Question

在docker openldap服务器和客户端容器上工作时，我遇到了一个奇怪的问题。要使用tls启用ldap身份验证，我必须先通过authconfig禁用它，然后重新启用。我也禁用了缓存登录。如果我不首先禁用tls并且只执行第二个命令，则从ssh

登录失败

$ docker exec -t datanode1 bash -c 'authconfig --enableldap --enableldapauth --ldapserver="kerbldap.dkdocker.com" \
 --ldapbasedn="dc=dkdocker,dc=com" --enablesssd --enablesssdauth --enableldaptls --enablemkhomedir --update'

$ ssh dhiren@localhost -p 2224
dhiren@localhost's password: 
Permission denied, please try again.
dhiren@localhost's password: 

$ docker exec -t datanode1 bash -c 'authconfig --disableldaptls --update'

$ docker exec -t datanode1 bash -c 'authconfig --enableldap --enableldapauth --ldapserver="kerbldap.dkdocker.com" \
--ldapbasedn="dc=dkdocker,dc=com" --enablesssd --enablesssdauth --enableldaptls --enablemkhomedir --update'

$ ssh dhiren@localhost -p 2224
dhiren@localhost's password: 
Creating home directory for dhiren.
Last failed login: Thu Sep 21 19:31:42 IST 2017 from gateway on ssh:notty
There were 4 failed login attempts since the last successful login.
[dhiren@datanode1 ~]$ 
docker exec -t clientcontainer1 bash -c 'authconfig --disableldaptls --update'

以下是我的authconfig --test结果

[root@datanode1 ~]# authconfig --test
caching is disabled
nss_files is always enabled
nss_compat is disabled
nss_db is disabled
nss_hesiod is disabled
 hesiod LHS = ""
 hesiod RHS = ""
nss_ldap is enabled
 LDAP+TLS is enabled
 LDAP server = "ldap://kerbldap.dkdocker.com/"
 LDAP base DN = "dc=dkdocker,dc=com"
nss_nis is disabled
 NIS server = ""
 NIS domain = ""
nss_nisplus is disabled
nss_winbind is disabled
 SMB workgroup = "SAMBA"
 SMB servers = ""
 SMB security = "user"
 SMB realm = ""
 Winbind template shell = "/bin/false"
 SMB idmap range = "16777216-33554431"
nss_sss is enabled by default
nss_wins is disabled
nss_mdns4_minimal is disabled
myhostname is enabled
DNS preference over NSS or WINS is disabled
pam_unix is always enabled
 shadow passwords are enabled
 password hashing algorithm is sha512
pam_krb5 is disabled
 krb5 realm = "DKDOCKER.COM"
 krb5 realm via dns is disabled
 krb5 kdc = "kerbldap.dkdocker.com"
 krb5 kdc via dns is disabled
 krb5 admin server = "kerbldap.dkdocker.com"
pam_ldap is enabled
 LDAP+TLS is enabled
 LDAP server = "ldap://kerbldap.dkdocker.com/"
 LDAP base DN = "dc=dkdocker,dc=com"
 LDAP schema = "rfc2307"
pam_pkcs11 is disabled
SSSD smartcard support is disabled
 use only smartcard for login is disabled
 smartcard module = ""
 smartcard removal action = ""
pam_fprintd is disabled
pam_ecryptfs is disabled
pam_winbind is disabled
 SMB workgroup = "SAMBA"
 SMB servers = ""
 SMB security = "user"
 SMB realm = ""
pam_sss is enabled by default
 credential caching in SSSD is enabled
 SSSD use instead of legacy services if possible is enabled
IPAv2 is disabled
IPAv2 domain was not joined
 IPAv2 server = ""
 IPAv2 realm = ""
 IPAv2 domain = ""
pam_pwquality is enabled (try_first_pass local_users_only retry=3 authtok_type=)
pam_passwdqc is disabled ()
pam_access is disabled ()
pam_faillock is disabled (deny=4 unlock_time=1200)
pam_mkhomedir or pam_oddjob_mkhomedir is enabled (umask=0077)
Always authorize local users is enabled ()
     --ldapbasedn="dc=dkdocker,dc=com" --enablesssd --enablesssdauth --enableldaptls --enablemkhomedir --update'

Answer 1

问题是由于/ etc / openldap / cacert目录下的CA.cert缺少符号链接引起的。

LDAP Authentication Requirements

通过authconfig禁用重新启用tls后，openldap tls在客户端上的身份验证工作

1 个答案: