前言

sssd服务是一个守护进程，该进程可以用来访问多种验证服务器，如LDAP，Kerberos等，并提供授权。SSSD是介于本地用户和数据存储之间的进程，本地客户端首先连接SSSD，再由SSSD联系外部资源提供者(一台远程服务器)
(1)避免了本地每个客户端程序对认证服务器大量连接，所有本地程序仅联系SSSD，由SSSD连接认证服务器或SSSD缓存，有效的降低了负载。
(2)允许离线授权。SSSD可以缓存远程服务器的用户认证身份，这允许在远程认证服务器宕机是，继续成功授权用户访问必要的资源。

回到顶部

集成sssd

所有节点安装相关服务

yum -y install openldap-clients sssd authconfig nss-pam-ldapd

将OpenLDAP服务器的/etc/openldap/certs目录下的ldap.key和ldap.crt文件拷贝至OpenLDAP所有客户端节点/etc/openldap/cacerts目录下

[root@cdh1 ~]# scp ldap.key cdh2.macro.com:/etc/openldap/cacerts/

[root@cdh1 ~]# scp ldap.crt cdh3.macro.com:/etc/openldap/cacerts/

在所有客户端节点上执行如下命令

[root@cdh2 cacerts]# cacertdir_rehash /etc/openldap/cacerts/

3.所有节点执行如下命令启用sssd服务（在如下参数中–enableldaptls 如果OpenLDAP服务未启用TLS则将此参数修改为–disableldaptls）

[root@cdh2 cacerts]# authconfig --enablesssd --enablesssdauth --enablerfc2307bis --enableldap --enableldapauth --enableldaptls --disableforcelegacy --disablekrb5 --ldapserver ldap://cdh1.macro.com --ldapbasedn "dc=macro,dc=com" --enablemkhomedir --update

4.修改/etc/sssd/sssd.conf文件，在执行authconfig命令时会默认生成，如果文件不存在则新建，文件内容如下:

[root@cdh2 cacerts]# vim /etc/sssd/sssd.conf
[root@cdh1 home]# cat /etc/sssd/sssd.conf
[domain/default]

autofs_provider = ldap
ldap_schema = rfc2307bis
krb5_realm = MACRO.COM
ldap_search_base = dc=macro,dc=com
krb5_server = cdh1.macro.com
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldap://cdh1.macro.com
ldap_id_use_start_tls = True
ldap_tls_reqcert = allow
cache_credentials = True
ldap_tls_cacertdir = /etc/openldap/cacerts
[sssd]
services = nss, pam, autofs
config_file_version = 2

domains = default
[nss]
homedir_substring = /home

[pam]

[sudo]

[autofs]

[ssh]

[pac]

[ifp]

修改sssd.conf文件权限

[root@cdh2 sssd]# chmod 600 /etc/sssd/sssd.conf

5.启动sssd服务并加入系统自启动

[root@cdh2 sssd]# systemctl start sssd
[root@cdh2 sssd]# systemctl enable sssd
[root@cdh2 sssd]# systemctl status sssd

6.至此完成sssd的配置，可以通过id查看用户OpenLDAP的用户

[user_w@cdh1 root]$ more /etc/passwd |grep etl_user
[user_w@cdh1 root]$ id etl_user
uid=50001(etl_user) gid=50001(etl_user) groups=50001(etl_user)

回到顶部

OpenLDAP与SSH集成

1.修改配置文件/etc/ssh/sshd_config，使ssh通过pam认证账户

#PasswordAuthentication yes
#PermitEmptyPasswords no
PasswordAuthentication yes


# and ChallengeResponseAuthentication to 'no'.
# WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several
# problems.
UsePAM yes

2.修改配置文件/etc/pam.d/sshd，以确认调用pam认证文件

# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    include      password-auth
session    include      postlogin
session    required      pam_mkhomedir.so
# Used with polkit to reauthorize users in remote sessions
-session   optional     pam_reauthorize.so prepare

3.修改配置文件

[root@cdh2 sssd]# vim /etc/pam.d/password-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        [default=1 success=ok] pam_localuser.so
auth        [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success
auth        sufficient    pam_sss.so forward_pass
#auth        sufficient    pam_ldap.so  forward_pass
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 1000 quiet
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
#account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so

password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_sss.so use_authtok
#password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
-session     optional      pam_systemd.so
session     optional      pam_mkhomedir.so umask=0077
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_sss.so
#session     optional      pam_ldap.so

4.修改/etc/pam.d/system-auth配置文件

[root@cdh1 ~]# cat /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        [default=1 success=ok] pam_localuser.so
auth        [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success
auth        sufficient    pam_sss.so forward_pass
#auth        sufficient    pam_ldap.so  forward_pass
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 1000 quiet
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
#account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so

password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_sss.so use_authtok
#password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
-session     optional      pam_systemd.so
session     optional      pam_mkhomedir.so umask=0077
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
#session     optional      pam_sss.so
session     optional      pam_ldap.so

5.重启sshd服务

systemctl restart sshd

至此就完成了OpenLDAP与SSH的集成。

验证SSH登录

1.确认etl_user用户只存在于OpenLDAP

[root@cdh1 ~]# more /etc/passwd |grep etl_user
[root@cdh1 ~]# id etl_user
uid=50001(etl_user) gid=50001(etl_user) groups=50001(etl_user)

2.su切换到etl_user用户

[root@cdh1 ~]# su etl_user
[etl_user@cdh1 root]$ cd ~
[etl_user@cdh1 ~]$ pwd
/home/etl_user
[etl_user@cdh1 ~]$ id
uid=50001(etl_user) gid=50001(etl_user) groups=50001(etl_user)

3.ssh登录本机

[root@cdh1 ~]# ssh etl_user@localhost
etl_user@localhost's password: 
Last login: Thu Oct  1 22:20:08 2020
[etl_user@cdh1 ~]$ pwd
/home/etl_user
[etl_user@cdh1 ~]$ id
uid=50001(etl_user) gid=50001(etl_user) groups=50001(etl_user)

4.ssh远程登录

[root@cdh1 ~]# ssh etl_user@cdh2.macro.com
etl_user@cdh2.macro.com's password: 
Last login: Thu Oct  1 21:41:19 2020 from 192.168.0.171
[etl_user@cdh2 ~]$ pwd
/home/etl_user
[etl_user@cdh2 ~]$ id
uid=50001(etl_user) gid=50001(etl_user) groups=50001(etl_user)

转载连接：https://cloud.tencent.com/developer/article/1719640?from=15425

__EOF__

本文作者：彬在俊
本文链接：https://www.cnblogs.com/erlou96/p/16878145.html
关于博主：评论和私信会在第一时间回复。或者直接私信我。
版权声明：本博客所有文章除特别声明外，均采用 BY-NC-SA 许可协议。转载请注明出处！
声援博主：如果您觉得文章对您有帮助，可以点击文章右下角【推荐】一下。您的鼓励是博主的最大动力！