Linux服务管理-kerberos实验

Kerberos+ssh

Kerberos+SSH是一种结合Kerberos认证协议和SSH（Secure Shell）安全协议的技术方案，旨在提供更安全、便捷的单点登录（SSO）体验。

---

在client修改sshd服务配置

[root@client ~]# vim /etc/ssh/sshd_config（以下内容找到相同的行修改，或解注释修改）
KerberosAuthentication yes
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
GSSAPIKeyExchange yes
UsePAM yes
[root@client ~]# systemctl restart sshd

在kerberos服务端

[root@kdc ~]# kadmin.local
kadmin.local:  addprinc testuser11@KUNPENG.COM
No policy specified for testuser11@KUNPENG.COM; defaulting to no policy
Enter password for principal "testuser11@KUNPENG.COM": （123456）
Re-enter password for principal "testuser11@KUNPENG.COM": （123456）
Principal "testuser11@KUNPENG.COM" created.
kadmin.local:
kadmin.local:  ktadd -k /tmp/client-host.keytab host/client.kunpeng.com@KUNPENG.COM
kadmin.local:  quit
[root@kdc ~]#
[root@kdc ~]# ll /tmp/client-host.keytab 
-rw-------. 1 root root 424 May  6 09:36 /tmp/client-host.keytab
[root@kdc ~]#

在客户端测试

[root@client ~]# scp kdc.kunpeng.com:/tmp/client-host.keytab /etc/krb5.keytab
[root@client ~]# kinit -kt /etc/krb5.keytab host/client.kunpeng.com@KUNPENG.COM
[root@client ~]# klist 输出略
此时客户端没有testuser11用户：
[root@client ~]# kinit testuser11
Password for testuser11@KUNPENG.COM: （123456）
[root@client ~]#
[root@client ~]# ssh testuser11@client.kunpeng.com 
testuser11@client.kunpeng.com's password: 
Permission denied, please try again.
testuser11@client.kunpeng.com's password: 
Permission denied, please try again.
testuser11@client.kunpeng.com's password: 
​
[root@client ~]#此时，使用kerberos的密码无法登陆

创建testuser11用户

[root@client ~]# useradd testuser11
[root@client ~]# ssh testuser11@client.kunpeng.com （用主机名可免密登录）
Activate the web console with: systemctl enable --now cockpit.socket
​
Last failed login: Tue May  7 10:08:24 CST 2024 from 192.168.99.134 on ssh:notty
There were 3 failed login attempts since the last successful login.
[testuser11@client ~]$ exit
logout
Connection to client.kunpeng.com closed.
[root@client ~]# ssh testuser11@127.0.0.1
testuser11@127.0.0.1's password: （123456）
Activate the web console with: systemctl enable --now cockpit.socket
​
Last login: Tue May  7 10:08:56 2024 from 192.168.99.134
[testuser11@client ~]$ exit
logout
Connection to 127.0.0.1 closed.
[root@client ~]#

Kerberos+Ldap

Kerberos与LDAP的集成是一种常见的身份认证和授权机制。Kerberos+LDAP广泛应用于企业内部的身份认证和授权系统。例如，在企业内部网络中，可以使用Kerberos+LDAP来实现对用户访问权限的细粒度控制，确保只有经过认证的用户才能访问特定的资源和服务。此外，Kerberos+LDAP还可以用于构建单点登录系统，方便用户在不同系统之间进行无缝切换。

---

在之前的ldap实验中，cache_credentials = true，会缓存凭证，sssd会缓存用户信息，sss_cache -E命令可以清除缓存，但是清除不彻底，可以删除缓存文件，然后重启服务清空缓存。注: 此时的ldap服务器关闭了slapd服务

[root@client ~]# rm -rf /var/lib/sss/db/cache_*
[root@client ~]# id ldapuser
uid=1001(testuser11) gid=1001(testuser11) groups=1001(testuser11)
[root@client ~]# systemctl restart sssd oddjobd.service 
[root@client ~]# id ldapuser
id: ‘ldapuser’: no such user
[root@client ~]#
​
[root@kdc ~]# kadmin.local 
Authenticating as principal root/admin@KUNPENG.COM with password.
kadmin.local:  addprinc ldapuser@KUNPENG.COM（密码redhat）
[root@client ~]# kinit ldapuser
Password for ldapuser@KUNPENG.COM: 
[root@client ~]#
[root@client ~]# ssh ldapuser@client.kunpeng.com 
ldapuser@client.kunpeng.com's password: 
Permission denied, please try again.
ldapuser@client.kunpeng.com's password: 
[root@client ~]#无法登陆
​
[root@server ~]# systemctl start slapd.service 启动ldap服务端服务

Client测试

[root@client ~]# id ldapuser
uid=1001(testuser11) gid=1001(testuser11) groups=1001(testuser11)
[root@client ~]# ssh ldapuser@client.kunpeng.com 
Activate the web console with: systemctl enable --now cockpit.socket
​
Last failed login: Tue May  7 10:33:43 CST 2024 from 192.168.99.134 on ssh:notty
There were 2 failed login attempts since the last successful login.
Last login: Tue May  7 10:21:15 2024 from 192.168.99.135
[testuser11@client ~]$ exit
logout
Connection to client.kunpeng.com closed.
[root@client ~]# 可以登陆

如上,sssd服务配置不修改，可以正常集成kerberos和ldap，也可以按如下方式修改

[root@client ~]# cat /etc/sssd/sssd.conf
[domain/default]
id_provider = ldap
autofs_provider = ldap
auth_provider = krb5
chpass_provider = ldap
krb5_realm = KUNPENG.COM
krb5_server = kdc.kunpeng.com
krb5_keytab = /etc/krb5.keytab
ldap_uri = ldap://server.kunpeng.com/
ldap_search_base = dc=kunpeng,dc=com
ldap_id_use_start_tls = True
cache_credentials = True
ldap_tls_cacertdir = /etc/openldap/certs
ldap_tls_cacert = /etc/openldap/certs/cert.pem
ldap_tls_reqcert = hard
​
[sssd]
services = nss, pam, autofs
domains = default
​
[nss]
homedir_substring = /home
​
[pam]
[root@client ~]#
[root@client ~]# systemctl restart sssd oddjobd.service
[root@client ~]# ssh ldapuser@client.kunpeng.com 
Activate the web console with: systemctl enable --now cockpit.socket
Last login: Tue May  7 10:35:02 2024 from 192.168.99.134
[testuser11@client ~]$ exit
logout
Connection to client.kunpeng.com closed.
[root@client ~]#