在Kerberos数据库中找不到服务器ldap/example.com@EXAMPLE.COM

发布时间：2020-05-24 04:20:23 所属栏目：MsSql 来源：互联网

导读：编辑：问题终于解决了.详细信息可在本消息末尾的故障排除部分中找到. 我在这里留下详细的步骤,以防它可以帮助某人. 设置OpenLDAP 我 – 创建服务器文档经常过时,您会找到多种方法来实现相同的目标. 根据我所读到的,创建服务器的现代方法是使用/etc/openldap/

编辑：问题终于解决了.详细信息可在本消息末尾的故障排除部分中找到.

我在这里留下详细的步骤,以防它可以帮助某人.

设置OpenLDAP

我 – 创建服务器

文档经常过时,您会找到多种方法来实现相同的目标.
根据我所读到的,创建服务器的现代方法是使用/etc/openldap/slapd.ldif而不是/etc/openldap/slapd.conf.以下是使用letsencrypt证书的示例配置.

您通常可以在slapd.ldif中使用olc转换slapd.conf指令.只需确保它位于正确的dn块中.

确保您创建了一个目录/etc/openldap/slapd.d,可由ldap用户读取和写入,并且该slapd已停止.使用slapadd命令将slapd.ldif插入slapd.d.我使用sudo -u ldap运行它,以便slapadd创建ldap用户拥有的文件.你也可以在没有sudo的情况下运行slapadd然后chown -R ldap：ldap /etc/openldap/slapd.d.这里重要的是,所有你的/ etc / openldap目录都是用户运行的slapd可读/写的.

$sudo -u ldap slapadd -d -1 
    -F /etc/openldap/slapd.d 
    -n 0 
    -f /etc/openldap/slapd.ldif

OpenLDAP配置：

# /etc/openldap/slapd.ldif
------------------------------------
dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /run/openldap/slapd.args
olcPidFile: /run/openldap/slapd.pid
olcTLSCipherSuite: ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
olcTLSCACertificateFile: /etc/letsencrypt/live/example/chain.pem
olcTLSCertificateFile: /etc/letsencrypt/live/example/cert.pem
olcTLSCertificateKeyFile: /etc/letsencrypt/live/example/privkey.pem
olcTLSVerifyClient: never

#
# Load dynamic backend modules:
#
dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModuleload: back_mdb.so


dn: cn=schema,cn=config
objectClass: olcSchemaConfig
cn: schema

include: file:///etc/openldap/schema/core.ldif
include: file:///etc/openldap/schema/cosine.ldif
include: file:///etc/openldap/schema/nis.ldif
include: file:///etc/openldap/schema/inetorgperson.ldif
include: file:///etc/openldap/schema/openldap.ldif
include: file:///etc/openldap/schema/kerberos.ldif
include: file:///etc/openldap/schema/openssh-lpk.ldif

# Frontend settings
#
dn: olcDatabase=frontend,cn=config
objectClass: olcDatabaseConfig
objectClass: olcFrontendConfig
olcDatabase: frontend
olcAccess: to dn.base="" by * read
olcAccess: to dn.base="cn=Subschema" by * read
olcAccess: to * 
    by self write 
    by users read 
    by anonymous auth


#######################################################################
# LMDB database definitions
#######################################################################
#
dn: olcDatabase=mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: mdb
olcSuffix: dc=example,dc=com
olcRootDN: cn=Manager,dc=example,dc=com
olcRootPW: {SSHA}anEncryptedPassword
olcDbDirectory: /var/lib/openldap-data
# Indices to maintain
olcDbIndex: objectClass        eq
olcDbIndex: uid                pres,eq
olcDbIndex: memberUid          eq
olcDbIndex: uidNumber          eq
olcDbIndex: gidNumber          eq
olcDbIndex: uniqueMember       eq
olcDbIndex: cn                 pres,sub,eq
olcDbIndex: mail               pres,eq
olcDbIndex: sn                 pres,eq
olcDbIndex: givenname          eq,subinitial
olcDbIndex: dc                 eq
olcDbIndex: krbPrincipalName   eq,pres,sub
olcAccess: to attrs=userPassword,shadowLastChange,krbPrincipalKey,givenName,sn,photo 
    by self write 
    by anonymous auth 
    by dn.base="cn=Manager,dc=com" write 
    by * none
olcAccess: to * 
    by self read 
    by dn.base="cn=Manager,dc=com" write 
    by * read

II – 设置目录信息树(DIT)

启动服务器：$systemctl start slapd

这将创建一个/var/lib/openldap-data/data.mdb(您的发行版上的目录可能不同).如果您遇到问题或想要重置OpenLDAP,可以在停止slapd服务后rm -rf /etc/openldap/slapd.d/* /var/lib/openldap-data/{data.mdb,lock.mdb}并返回步骤I.

我更改了我的slapd.service以销毁/var/lib/openldap-data/lock.mdb,因为在我的设置中,关闭slapd时不会删除此文件,这会阻止它再次启动.

slapd.service的内容：

# /etc/systemd/system/slapd.service
------------------------------------
[Unit]
Description=OpenLDAP Server Daemon
After=network.target

[Service]
# "-d n" stops slapd from forking
ExecStartPre = /bin/rm -f /var/lib/openldap-data/lock.mdb
ExecStart = /usr/lib64/openldap/slapd -u ldap -g ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS -d1
ExecStopPost = /bin/rm -f /var/lib/openldap-data/lock.mdb
Restart = always
RestartSec = 180

[Install]
WantedBy=multi-user.target

# /etc/systemd/system/slapd.service.d/00gentoo.conf
------------------------------------
[Service]
Environment="HOME=/var/lib/openldap"
# Use the slapd configuration directory:
Environment="SLAPD_OPTIONS=-F /etc/openldap/slapd.d"
Environment="SLAPD_URLS=ldaps:/// ldap://127.0.0.1:389/ ldapi://127.0.0.1"
Environment="KRB5_KTNAME=FILE:/etc/openldap/ldap.keytab"

确保ldap用户可以读取证书：

$useradd -r letsencrypt
$chown -R letsencrypt:letsencrypt /etc/letsencrypt
$gpasswd -a ldap letsencrypt
$chmod 750 /etc/letsencrypt/{live,archive}

然后添加构建DIT的ldif文件：

$ldapadd -x -W -D“cn = Manager,dc = example,dc = com”-f ${PATH_TO_FILES}

# example.com.ldif
------------------------------------
# Create example dn
dn: dc=example,dc=com
dc: example
objectClass: dcObject
objectClass: organization
o: Example Organization

# Create Manager role
dn: cn=Manager,dc=com
cn: Manager
description: LDAP Administrator
objectClass: organizationalROle
objectClass: top
roleOccupant: dc=example,dc=com

# users.ldif
------------------------------------
dn: ou=People,dc=com
objectClass: top
objectClass: organizationalUnit
ou: People
description: Users of Example

# groups.ldif
------------------------------------
dn: ou=Group,dc=com
objectClass: top
objectClass: organizationalUnit
ou: Group
description: Groups of Example

III – 设置LDAP客户端

配置ldap.conf：

# /etc/openldap/ldap.conf
------------------------------------
BASE    dc=example,dc=com
URI ldaps://example.com

TLS_CACERT      /etc/letsencrypt/live/example/chain.pem
TLS_REQCERT     allow
TIMELIMIT       2

设置Kerberos

I – 配置服务器

服务器配置(mit-krb5)：

# /etc/krb5.conf
------------------------------------
[logging]
    default = FILE:/var/log/krb5/libs.log
    kdc = FILE:/var/log/krb5/kdc.log
    admin_server = FILE:/var/log/krb5/kadmind.log

[libdefaults]
    default_realm = EXAMPLE.COM

[realms]
    EXAMPLE.COM = {
        kdc = example.com
        admin_server = example.com
        default_domain = example.com
        database_module = openldap_ldapconf
    }

[domain_realm]
    example.com = EXAMPLE.COM
    .example.com = EXAMPLE.COM

[dbdefaults]
    ldap_kerberos_container_dn = cn=krbContainer,dc=com

[dbmodules]
    openldap_ldapconf = {
        db_library = kldap
        ldap_kdc_dn = "cn=Manager,dc=com"

        ldap_kadmind_dn = "cn=Manager,dc=com"

        ldap_service_password_file = /etc/krb5kdc/service.keyfile
        ldap_servers = ldaps://example.com
        ldap_conns_per_server = 5
    }

然后,创建领域：$kdb5_util -r EXAMPLE.COM create -s

II – 配置OpenLDAP后端

设置Kerberos OpenLDAP子树：

$kdb5_ldap_util -D“cn = Manager,dc = com”create -subtrees dc = example,dc = com -r EXAMPLE.COM -s -H ldap：//127.0.0.1“

并在KDC的本地磁盘上创建以加密形式驻留的主密钥的本地副本,以便与OpenLDAP链接：

$kdb5_ldap_util -D“cn = Manager,dc = com”stashsrvpw -f /etc/krb5kdc/service.keyfile cn = Manager,dc = com

这也称为(又名)stash file.

III – 创建一个委托人

启动MIT Kerberos v5服务(krb5)：

$systemctl start krb5-kdc krb5-kadmind

系统服务已从ArchLinux软件包中获取(因为Gentoo没有提供这些文件)：

（编辑：安卓应用网）

【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容!