kerberos&LDAP实现免密码登录搭建

其他 2019-12-16 09:34:11 阅读次数: 0 
kerberos && openldap 

1.install openldap & kerberos server:
	yum install db4 db4-utils db4-devel cyrus-sasl* krb5-server-ldap -y
	yum install openldap openldap-servers openldap-clients openldap-devel compat-openldap -y
	
2.conf ldap
	rm -rf /var/lib/ldap/*
	cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
	chown -R ldap.ldap /var/lib/ldap
	cp -rf /etc/openldap/slapd.d /etc/openldap/slapd.d.bak
	cp /usr/share/doc/krb5-server-ldap-1.15.1/kerberos.schema /etc/openldap/schema/
	
#include  (kerberos  & openldap) schema:
cat >>/etc/openldap/slapd.conf<<"EOF"	
	include /etc/openldap/schema/core.schema
	include /etc/openldap/schema/collective.schema
	include /etc/openldap/schema/corba.schema
	include /etc/openldap/schema/cosine.schema
	include /etc/openldap/schema/duaconf.schema
	include /etc/openldap/schema/dyngroup.schema
	include /etc/openldap/schema/inetorgperson.schema
	include /etc/openldap/schema/java.schema
	include /etc/openldap/schema/misc.schema
	include /etc/openldap/schema/nis.schema
	include /etc/openldap/schema/openldap.schema
	include /etc/openldap/schema/ppolicy.schema
	include /etc/openldap/schema/kerberos.schema
EOF

#update slapd.d
	slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
	chown -R ldap:ldap /etc/openldap/slapd.d && chmod -R 700 /etc/openldap/slapd.d


#start sldap
    rpm -e cyrus-sasl-sql 
	rpm -e cyrus-sasl-ldap
	
	systemctl start slapd
	systemctl enable slapd
	ps aux | grep slapd | grep -v grep
	
	
cat >>/root/modify.ldif<<"EOF"
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=test,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=test,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}R5ZBYELRk8gpViFSY2MLnyHsIwHDP3Ec
#PW: slappasswd  123456生成的密码：{SSHA}R5ZBYELRk8gpViFSY2MLnyHsIwHDP3Ec

dn: cn=config
changetype: modify
add: olcAuthzRegexp
olcAuthzRegexp: uid=([^,]*),cn=GSSAPI,cn=auth uid=$1,ou=people,dc=test,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to dn.base="" by * read
olcAccess: {1}to * by dn.base="cn=Manager,dc=test,dc=com" write by self write by * read
EOF

ldapmodify -Y EXTERNAL -H ldapi:/// -f modify.ldif


cat >>/root/init.ldif<<"EOF"
dn: dc=test,dc=com
dc: test
objectClass: domain
objectClass: dcObject

dn: cn=Kerberos,dc=test,dc=com
cn: Kerberos
objectClass: organizationalRole

dn: ou=people,dc=test,dc=com
objectclass: organizationalUnit
ou: people
description: Users

dn: ou=group,dc=test,dc=com
objectClass: organizationalUnit
description: Groups
ou: group
EOF

#导入数据：
ldapadd -x -D 'cn=Manager,dc=test,dc=com' -w 123456 -h 127.0.0.1 -f init.ldif
#执行命令验证数据导入是否成功：
ldapsearch -x -D 'cn=Manager,dc=test,dc=com' -w 123456 -h 127.0.0.1 -b 'dc=test,dc=com'


配置kerberos：


cat >/etc/krb5.conf<<EOF
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
 pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
 default_ccache_name = KEYRING:persistent:%{uid}
 default_realm = TEST.COM

[realms]
  TEST.COM = {
  kdc = 10.130.98.196
  admin_server = 10.130.98.196
        default_domain = TEST.COM
        database_module = openldap_ldapconf
        key_stash_file = /etc/krb5.TEST.COM
        max_life = 1d 0h 0m 0s
        max_renewable_life = 90d 0h 0m 0s
        dict_file = /usr/share/dict/words
    }

[dbdefaults]
    ldap_kerberos_container_dn = cn=Kerberos,dc=test,dc=com

[dbmodules]
    openldap_ldapconf = {
        db_library = kldap
        ldap_servers = ldapi://
        ldap_kerberos_container_dn = cn=Kerberos,dc=test,dc=com
        ldap_kdc_dn = cn=Manager,dc=test,dc=com
        ldap_kadmind_dn = cn=Manager,dc=test,dc=com
        ldap_service_password_file = /etc/krb5.ldap
        ldap_conns_per_server = 5
    }


[domain_realm]
 test.com = TEST.COM
 .test.com = TEST.COM
EOF

生成访问ldap的服务密码文件：
kdb5_ldap_util -D cn=Manager,dc=test,dc=com  -w 123456 stashsrvpw -f /etc/krb5.ldap  cn=Manager,dc=test,dc=com

创建kerberos数据库:
kdb5_ldap_util -D cn=Manager,dc=test,dc=com -H ldap://  create  -r TEST.COM

启动kerberos
systemctl start krb5kdc 
systemctl status krb5kdc
systemctl start kadmin
systemctl status kadmin


测试添加用户：
kadmin.local -q 'ank -pw 123456 test'  #配置 test 用户的密码为：123456

测试
slapcat |grep "test"
测试获取凭证：
kinit test

导入系统用户：
yum install migrationtools -y
vim /usr/share/migrationtools/migrate_common.ph  
DEFAULT_MAIL_DOMAIN = "example.com";  #改成自己的域名
DEFAULT_BASE = "dc=example,dc=com";   #改成自己的域名

grep -E "test" /etc/passwd >/opt/passwd.txt  #选择要导入ldap的帐号
grep -E "test" /etc/group >/opt/group.txt  #选择要导入ldap的组
/usr/share/migrationtools/migrate_passwd.pl /opt/passwd.txt /opt/passwd.ldif  #生成ldap帐号文件
/usr/share/migrationtools/migrate_group.pl /opt/group.txt /opt/group.ldif     #生成group文件 
ldapadd -x -D "cn=Manager,dc=test,dc=com" -w 123456 -f /opt/group.ldif  #导入用户组
ldapadd -x -D "cn=Manager,dc=test,dc=com" -w 123456 -f /opt/passwd.ldif   #导入用户数据

#测试LDAP是否正常
getent passwd test
 systemctl status nslcd 

#ldap 方式认证，test 用户设置密码123456
cat >/root/change.ldif<<EOF
dn: uid=cjb,ou=People,dc=test,dc=com
changetype: modify
add: userPassword
userPassword:: e1NTSEF9Ym0rZXloV1ExalB1aWNEVU1BaHlNM0hZVHh3REIrWU4K
EOF

ldapmodify -x -D 'cn=Manager,dc=test,dc=com' -w 123456 -f change.ldif
测试test密码是否生效
ldapsearch -x -D 'uid=test,ou=People,dc=test,dc=com' -w 123456 127.0.0.1 -b 'ou=People,dc=test,dc=com'

#Kerberos方式认证
echo -n "{SASL}[email protected]" | base64  生成串：e1NBU0x9dGVzdEBURVNULkNPTQ==

cat >/root/change.ldif<<EOF
dn: uid=maokey,ou=People,dc=test,dc=com
changetype: modify
replace: userPassword
userPassword:: e1NBU0x9bWFva2V5QFRFU1QuQ09N
EOF

ldapmodify -x -D 'cn=Manager,dc=test,dc=com' -w 123456 -f change.ldif

#修改saslauthd 配置
vim 

MECH=kerberos5

cat >/etc/sasl2/slapd.conf<<EOF
pwcheck_method: saslauthd
EOF
service slapd restart
service saslauthd status -l #查看有没报错


#Kerberos 相关操作 待整理
服务端相关操作：
创建管理员：
/usr/sbin/kadmin.local -q "addprinc admin/admin"
#database administrator设置ACL权限
vim /var/kerberos/krb5kdc/kadm5.acl  #修改里面的内容
#创建主机KEY
kadmin.local
addprinc -randkey host/node2.example.com
#kadmin.local -q "ank -clearpolicy -randkey host/node2.example.com"
#kadmin.local -q "ktadd host/c2bde55"  #keytab必须为：/etc/krb5.keytab ，

kdestroy 删除凭证
service saslauthd restart
ps -aux | grep saslauthd

Kerberos 认证测试：
testsaslauthd -u test -p 123456

执行 ldapsearch测试LDAP 认证：
ldapsearch -x -D 'uid=test,ou=People,dc=test,dc=com' -w 123456 -h 127.0.0.1 -b 'ou=People,dc=test,dc=com'


clinet相关操作
yum -y install nss-pam-ldapd     #ldap认证模块
yum -y install pam_krb5 sssd krb5-workstation #Kerberos 认证模块、

#配置用户ldap，认证：kerberos
authconfig-tui
注意：
　　1.会更改三个配置文件：/etc/sssd/sssd.conf 、/etc/nsswithch.conf、/etc/pam.d/system-auth
　　2.配置结束，sssd服务自动启动

systemctl status nslcd  #LDAP确认此服务成功启动，否则无法ldap用户信息
systemctl status sssd   #认证缓存，服务挂将引发无法登录

.导入keytab

#客户端导出：/etc/krb5.keytab ，keytab必须为：/etc/krb5.keytab
kinit  kadmin/admin   #上面创建用的用记
kadmin
ktadd host/client.example.com  #根据配置文件，连接到kerberos服务器，将主机的key下载到本地，在此之前，请确认主机已设定hostame 而且主机名可以解析

#ssh相关配置
vi /etc/ssh/ssh_config
	GSSAPIAuthentication yes
	GSSAPIDelegateCredentials yes
vi /etc/ssh/sshd_config
	GSSAPIAuthentication yes
	GSSAPICleanupCredentials yes
systemctl reload sshd
#测试
ssh demouser1@node1

　　#不需要输入密码就对了

klist

　　#列出票据
 
 
 https://blog.csdn.net/linlinv3/article/details/45171097

　　

猜你喜欢

转载自www.cnblogs.com/boxker/p/12047403.html
今日推荐
《美国对全球网络空间安全与发展的威胁和破坏》报告发布
火速冲上 GitHub 热榜 —— 开源编程语言、框架哪有这么可爱？
北京人形机器人创新中心发布全球首个纯电驱拟人奔跑的全尺寸人形机器人“天工”
LFOSSA 源来如此公开课 | 掌握云原生未来：CNCF 认证全面攻略与备考秘籍
周排行
让自己的头脑极度开放
CentOS 6.5(x64) 和Redhat6.5操作系误删libc
高可用注册中心
【日记】12.28/【题解】AtCoder AGC041
XML（5）_XML 约束_DTD
Java集合Map（四）
树梅派安装桌面环境教程
pipenv 的 使用和安装
小程序白屏问题和内存研究
C语言简单选择排序
每日归档
更多
2024-05-02(0)
2024-05-01(4)
2024-04-30(1)
2024-04-29(40)
2024-04-28(0)
2024-04-27(56)
2024-04-26(39)
2024-04-25(22)
2024-04-24(36)
2024-04-23(26)

代码天地 © 2018 codetd.com

境外服务器   最新电视剧2022