Kerberos+LDAP+NFSv4 实现单点登录(中)

概述Kerberos+LDAP+NFSv4 实现单点登录(中) 五.nfs服务器的安装 1.安装nfs-kernel-server [email protected]:~# apt-get install nfs-kernel-server nfs-common 修改/etc/default/nfs-kernel-server文件 将 NEED_SVCGSSD="" 改为 NEED_SVCGSSD=" Kerberos+LDAP+NFSv4 实现单点登录(中)

五.nfs服务器的安装
1.安装nfs-kernel-server
[email protected]:~# apt-get install nfs-kernel-server nfs-common

修改/etc/default/nfs-kernel-server文件
将
NEED_SVCGSSD=""
改为
NEED_SVCGSSD="yes"

重启nfs-kernel-server

[email protected]:~# /etc/init.d/nfs-kernel-server stop[email protected]:~# /etc/init.d/nfs-kernel-server start

[email protected]:~# ps -e |grep gss10275 ?        00:00:00 rpc.svcgssd

2.安装libnss-ldapd、nslcd
为了获取ldap用户信息,要安装libnss-ldapd、nslcd
在新立得选上libnss-ldapd、nslcd会自动将libpam-ldapd、nscd、nslcd-utils三个包打上安装标记,可手工将该三个包去掉安装标记,不需此三个包

[email protected]:~# apt-get install libnss-ldapd nslcd

注意安装nslcd配置过程中,提示输入LDAP服务器地址的输入框默认了uri ldAPI:///,一定要将 ldAPI 改为 ldap,因为ldAPI:///表示用在unix域

1)nslcd
安装过程中
ldap server uri 填 ldap://192.168.1.101/
ldap服务器搜索起点 填 dc=ctp,dc=net

查看配置文件

[email protected]:~# cat /etc/nslcd.conf#The user and group nslcd should run as.uID nslcdgID nslcd#The location at which the LDAP server(s) should be reachable.#填LDAP服务器地址,即kdc服务器地址uri ldap://192.168.1.101/#The search base that will be used for all querIEs.base dc=ctp,dc=net[email protected]:~#

2)libnss-ldapd
安装过程中
name services to configure 选 [*] passwd

新建测试目录
[email protected]:~# mkdir /home/linlin/share

将该目录属性改为用户ID及用户组ID都为4001,即为ldap用户krblinlin的uIDNumber/gIDNumber,但并在nfs客/服两主机本地不存在该ID用户
[email protected]:~# chown 4001:4001 /home/linlin/share

2.1)假定没选[*] passwd

[email protected]:~$ ls -ld /home/linlin/sharedrwxr-xr-x 2 4001 4001 4096 9月  18 21:13 /home/linlin/share

则取不到ldap用户信息

2.2)可重设libnss-ldapd,选上[*] passwd
[email protected]:~# dpkg-reconfigure libnss-ldapd

...┌───────────┤  正在设定 libnss-ldapd  ├──────────────────────────┐  │  For this package to work,you need to modify the /etc/nsswitch.conf file to use the ldap datasource. │  │  You can select the services that should have LDAP lookups enabled. The new LDAP lookups will be added││as the last datasource. Be sure to revIEw these changes.                                               │  │  name services to configure:                                                                          │  │    [ ] hosts                                                                                          │  │    [ ] netgroup                                                                                       │  │    [ ] networks                                                                                       │  │    [*] passwd                                                                                         │  │    [ ] protocols                                          ...

/etc/nsswitch.conf: enable LDAP lookups for passwd
[email protected]:~#

查看配置文件,可见passwd一行后添加了ldap

[email protected]:~# cat /etc/nsswitch.confpasswd:         compat ldapgroup:          compatshadow:         compatgshadow:        fileshosts:          files mdns4_minimal [NOTFOUND=return] dnsnetworks:       filesprotocols:      db filesservices:       db filesethers:         db filesrpc:            db filesnetgroup:       nis[email protected]:~#

[email protected]:~$ ls -ld /home/linlin/sharedrwxr-xr-x 2 krblinlin 4001 4096 9月  18 21:13 /home/linlin/share

则已获取显示ldap用户信息,krblinlin为ldap用户,同时也是Kerberos用户
获取用户信息很重要,因为nfs客/服两端的认证用户信息要匹配,即两边的域+用户名要一致

注:本实验只获取ldap用户的用户名,无法获取ldap用户的所属用户组名(如上仍显示用户组ID 4001),但不影响实验效果

3.网络共享
本实验目的NFSv4认证采用安全性强的gss/krb5认证(Kerberos),而不是弱的系统认证(AUTH_SYS)

编辑/etc/exports文件

[email protected]:~# cat /etc/exports/home/linlin/share  gss/krb5(rw,sync,no_subtree_check)[email protected]:~#

执行导出
[email protected]:~# exportfs -r

查看导出

[email protected]:~# exportfs -v/home/linlin/share        gss/krb5(rw,wdelay,root_squash,no_subtree_check,sec=sys,rw,no_all_squash)[email protected]:~#

4.问题解决
nfs服务器没有启动rpc.IDmapd,导致nfs客户机没写权限
1)

[email protected]:~# rpc.IDmapdrpc.IDmapd: libnfsIDmap: using (default) domain: ctp.netrpc.IDmapd: libnfsIDmap: Realms List: ‘CTP.NET‘rpc.IDmapd: libnfsIDmap: loaded plugin /lib/x86_64-linux-gnu/libnfsIDmap/nsswitch.so for method nsswitch[email protected]:~# ps -e|grep rpc  634 ?        00:00:00 rpciod  757 ?        00:00:00 rpcbind 1188 ?        00:00:00 rpc.svcgssd 1261 ?        00:00:00 rpc.mountd[email protected]:~#

手工运行rpc.IDmapd仍没启动rpc.IDmapd

2)
原来nfs服务器的nfs-common要重启

[email protected]:~# /etc/init.d/nfs-common stop[email protected]:~# /etc/init.d/nfs-common start[email protected]:~# ps -e|grep rpc  634 ?        00:00:00 rpciod  757 ?        00:00:00 rpcbind14256 ?        00:00:00 rpc.svcgssd14258 ?        00:00:00 rpc.mountd15023 ?        00:00:00 rpc.statd15041 ?        00:00:00 rpc.IDmapd[email protected]:~#nfs客户机已可写权限了

总结

以上是内存溢出为你收集整理的Kerberos+LDAP+NFSv4 实现单点登录(中)全部内容，希望文章能够帮你解决Kerberos+LDAP+NFSv4 实现单点登录(中)所遇到的程序开发问题。

如果觉得内存溢出网站内容还不错，欢迎将内存溢出网站推荐给程序员好友。