基于SSH密钥的SSSD与Microsoft AD的集成

Question

我已经在linux机器上配置了SSSD，它使用领域连接到Microsoft。

我的最终目标是使用存储在Microsoft AD中的SSH键登录到CentOS机器。

以下是设置详细信息：

• EC2 Windows for Microsoft
• EC2 Amazon配置了SSSD配置的

我可以使用AD用户名和密码登录到linux机器。

我现在已经将SSH公钥存储在Microsoft altSecurityIdentities用户属性以及sshPublicKeys属性中。

下面是SSSD的Config文件

[sssd]
domains = test.com
config_file_version = 2
services = nss, pam, ssh, sudo
debug_level=10

[domain/test.com]
ad_domain = test.com
ad_server = test.com
krb5_realm = TEST.COM
realmd_tags = manages-system joined-with-samba 
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /home/%u
access_provider = ad
#SSH KEY FETCH
ldap_user_extra_attrs = altSecurityIdentities:altSecurityIdentities
ldap_user_ssh_public_key = altSecurityIdentities
ldap_use_tokengroups = True

[nss]
debug_level=10

下面是sssd_nsss日志中的错误

[sssd[nss]] [cache_req_search_send] (0x0400): CR #476: Object found, but needs to be refreshed.
[sssd[nss]] [cache_req_search_dp] (0x0400): CR #476: Looking up [demo_user@test.com] in data provider
[sssd[nss]] [sss_dp_issue_request] (0x0400): Issuing request for [0x55bf7f9683e0:3:demo_user@test.com@test.com]
[sssd[nss]] [sss_dp_get_account_msg] (0x0400): Creating request for [test.com][0x3][BE_REQ_INITGROUPS][name=demo_user@test.com:-]
[sssd[nss]] [sbus_add_timeout] (0x2000): 0x55bf80d3c120
[sssd[nss]] [sss_dp_internal_get_send] (0x0400): Entering request [0x55bf7f9683e0:3:demo_user@test.com@test.com]
[sssd[nss]] [sbus_remove_timeout] (0x2000): 0x55bf80d3c120
[sssd[nss]] [sbus_dispatch] (0x4000): dbus conn: 0x55bf80d27fe0
[sssd[nss]] [sbus_dispatch] (0x4000): Dispatching.
[sssd[nss]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[nss]] [cache_req_common_dp_recv] (0x0040): CR #476: Data Provider Error: 3, 5, Failed to get reply from Data Provider
[sssd[nss]] [cache_req_common_dp_recv] (0x0400): CR #476: Due to an error we will return cached data
[sssd[nss]] [cache_req_search_cache] (0x0400): CR #476: Looking up [demo_user@test.com] in cache
[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_callback": 0x55bf80d3bc90

[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_timeout": 0x55bf80d2bb90
[sssd[nss]] [ldb] (0x4000): Running timer event 0x55bf80d3bc90 "ldb_kv_callback"
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d2bb90 "ldb_kv_timeout"
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d3bc90 "ldb_kv_callback"
[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_callback": 0x55bf80d3bc90
[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_timeout": 0x55bf80d2bb90
[sssd[nss]] [ldb] (0x4000): Running timer event 0x55bf80d3bc90 "ldb_kv_callback"
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d2bb90 "ldb_kv_timeout"
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d3bc90 "ldb_kv_callback"
[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_callback": 0x55bf80d43d00
[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_timeout": 0x55bf80d41100
[sssd[nss]] [ldb] (0x4000): Running timer event 0x55bf80d43d00 "ldb_kv_callback"
[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_callback": 0x55bf80d46b00
[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_timeout": 0x55bf80d46bd0
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d41100 "ldb_kv_timeout"
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d43d00 "ldb_kv_callback"
[sssd[nss]] [ldb] (0x4000): Running timer event 0x55bf80d46b00 "ldb_kv_callback"
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d46bd0 "ldb_kv_timeout"
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d46b00 "ldb_kv_callback"

[sssd[nss]] [cache_req_search_ncache_filter] (0x0400): CR #476: This request type does not support filtering result by negative cache
[sssd[nss]] [cache_req_search_done] (0x0400): CR #476: Returning updated object [demo_user@test.com]
[sssd[nss]] [cache_req_create_and_add_result] (0x0400): CR #476: Found 2 entries in domain test.com
[sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x55bf7f9683e0:3:demo_user@test.com@test.com]
[sssd[nss]] [cache_req_done] (0x0400): CR #476: Finished: Success
[sssd[nss]] [nss_protocol_done] (0x4000): Sending reply: success

SSSD_SSH日志如下所示

[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]

当我尝试使用ssh登录时，请使用以下命令

ssh demo_user@test.com@<IP>

我得到以下错误

demo_user@test.com@<IP>: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

我试过以下的方法

• Dig

• id demo_user@test.com

uid=1277801117(demo_user) gid=1277800513(域用户)groups=1277800513(域用户)

我试过重新启动SSSD恶魔，但它并没有像在几个论坛上建议的那样有所帮助。

有什么办法能让这件事成功吗

Answer 1

[sssd[nss]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[nss]] [cache_req_common_dp_recv] (0x0040): CR #476: Data Provider Error: 3, 5, Failed to get reply from Data Provider
[sssd[nss]] [cache_req_common_dp_recv] (0x0400): CR #476: Due to an error we will return cached data

这告诉您数据提供程序是脱机的，使用id命令看到的输出来自缓存。请检查SSSD域日志(sssd_*.test.com.log)，为什么客户端不能与后端对话。

一旦修复，请验证您的ssh_config设置是否正确，以便从AD中获取公钥。该文件中需要有以下选项：

AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
AuthorizedKeysCommandUser root

您可以通过手动运行该工具来验证ssh密钥代理是否正常工作：

# sss_ssh_authorizedkeys demo_user

但是，在SSSD数据提供程序能够成功地与AD后端对话之前，这是行不通的。