Question

我一直在尝试使用kdb5_util dump（filename）转储我的Kerberos数据库（ldap后端），但我得到了：

kdb5_util load_dump version 6
kdb5_util: error performing Kerberos version 5 release 1.8 dump (Server error)
policy  default    0       0       1       1       1       0       0       0       0

Kerberos KDC和Kadmin日志没有任何内容，ldap.log给出 5月31日12:40:17 kdc slapd [28020]：connection_input：conn = 1091延期操作：绑定

其他一切正常，创建，删除，校长身份验证，没问题。只是转储数据库失败。据我了解，后端不应对转储产生任何影响。

我有什么想法可以调试或解决这个问题？我错过了什么？

的/etc/krb5.conf

[libdefaults]
        default_realm   = REALM.EXAMPLE.COM
        kdc_timesync    = 1
        ccache_type     = 4
        forwardable     = true
        proxiable       = true

[realms]
        REALM.EXAMPLE.COM = {
                kdc             = kdc.realm.example.com
                admin_server    = kdc.realm.example.com
                kpasswd_server  = kdc.realm.example.com
        }

[domain_realm]
        .realm.example.com  = REALM.EXAMPLE.COM

/etc/krb5kdc/kdc.conf

[realms]
    REALM.EXAMPLE.COM = {
        default_domain  = realm.example.com
        database_module = ldapconf

        acl_file        = /etc/krb5kdc/kadm5.acl
        key_stash_file  = /etc/krb5kdc/.master

       max_life        = 10h 0m 0s
       max_renewable_life = 7d 0h 0m 0s

        master_key_type         = aes256-cts
        supported_enctypes      = aes256-cts-hmac-sha1-96:normal
#aes128-cts-hmac-sha1-96:normal arcfour-hmac:normal
        default_principal_flags = +preauth

        pkinit_identity = FILE:/etc/krb5kdc/kdc-cert.pem,/etc/krb5kdc/.kdc-key.pem
        pkinit_anchors  = FILE:/etc/krb5kdc/ca-cert.pem

        dict_file       = /root/bad_passwords.dict
    }

[dbmodules]
        ldapconf = {
                db_library                 = kldap
                ldap_kerberos_container_dn = "cn=kerberos,dc=realm,dc=example,dc=com"
                ldap_kdc_dn                = "cn=kerberos-kdc,dc=realm,dc=example,dc=com"
                ldap_kadmind_dn            = "cn=kerberos-admin,dc=realm,dc=example,dc=com"
                ldap_servers               = ldapi:///
                ldap_service_password_file = /etc/krb5kdc/.service
    }
[logging]
kdc          = FILE:/var/log/kerberos/kdc.log
admin_server = FILE:/var/log/kerberos/kadmin.log
default      = FILE:/var/log/kerberos/kerberos.log

Answer 1

最后调试后发现问题：

对于搜索请求，LDAP后端的大小限制为500。 501位用户将我排在后面！

修正：

#
# remove sizelimit for ldap search
#
# apply with ldapmodify -Y EXTERNAL -H ldapi:/// -f sizelimit.ldif
#
dn: olcDatabase={1}hdb,cn=config
changetype: modify
add: olcLimits
olcLimits:  dn.exact="cn=kerberos-admin,dc=realm,dc=example,dc=com" size=unlimited

申请，重启slapd，然后愉快地转储

kdb5_util dump提供服务器错误

1 个答案: