Question

我有一个使用mod_auth_kerb配置的内部Apache服务器。我也有一个外部Apache服务器，用来代理与内部服务器的连接。

当用户内部使用其域帐户进行连接时，使用kerberose的SSO可以工作。从外部访问时，系统会提示他们输入用户名和密码。在我们实现第二个域（也称为领域）之前，该设置一直有效。

内部，任何一个域上的用户都可以进行身份验证。但是在外部，输入凭据后，内部服务器会报告

[Mon Sep 24 11:17:17.482681 2018] [auth_kerb:error] [pid 10547:tid 140441496266496] [client 10.200.3.36:49484] failed to verify krb5 credentials: Server not found in Kerberos database, referer: https://server.com/

和代理报告

Mon Sep 24 11:17:18.127581 2018] [proxy_http:error] [pid 2539] (70014)End of file found: [client xxx.xxx.xxx.xxx:60926] AH01102: error reading status line from remote server server.com:443, referer: https://server.com/

我知道我缺少明显的东西。

这是来自代理的配置

<VirtualHost *:443>
ServerName server.com
SSLEngine On
SSLCertificateFile /etc/pki/tls/certs/server.com.crt
SSLCertificateKeyFile /etc/pki/tls/private/server.com.key
SSLCertificateChainFile /etc/pki/tls/certs/server.com.inter.crt
SSLProxyEngine On
ProxyPass "/" "https://server.com/"
ProxyPassReverse "/" "https://server.com/"
</VirtualHost>

从内部服务器配置

<VirtualHost *:443>
ServerName server.com
DocumentRoot /var/www/html/wordpress
SSLEngine on
SSLCertificateFile "/etc/pki/tls/certs/server.com.crt"
SSLCertificateKeyFile "/etc/pki/tls/private/server.com.key"
SSLCertificateChainFile /etc/pki/tls/certs/server.com.inter.crt
SSLProtocol +TLSv1.2
SSLCipherSuite RSA:HIGH:-LOW:-RC4

<IF "'%{REMOTE_ADDR}' != '10.200.3.35' && '${REQUEST_URI}' != '/wp-admin'">
AuthType Kerberos
AuthName "Kerberos authenticated intranet"
KrbAuthRealms REALM1 REAM2
KrbServiceName Any
Krb5KeyTab /etc/httpd/merged.keytab
KrbMethodNegotiate On
KrbMethodK5Passwd On
require valid-user
</IF>

<Directory "/var/www/html/wordpress">
AllowOverride All
</Directory>
</VirtualHost>

Keytab示例

slot KVNO Principal
---- ---- ---------------------------------------------------------------------
   1    1 HTTP/server.com@REALM1
   2    1 HTTP/server.com@REALM1
   3    1 HTTP/server.com@REALM1
   4    1 HTTP/server.com@REALM1
   5    1 HTTP/server.com@REALM1
   6    1          HTTP/server.com@REALM2
   7    1          HTTP/server.com@REALM2
   8    1          HTTP/server.com@REALM2
   9    1          HTTP/server.com@REALM2
  10    1          HTTP/server.com@REALM2

Apache反向代理Kerberos

0 个答案: