FreeIPA와 AD 사이에 신뢰 관계를 구축하고 일부 AD 사용자를 FreeIPA 서버에 추가했는데, 모두 IPA 서버측에 성공적으로 로그인할 수 있었습니다. 하지만 IPA 클라이언트에는 로그인할 수 있습니다. 이것은 FreeIPA에 워크스테이션을 추가하는 데 사용하는 명령입니다.
ipa-client-install -U -f --enable-dns-updates --domain example.com --ntp-server=phoenix.example.com --server=phoenix.example.com -p EXAMPLE.COM -p admin -w '$EXAMPLE' --hostname=$HOSTNAME --automount-location=default --no-dns-sshfp --preserve-sssd
확인한 후 이 경고를 받았습니다 /var/log/message. /var/log/secure
/var/log/secure:
Jan 24 15:19:00 greentag sshd[2092]: Received disconnect from 192.168.5.222: 11: disconnected by user
Jan 24 15:19:00 greentag sshd[2092]: pam_unix(sshd:session): session closed for user root
Jan 24 15:19:12 greentag sshd[3856]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 [email protected]
Jan 24 15:19:12 greentag sshd[3856]: pam_sss(sshd:auth): received for user [email protected]: 6 (Permission denied)
Jan 24 15:19:12 greentag sshd[3838]: error: PAM: Authentication failure for [email protected] from 192.168.5.222
Jan 24 15:19:16 greentag sshd[3892]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 [email protected]
Jan 24 15:19:16 greentag sshd[3892]: pam_sss(sshd:auth): received for user [email protected]: 6 (Permission denied)
Jan 24 15:19:16 greentag sshd[3838]: error: PAM: Authentication failure for [email protected] from 192.168.5.222
Jan 24 15:19:16 greentag sshd[3838]: Postponed keyboard-interactive for [email protected] from 192.168.5.222 port 45318 ssh2 [preauth]
Jan 24 15:19:19 greentag sshd[3895]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 [email protected]
Jan 24 15:19:19 greentag sshd[3895]: pam_sss(sshd:auth): received for user [email protected]: 6 (Permission denied)
Jan 24 15:19:19 greentag sshd[3838]: error: PAM: Authentication failure for [email protected] from 192.168.5.222
Jan 24 15:19:26 greentag sshd[3838]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 [email protected]
Jan 24 15:19:26 greentag sshd[3838]: pam_sss(sshd:auth): received for user [email protected]: 6 (Permission denied)
Jan 24 15:19:26 greentag sshd[3838]: Failed password for [email protected] from 192.168.5.222 port 45318 ssh2
Jan 24 15:19:30 greentag sshd[3838]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.5.222 [email protected]
Jan 24 15:19:30 greentag sshd[3838]: pam_sss(sshd:auth): received for user [email protected]: 6 (Permission denied)
Jan 24 15:19:30 greentag sshd[3838]: Failed password for [email protected] from 192.168.5.222 port 45318 ssh2
/var/log/message:
Jan 24 15:19:12 greentag [sssd[krb5_child[3889]]]: Cannot find KDC for realm "adexample.COM"
Jan 24 15:19:12 greentag [sssd[krb5_child[3889]]]: Cannot find KDC for realm "adexample.COM"
Jan 24 15:19:12 greentag [sssd[krb5_child[3890]]]: Cannot find KDC for realm "adexample.COM"
Jan 24 15:19:12 greentag [sssd[krb5_child[3890]]]: Cannot find KDC for realm "adexample.COM"
하지만 ID를 입력하면 [email protected]이 사용자 정보가 표시됩니다.
답변1
문제가 해결되었네요. 해당 포트를 수동으로 열어야 할 것 같습니다. /etc/sysconfig/iptables를 편집하고 다음 코드를 추가하세요.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
# -A INPUT -s ad_ip_address -p tcp -m multiport --dports 389,636 -m state --state NEW,ESTABLISHED -j REJECT
-A INPUT -p tcp -m multiport --dports 80,88,443,389,636,88,464,53,138,139,445 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m multiport --dports 88,464,53,123,138,139,389,445 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p udp -j REJECT
-A INPUT -p tcp -j REJECT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT