配置 LDAP 身份验证后无法使用 SSH 登录

Question

我有一个连接到我的 LDAP 服务器的 CoreOS 服务器。使用id和ldapsearch命令后，我得到了正确答案。但是，我仍然无法使用 SSH 登录。

我可以在 sssd_LDAP.log 文件中看到服务器已收到以用户 (my_user) 登录的请求，但该请求被拒绝。

tail -f /var/log/sssd/sssd_LDAP.log

(Sun Nov 13 15:06:29 2016) [sssd[be[LDAP]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Success)
(Sun Nov 13 15:06:49 2016) [sssd[be[LDAP]]] [be_get_account_info] (0x0200): Got request for [0x1003][FAST BE_REQ_INITGROUPS][1][name=etcd]
(Sun Nov 13 15:06:49 2016) [sssd[be[LDAP]]] [sysdb_get_real_name] (0x0040): Cannot find user [etcd] in cache
(Sun Nov 13 15:06:49 2016) [sssd[be[LDAP]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Success)
(Sun Nov 13 15:07:10 2016) [sssd[be[LDAP]]] [be_get_account_info] (0x0200): Got request for [0x1003][FAST BE_REQ_INITGROUPS][1][name=etcd]
(Sun Nov 13 15:07:10 2016) [sssd[be[LDAP]]] [sysdb_get_real_name] (0x0040): Cannot find user [etcd] in cache
(Sun Nov 13 15:07:10 2016) [sssd[be[LDAP]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Success)
(Sun Nov 13 15:07:30 2016) [sssd[be[LDAP]]] [be_get_account_info] (0x0200): Got request for [0x1003][FAST BE_REQ_INITGROUPS][1][name=etcd]
(Sun Nov 13 15:07:30 2016) [sssd[be[LDAP]]] [sysdb_get_real_name] (0x0040): Cannot find user [etcd] in cache
(Sun Nov 13 15:07:30 2016) [sssd[be[LDAP]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Success)
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [be_get_account_info] (0x0200): Got request for [0x1003][FAST BE_REQ_INITGROUPS][1][name=etcd]
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [sysdb_get_real_name] (0x0040): Cannot find user [etcd] in cache
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Success)
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [be_get_account_info] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][1][name=my_user]
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [sdap_initgr_nested_send] (0x0100): User entry lacks original memberof ?
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Success)
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [be_pam_handler] (0x0100): Got request with the following data
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): domain: LDAP
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): user: my_user
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): service: sshd
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): tty: ssh
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): ruser: 
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): rhost: x.x.x.x
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): authtok type: 0
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): newauthtok type: 0
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): priv: 1
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): cli_pid: 21280
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): logon name: not set
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 7, <NULL>) [Success (Authentication failure)]
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Sending result [7][LDAP]

有谁知道是什么问题？

---

更新：我已经删除了 /etc 下的配置文件，因为 /usr 下的默认 PAM 配置启用了 sssd。

以下是当前的错误：

Dec 12 09:33:07 localhost sshd[3298]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.x.x.x user=my_user
Dec 12 09:33:07 localhost sshd[3298]: pam_sss(sshd:auth): received for user my_user: 7 (Authentication failure)
Dec 12 09:33:11 localhost sshd[3298]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.x.x.x  user=my_user
Dec 12 09:33:14 localhost sshd[3296]: PAM: Authentication failure for my_user from x.x.x.x

以下是当前配置：

cat system-auth

    auth        required    pam_env.so
    auth        sufficient  pam_sss.so use_first_pass
    auth        sufficient  pam_unix.so try_first_pass likeauth nullok
    auth        required    pam_deny.so

    account     required    pam_unix.so
    # Don't fail if the user is unknown to sssd or if sssd isn't running
    account     required    pam_sss.so ignore_unknown_user ignore_authinfo_unavail
    account     optional    pam_permit.so

    password    sufficient  pam_unix.so try_first_pass  nullok sha512 shadow
    password    sufficient  pam_sss.so use_authtok
    password    required    pam_deny.so

    session     required    pam_limits.so
    session     required    pam_env.so
    session     required    pam_unix.so
    session     optional    pam_permit.so
    session     optional    pam_sss.so
    -session        optional        pam_systemd.so

cat sshd

auth       include  system-remote-login
account    include  system-remote-login
password   include  system-remote-login
session    include  system-remote-login

Answer 1

根据这一行：

(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): authtok type: 0

没有从 PAM 堆栈向 SSSD 传递密码（authtok 类型 0 表示没有密码，1 将是密码），因此没有任何 SSSD 可用于向 LDAP 服务器进行身份验证。

我建议检查 PAM 配置（尽管我自己从未使用过 coreos，所以我不知道那里的 PAM 堆栈是什么样的......）