requested
unknown mech-code 0 for mech 1 3 5 1 5 2 7
debug1: Miscellaneous failure (see text)
unknown mech-code 0 for mech 1 3 6 1 5 2 5
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/alex/.ssh/id_rsa
debug1: Trying private key: /Users/alex/.ssh/id_dsa
debug1: Trying private key: /Users/alex/.ssh/id_ecdsa
debug1: Trying private key: /Users/alex/.ssh/id_ed25519
debug1: Next authentication method: keyboard-interactive
Password:
그럼 비밀번호를 물어보는데...
내가 뭐 잘못 했어요?
/etc/sssd/sssd/conf는 다음과 같습니다.
[sssd]
domains = home.lan
config_file_version = 2
services = nss, pam, ssh
[domain/home.lan]
ad_domain = home.lan
id_provider = ad
access_provider = ad
krb5_realm = HOME.LAN
realmd_tags = joined-with-adcli
cache_credentials = True
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
use_fully_qualified_names = False
fallback_homedir = /home/%u
감사해요!
답변1
도메인 계정 정보를 성공적으로 확인할 수 있었습니까?
id username@domain
또한 출력을 확인하십시오.
realm discover domain
Linux 시스템이 Kerberos의 구성원인 경우 출력은 다음과 같아야 합니다.
[root@linuxVM ~]# realm discover domain.dom
domain.dom
**type: kerberos**
realm-name: DOMAIN.DOM
domain-name: domain.dom
configured: no
server-software: active-directory
client-software: sssd
required-package: oddjob
required-package: oddjob-mkhomedir
required-package: sssd
required-package: adcli
required-package: samba-common-tools
다음과 같이 로그인해 보시길 바랍니다.
ssh [email protected]
Kerberos 구성원이 나열되지 않으면 다음 명령을 사용하여 다시 참가할 수 있습니다.
realm join domain.dom -U [email protected]
그런 다음 다음 명령을 사용하여 SSSD 로그인을 활성화합니다.
authconfig --enablesssd --enablesssdauth --enablemkhomedir --update
realmd 및 sssd 서비스를 다시 시작합니다.
이렇게 하면 모든 도메인 사용자가 Linux 서버에 로그인할 수 있습니다. 모든 로그인을 거부하고 그룹별 로그인을 활성화하고 싶을 수도 있지만 그 여부는 귀하에게 맡기겠습니다.
#Deny login to everyone using below:
realm deny --all
#Permit specific AD Groups:
realm permit -g [email protected]