Active directory SSSD与Microsoft AD集成，用于基于SSH密钥的登录

我已经在linux机器上配置了SSSD，该机器使用Realm连接到Microsoft AD林

我的最终目标是使用Microsoft AD中存储的SSH密钥登录CentOS机器

以下是安装详细信息：

• EC2 Windows for Microsoft AD
• 配置了SSSD的EC2 Amazon Linux

我可以使用AD用户名和密码登录linux机器

现在，我已将SSH公钥存储在Microsoft ADaltSecurityIdentities用户属性以及sshPublicKeys属性中

下面是SSSD的配置文件

[sssd]
domains = test.com
config_file_version = 2
services = nss, pam, ssh, sudo
debug_level=10

[domain/test.com]
ad_domain = test.com
ad_server = test.com
krb5_realm = TEST.COM
realmd_tags = manages-system joined-with-samba 
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /home/%u
access_provider = ad
#SSH KEY FETCH
ldap_user_extra_attrs = altSecurityIdentities:altSecurityIdentities
ldap_user_ssh_public_key = altSecurityIdentities
ldap_use_tokengroups = True

[nss]
debug_level=10

我在sssd\u nsss日志中发现以下错误

[sssd[nss]] [cache_req_search_send] (0x0400): CR #476: Object found, but needs to be refreshed.
[sssd[nss]] [cache_req_search_dp] (0x0400): CR #476: Looking up [demo_user@test.com] in data provider
[sssd[nss]] [sss_dp_issue_request] (0x0400): Issuing request for [0x55bf7f9683e0:3:demo_user@test.com@test.com]
[sssd[nss]] [sss_dp_get_account_msg] (0x0400): Creating request for [test.com][0x3][BE_REQ_INITGROUPS][name=demo_user@test.com:-]
[sssd[nss]] [sbus_add_timeout] (0x2000): 0x55bf80d3c120
[sssd[nss]] [sss_dp_internal_get_send] (0x0400): Entering request [0x55bf7f9683e0:3:demo_user@test.com@test.com]
[sssd[nss]] [sbus_remove_timeout] (0x2000): 0x55bf80d3c120
[sssd[nss]] [sbus_dispatch] (0x4000): dbus conn: 0x55bf80d27fe0
[sssd[nss]] [sbus_dispatch] (0x4000): Dispatching.
[sssd[nss]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[nss]] [cache_req_common_dp_recv] (0x0040): CR #476: Data Provider Error: 3, 5, Failed to get reply from Data Provider
[sssd[nss]] [cache_req_common_dp_recv] (0x0400): CR #476: Due to an error we will return cached data
[sssd[nss]] [cache_req_search_cache] (0x0400): CR #476: Looking up [demo_user@test.com] in cache
[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_callback": 0x55bf80d3bc90

[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_timeout": 0x55bf80d2bb90
[sssd[nss]] [ldb] (0x4000): Running timer event 0x55bf80d3bc90 "ldb_kv_callback"
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d2bb90 "ldb_kv_timeout"
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d3bc90 "ldb_kv_callback"
[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_callback": 0x55bf80d3bc90
[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_timeout": 0x55bf80d2bb90
[sssd[nss]] [ldb] (0x4000): Running timer event 0x55bf80d3bc90 "ldb_kv_callback"
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d2bb90 "ldb_kv_timeout"
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d3bc90 "ldb_kv_callback"
[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_callback": 0x55bf80d43d00
[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_timeout": 0x55bf80d41100
[sssd[nss]] [ldb] (0x4000): Running timer event 0x55bf80d43d00 "ldb_kv_callback"
[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_callback": 0x55bf80d46b00
[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_timeout": 0x55bf80d46bd0
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d41100 "ldb_kv_timeout"
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d43d00 "ldb_kv_callback"
[sssd[nss]] [ldb] (0x4000): Running timer event 0x55bf80d46b00 "ldb_kv_callback"
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d46bd0 "ldb_kv_timeout"
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d46b00 "ldb_kv_callback"

[sssd[nss]] [cache_req_search_ncache_filter] (0x0400): CR #476: This request type does not support filtering result by negative cache
[sssd[nss]] [cache_req_search_done] (0x0400): CR #476: Returning updated object [demo_user@test.com]
[sssd[nss]] [cache_req_create_and_add_result] (0x0400): CR #476: Found 2 entries in domain test.com
[sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x55bf7f9683e0:3:demo_user@test.com@test.com]
[sssd[nss]] [cache_req_done] (0x0400): CR #476: Finished: Success
[sssd[nss]] [nss_protocol_done] (0x4000): Sending reply: success

SSSD\u SSH日志如下所示

[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]

当我尝试使用以下命令使用ssh登录时

ssh demo_user@test.com@<IP>

ssh演示_user@test.com@

我得到下面的错误

demo_user@test.com@<IP>: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

demo_user@test.com@：权限被拒绝（公钥、gssapi keyex、带麦克风的gssapi）。

我试过下面的东西

• 挖掘

• id演示_user@test.com
  uid=1277801117（演示用户）gid=1277800513（域用户）组=1277800513（域用户）

我曾尝试重新启动SSSD Demon，但它没有像少数论坛中建议的那样起到帮助作用

有没有办法让这一切顺利

[sssd[nss]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[nss]] [cache_req_common_dp_recv] (0x0040): CR #476: Data Provider Error: 3, 5, Failed to get reply from Data Provider
[sssd[nss]] [cache_req_common_dp_recv] (0x0400): CR #476: Due to an error we will return cached data

这告诉您数据提供程序处于脱机状态，并且您使用

id

命令看到的输出来自缓存。请检查SSSD域日志（SSSD*.test.com.log）了解客户端无法与后端对话的原因

修复后，请验证您的

ssh\u config

设置是否正确，以便从AD获取公钥。此文件中需要包含以下选项：

AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
AuthorizedKeysCommandUser root

您可以通过手动运行该工具来验证ssh密钥代理是否按预期工作：

# sss_ssh_authorizedkeys demo_user

---

但同样，在SSSD数据提供程序能够成功与AD后端对话之前，这不会起作用。

请参考下面的问题，我必须找到一种方法来解析resolv.conf文件中的多个域