Question

我正在使用Pluggable Authentication Modules（PAM）在MySQL（安装在RHEL 6.6上）上配置AD身份验证。

到目前为止，我的AD用户可以使用AD凭据登录RHEL框。但是当我尝试使用PAM插件登录MySQL时，我收到了拒绝访问错误。 MySQL的PAM配置如下：

/etc/pam.d/mysql:
auth   required    pam_winbind.so
account required    pam_winbind.so

当我检查MySQL错误日志时，我看到方法authenticate_pam（）中抛出了系统错误。以下是mysqld日志：

entering auth_pam_server 
entering auth_pam_next_token 
auth_pam_next_token:reading at [mysql, MySQLUsers=mysql_ad], sep=[,] 
auth_pam_next_token:state=PRESPACE, ptr=[mysql, MySQLUsers=mysql_ad], out=[] 
auth_pam_next_token:state=IDENT, ptr=[mysql, MySQLUsers=mysql_ad], out=[] 
auth_pam_next_token:state=AFTERSPACE, ptr=[, MySQLUsers=mysql_ad], out=[mysql] 
auth_pam_next_token:state=DELIMITER, ptr=[, MySQLUsers=mysql_ad], out=[mysql] 
auth_pam_next_token:state=DONE, ptr=[, MySQLUsers=mysql_ad], out=[mysql] 
leaving auth_pam_next_token on /export/home/pb2/build/sb_0-19016729-1464156482.79/rpm/BUILD/mysqlcom-pro-5.7.13/mysqlcom-pro-5.7.13/plugin/pam-authentication-plugin/src/parser.c:195 
auth_pam_server:password ******** received 
auth_pam_server:pam_start rc=0 
auth_pam_server:pam_set_item(PAM_RUSER,administrator) rc=0 
auth_pam_server:pam_set_item(PAM_RHOST,localhost) rc=0 
entering auth_pam_server_conv 
auth_pam_server_conv:PAM_PROMPT_ECHO_OFF [Password: ] received 
leaving auth_pam_server_conv on /export/home/pb2/build/sb_0-19016729-1464156482.79/rpm/BUILD/mysqlcom-pro-5.7.13/mysqlcom-pro-5.7.13/plugin/pam-authentication-plugin/src/authentication_pam.c:269 
**auth_pam_server:pam_authenticate rc=4 
auth_pam_server: rc=4 
PAM error: System error** 
leaving auth_pam_server on /export/home/pb2/build/sb_0-19016729-1464156482.79/rpm/BUILD/mysqlcom-pro-5.7.13/mysqlcom-pro-5.7.13/plugin/pam-authentication-plugin/src/authentication_pam.c:441 
2016-07-18T12:48:22.360536Z 122 [Note] Access denied for user 'administrator'@'localhost' (using password: YES)

根据上面的PAM配置，PAM使用winbind在AD中查找用户凭据并进行身份验证，这与将AD用户身份验证到Linux机箱的过程相同。当我看到winbind日志时，我看到以下内容：

[2016/07/18 08:27:24.236701,  5] winbindd/winbindd_pam.c:1868(winbindd_dual_pam_auth)
  Plain-text authentication for user CORPAD\administrator returned NT_STATUS_OK (PAM: 0)

这告诉我，winbind的身份验证工作正常，但是当winbind将控制权返回给PAM时，某些内容失败并引发系统错误。

Answer 1

好吧，我明白了。

首先，我在这篇文章后启用了PAM上的调试日志 - https://serverfault.com/questions/249671/switch-on-pam-debugging-to-syslog。

当我这样做时，我发现每次我尝试进行身份验证时都会收到以下错误： PAM audit_open（）失败：权限被拒绝

这是SELinux强制执行的根本原因。所以我禁用了SELinux并重新启动了系统，这解决了这个问题。我现在可以使用我的AD凭据登录Linux，然后使用mysql命令并对mysql进行身份验证！

MySQL 5.7（RHEL6.6）使用AD进行PAM身份验证

1 个答案: