WEBMIN LDAP身份验证: passwd返回“身份验证令牌操作错误”

Question

更新:2023年1月25日，我相信我的sssd和nslcd工作正常，我也调整了webmin中的pam模块。我还将db添加到nsswitch.conf中，因此我首先在那里进行检查。现在我可以使用ldapsearch -x -D cn=bindadmin，ou=People，dc=xxx，dc=com -W可以成功地查询我的数据库中满是用户的用户，我也可以成功地通过$USER并使用su -l $USER登录新密码，我剩下的唯一问题是允许用户登录到我希望的webmin，因为客户端正在工作，并且passwd更改了工作，它允许我登录，但是当我试图更改转换后的webmin用户acl用于webmin日志时，我会在/var/ webmin /miniserv.error中得到以下错误，这似乎是我获得的唯一的日志错误msg，这阻止了我的webmin用户登录。有什么想法吗？

参数"“不是数字ne (!=) at /usr/libexec/webmin/acl/save_unix.cgi第80行中的数字。重装配置

我正在尝试为unix用户设置ldap身份验证，以便登录，并得到令牌错误。我让ldap用户和组工作，我已经将所有unix用户转换为webmin用户，但我无法让用户登录或用passwd更改密码。我配置并启用了sssd.conf，但我相信这个问题可能与PAM文件有关，我在任何帮助下都有有限的经验，我希望我会在下面的sssd.conf中添加一些PAM的内容。如果你还需要其他的帮助，请告诉我，谢谢。

我也不能使用像ldapmodify或ldapsearch这样的东西，这是因为配置错误的ldap客户机没有到达服务器？当我使用nslcd.conf文件在webmin上配置ldap-client时，它会返回以下内容，但它没有给我运行/启动客户机的选项，就像以前一样，它只给了我验证配置选项，并且都启动了ldap-client，这是为什么它不能正常连接的原因吗？

当我尝试ldap搜索时出现错误消息：

SASL/GSS-SPNEGO authentication started
ldap_sasl_interactive_bind_s: Local error (-2)
additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (SPNEGO cannot find mechanisms to negotiate)

Finding LDAP base for users ..
.. found base dc=xxxx,dc=com.
Connecting to LDAP server ..
.. connected to ldap-primary.ue1.-prod.com

Searching for users ..
.. found 507 users.

Checking Unix users service ..
.. service is setup to query LDAP.

Looking for Unix user bjones ..
.. user found successfully.

Your system has been successfully configured as an LDAP client!

期望：

• 使用LDAP的用户和组功能
• 转换后的unix webmin用户登录功能

以下命令起作用

$ id tuser
uid=6469(tuser) gid=6250(gwtest) groups=6250(gwtest),9003(git),9001(softeng)

$ getent passwd tuser
tuser:*:6469:6250:test user:/home/tuser:/bin/bash

当我尝试passwd tuser时，记录msg：

passwd: pam_unix(passwd:chauthtok): user "tuser" does not exist in /etc/passwd
passwd: pam_sss(passwd:chauthtok): Authentication failed for user tuser: 4 (System error)

当转换的webmin用户尝试登录时，登录msg：

pam_unix(webmin:auth): authentication failure; logname= uid=0 euid=0 tty=10000 ruser= rhost=xxx user=xxx
webmin[8072]: Invalid login as xxxx from xxxx

帕斯瓦多：

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
auth [default=1 ignore=ignore success=ok] pam_localuser.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
auth required pam_deny.so

account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so

password requisite pam_pwquality.so try_first_pass local_users_only retry=3
password sufficient pam_unix.so sha512 shadow nullok try_first_pass
password sufficient pam_sss.so


password required pam_deny.so

session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session optional pam_mkhomedir.so umask=0077
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so

passwd
#%PAM-1.0
auth include system-auth
account include system-auth
password substack system-auth
-password optional pam_gnome_keyring.so
password substack postlogin

webmin
#%PAM-1.0
auth sufficient pam_ldap.so
auth required pam_unix.so nullok
account sufficient pam_ldap.so
account required pam_unix.so
session sufficient pam_ldap.so
session required pam_unix.so

system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
auth [default=1 ignore=ignore success=ok] pam_localuser.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
auth required pam_deny.so

account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so

password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so

session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session optional pam_mkhomedir.so umask=0077
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so

sssd.conf

[sssd]
config_file_version = 2
services = nss, pam, ssh
reconnection_retries = 3
domains = xxxx

[nss]
filter_groups = root
filter_users = root,named,nscd

[

[domain/xxx]
access_provider = ldap
auth_provider = ldap
cache_credentials = true
chpass_provider = none
debug_level = 3
entry_cache_timeout = 300
enum_cache_timeout = 300
enumerate = true
id_provider = ldap
ldap_access_order = expire
ldap_account_expire_policy = shadow
ldap_default_authtok_type = password
ldap_default_authtok = xxxx

ldap_default_bind_dn = cn=bindadmin-sssd,ou=People,dc=xxxx,dc=com
ldap_enumeration_refresh_timeout = 300
ldap_group_member = memberUid
ldap_group_name = cn
ldap_group_object_class = posixGroup
ldap_group_search_base = ou=Groups,dc=xxxx,dc=com
ldap_id_use_start_tls = false
ldap_network_timeout = 3
ldap_pwd_policy = shadow
ldap_schema = rfc2307
ldap_search_base = dc=xxx,dc=com
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_tls_reqcert = never
ldap_uri = ldaps://ldap-01.ue1-prod.com
ldap_user_name = uid
ldap_user_object_class = posixAccount
ldap_user_search_base = ou=People,dc=xxxx,dc=com
ldap_user_shadow_expire = shadowExpire
shell_fallback = /bin/bash

Answer 1

我通过安装perl -module (yum install perl-Authen-PAM)和更新webmin配置解决了这个问题：

auth       required     pam_env.so
auth       sufficient   pam_unix.so likeauth nullok
auth       sufficient   pam_ldap.so use_first_pass
auth       required     pam_deny.so

account    sufficient   pam_unix.so
account    sufficient   pam_ldap.so
account    required     pam_ldap.so

password   required     pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
password   sufficient   pam_unix.so nullok md5 shadow use_authtok
password   sufficient   pam_ldap.so use_first_pass
password   required     pam_deny.so