Kerberos:无法在linux主机和从kdc之间传播数据库

Question

命令

sudo kprop -r MY.DOMAIN -f /var/lib/krb5kdc/slave_datatrans slave_kdc.my.domain

返回

kprop: Key table entry not found while getting initial credentials

这是一个在两个linux服务器上的新安装。master_kdc似乎可以工作，但我无法让数据库进行传播。我手动复制了数据库转储并将其加载到slave_kdc上，但是传播仍然不起作用。

/etc/krb5.conf

[libdefaults]
    default_realm = MY.DOMAIN
# The following krb5.conf variables are only for MIT Kerberos.
    kdc_timesync = 1
    ccache_type = 4
    forwardable = true
    proxiable = true

[realms]
    MY.DOMAIN = {
            kdc = master_kdc.my.domain
            kdc = slave_kdc.my.domain
            admin_server = master_kdc.my.domain
    }
[domain_realm]
    .my.domain = MY.DOMAIN
    my.domain = MY.DOMAIN

/etc/krb5kdc/kdc.conf

[kdcdefaults]
    kdc_ports = 750,88

[realms]
    MY.DOMAIN = {
        database_name = /var/lib/krb5kdc/principal
        admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab
        acl_file = /etc/krb5kdc/kadm5.acl
        key_stash_file = /etc/krb5kdc/stash
        kdc_ports = 750,88
        max_life = 10h 0m 0s
        max_renewable_life = 7d 0h 0m 0s
        master_key_type = des3-hmac-sha1
        #supported_enctypes = aes256-cts:normal aes128-cts:normal
        default_principal_flags = +preauth
    }

[logging]
    kdc = FILE:/var/log/krb5kdc.log
    admin_server = FILE:/var/log/kadmin.log
    default = FILE:/var/log/krb5lib.log

/etc/krb6kdc/kadm5 5/acl

john/admin@MY.DOMAIN        *

/etc/krb5kdc/kprod.acl

host/master_kdc.my.domain@MY.DOMAIN
host/slave_kdc.my.domain@MY.DOMAIN

我安装了xinetd并创建了以下文件，并启用并启动了xinetd服务。/etc/xinetd.d/krb5 5_支柱

service krb5_prop
{
    disable = no
    socket_type = stream
    protocol = tcp
    wait = no
    user = root
    server = /usr/sbin/kpropd
}

sudo cat /etc/services _ grep krb5的结果

kerberos    88/tcp      kerberos5 krb5 kerberos-sec # Kerberos v5
kerberos    88/udp      kerberos5 krb5 kerberos-sec # Kerberos v5
krb5_prop   754/tcp     krb-prop krb_prop hprop # Kerberos slave propagation

在对数据库进行复制之后，我在master_kdc和slave_kdc上生成了/etc/krb5.keytab文件。

kadmin: ktadd host/slave_kdc.my.domain

什么都没有被记录(我不知道为什么)。

/etc/bind/zone/db.my.Domain

$TTL    604800
@       IN      SOA     master_kdc.my.domain. john.my.domain. (
                          5         ; Serial
                     604800         ; Refresh
                      86400         ; Retry
                    2419200         ; Expire
                     604800 )       ; Negative Cache TTL
;
; Name servers - NS records
@       IN      NS      master_kdc.my.domain.
@       IN      NS      slave_kdc.my.domain.

; Name servers - A records
master_kdc  IN      A      AAA.BBB.CCC.DD1
slave_kdc  IN      A       AAA.BBB.CCC.DD2

; Kerberos services
_kerberos._udp.MY.DOMAIN.   IN      SRV     1       0       88      master_kdc.my.domain.
_kerberos._tcp.MY.DOMAIN.   IN      SRV     1       0       88      master_kdc.my.domain.
_kerberos._udp.MY.DOMAIN.   IN      SRV     10      0       88      slave_kdc.my.domain.
_kerberos._tcp.MY.DOMAIN.   IN      SRV     10      0       88      slave_kdc.my.domain.
_kerberos-adm._tcp.MY.DOMAIN.       IN      SRV     1       0       749     master_kdc.my.domain.
_kpasswd._udp.MY.DOMAIN.   IN      SRV     1       0       464      master_kdc.my.domain.

/etc/bind/zone/db.aa

$TTL    604800
@       IN      SOA     master_kdc.my.domain.   john.my.domain. (
                                    5       ; Serial
                               604800       ; Refresh
                                86400       ; Retry
                              2419200       ; Expire
                               604800 )     ; Negative Cache TTL
;
; Name servers - NS records
@       IN      NS      master_kdc.my.domain.
@       IN      NS      slave_kdc.my.domain.
master_kdc  IN      A       AAA.BBB.CCC.DD1
slave_kdc   IN      A       AAA.BBB.CCC.DD2

; Name servers - PTR records
DD1      IN      PTR     master_kdc.my.domain.
DD2      IN      PTR     slave_kdc.my.domain.

Answer 1

我花了几个小时解决这个完全相同的问题。最后，通过以下步骤解决了这一问题：

1. 创建主主机主体“addprinc host/mastr.comain.com”
2. 在主服务器上，向keytab添加主主机主体“ktadd host/mastr.comain.com”。

显然，kprop使用"kinit -k“来获得一张票，而且只有当您在keytab中有主主机条目时，这才能工作。