SSSD 不返回组中用户的完整列表

Question

我们已经设置了一个有效的 SSSD+Samba+Krb5 捆绑包，用于在 Linux 计算机上授权域用户。授权工作正常，但getent 组示例不会返回组中用户的完整列表。而id命令显示用户所属的特定组

\n

id mshepelev命令示例（pam_nas_admins组存在）：

\n

    ~$ id mshepelev\n    uid=578290105(mshepelev) gid=1145492938(linuxadm) \xd0\xb3\xd1\x80\xd1\x83\xd0\xbf\xd0\xbf\xd1\x8b=128(vboxusers),132(libvirtd),\n6990039486(exchange_terminal),45633573(domain admins),6753567(domain users),4563345(it dept base),1019817232(printer_it),\n5673883(linuxadm),4356383822(buh),25472572456(pam_nas_admins)....\n

\n

getent 组 pam_nas_admins示例（该组中没有 mshepelev）：

\n

    ~$ getent group pam_nas_admins\npam_nas_admins:*:6969932058:nhramchihin,apyataev,\nvshuykov,isaidashev,admin,nrosnovskiy,itugunov,\nmalfereva,mdimitraki,izinoviev,gkulakov,mcherenkov,kfomchenko,mkotov,aromanovskiy\n

\n

\n

更新\n
同样的情况出现在另一台电脑上，但对于用户 isaidashev 来说反之亦然。Id命令返回完整列表，getent 组 pam_nas_admins返回除用户本身之外的所有人（输出有mshepelev用户但没有isaidashev用户）

\n

\n

以下是配置文件：\n /etc/krb5.conf

\n

cat /etc/krb5.conf\n[logging] \n    default = FILE:/var/log/krb5libs.log \n    kdc = FILE:/var/log/krb5kdc.log \n    admin_server = FILE:/var/log/kadmind.log \n[libdefaults]\n    default_realm = example.com\n    kdc_timesync = 1\n    ccache_type = 4\n    forwardable = true\n    proxiable = true\n    v4_instance_resolve = false \n#add\n        dns_lookup_realm = false\n        dns_lookup_kdc = true\n        ticket_lifetime = 24h\n        renew_lifetime = 2d\n    v4_name_convert = {\n        host = {\n            rcmd = host\n            ftp = ftp\n        }\n        plain = {\n            something = something-else\n        }\n    }\n    fcc-mit-ticketflags = true\n\n[realms]\n    example.com = {\n        kdc = dc2012.example.com\n        kdc = echo.example.com\n        kdc = artemis.example.com\n        admin_server = dc2012.example.com\n        default_domain = example.com\n            }\n[domain_realm]\n    .example.com = example.com\n    example.com = example.com\n[login]\n    krb4_convert = false\n    krb4_get_tickets = false\n

\n

/etc/samba/smb.conf

\n

cat /etc/samba/smb.conf\n\n[global]\n        workgroup = example\n        security = ADS\n        ## Full domain name\n        realm = example.com\n\nsecurity = user\nkerberos method = system keytab\n\nlog file = /var/log/samba/log.%m\nlog level = 10\nmax log size = 50\nload printers = no\ncups options = raw\nprintcap name = /dev/null\n\n\n\n    idmap config * : backend = tdb\n    idmap config * : range = 100000-299999\n    idmap config example.com : backend  = rid\n    idmap config example.com : range = 300000-499999\n\n    \n       \n    \n\n    domain master = no\n    local master = no\n    preferred master = no\n    os level = 0\n    domain logons = no\n    \n    #\xd0\x9d\xd0\xb0\xd1\x81\xd1\x82\xd1\x80\xd0\xbe\xd0\xb9\xd0\xba\xd0\xb8 \xd0\xb4\xd0\xbb\xd1\x8f \xd0\xbf\xd1\x80\xd0\xb8\xd0\xbd\xd1\x82\xd0\xb5\xd1\x80\xd0\xbe\xd0\xb2(\xd0\xbe\xd1\x82\xd0\xba\xd0\xbb\xd1\x8e\xd1\x87\xd0\xb5\xd0\xbd\xd0\xb8\xd0\xb5 \xd0\xbf\xd0\xbe\xd0\xb4\xd0\xb4\xd0\xb5\xd1\x80\xd0\xb6\xd0\xba\xd0\xb8)\n    load printers = no\n    show add printer wizard = no\n    printcap name = /dev/null\n    disable spoolss = yes\n

\n

/etc/sssd/sssd.conf

\n

    cat /etc/sssd/sssd.conf\n[sssd]\nservices = nss, pam\nconfig_file_version = 2\ndomains = example.com\ndebug_level = 7\n\n[nss]\n#allowed_shells = /bin/bash, /bin/hgcsh\nshell_fallback = /bin/bash\ndefault_shell = /bin/bash\ndebug_level = 7\nentry_cache_timeout = 2\nenum_cache_timeout = 5\n\n[domain/example.com]\nenumerate = true\ndebug_level = 7\nad_domain = example.com\nkrb5_realm = example.com\nkrb5_store_password_if_offline = True\nrealmd_tags = manages-system joined-with-adcli \ncache_credentials = True\nid_provider = ad\naccess_provider = ad\n#ldap_id_mapping = True\nuse_fully_qualified_names = False\ndefault_shell = /bin/bash\nfallback_homedir = /home/%u\nkrb5_validate = false\n

\n

/etc/nsswitch.conf

\n

cat /etc/nsswitch.conf\n# /etc/nsswitch.conf\n#\n# Example configuration of GNU Name Service Switch functionality.\n# If you have the `glibc-doc-reference' and `info' packages installed, try:\n# `info libc "Name Service Switch"' for information about this file.\n\npasswd:         compat sss\ngroup:          compat sss\nshadow:         compat sss\ngshadow:        files\n\nhosts:          files mdns4_minimal [NOTFOUND=return] dns\nnetworks:       files\n\nprotocols:      db files\nservices:       db files sss\nethers:         db files\nrpc:            db files\n\nnetgroup:       nis sss\nsudoers:        files sss\n

\n

/etc/realmd.conf

\n

cat /etc/realmd.conf\n[active-directory]\nos-name = exampleBuntu\nos-version = 16.04\n\n[service]\nautomatic-install = no\n\n[users]\ndefault-home = /home/%u\ndefault-shell = /bin/bash\n\n[example.com]\nuser-principal = yes\nfully-qualified-names = no\n

\n

下面是日志文件。由于某种原因 sssd_domain.log 告诉端口 389 不可用，但它是开放的

\n

~$ nslookup -type=srv _ldap._tcp.example.com\nServer:     10.20.20.1\nAddress:    10.20.20.1#53\n\n_ldap._tcp.example.com  service = 0 100 389 echo.example.com.\n_ldap._tcp.example.com  service = 0 100 389 artemis.example.com.\n_ldap._tcp.example.com  service = 0 100 389 dc2012.example.com.\n

\n

分别检查端口

\n

~$ nc -zv example.com 389\nConnection to example.com 389 port [tcp/ldap] succeeded!\nmshepelev@example480:~$ nc -zv dc2012 389\nConnection to dc2012 389 port [tcp/ldap] succeeded!\nmshepelev@example480:~$ nc -zv artemis 389\nConnection to artemis 389 port [tcp/ldap] succeeded!\n

\n

/etc/var/log/sssd/sssd_example.com.log

\n

(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [be_resolve_server_process] (0x1000): Saving the first resolved server\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [be_resolve_server_process] (0x0200): Found address for server artemis.example.com: [10.30.0.3] TTL 3600\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [be_primary_server_timeout_activate] (0x0400): The primary server reconnection is already scheduled\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [sdap_kinit_kdc_resolved] (0x1000): KDC resolved, attempting to get TGT...\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [create_tgt_req_send_buffer] (0x0400): buffer size: 31\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [set_tgt_child_timeout] (0x0400): Setting 6 seconds timeout for tgt child\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [write_pipe_handler] (0x0400): All data has been sent!\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [read_pipe_handler] (0x0400): EOF received, client finished\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [sdap_get_tgt_recv] (0x0400): Child responded: 14 [Preauthentication failed], expired on [0]\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [sdap_kinit_done] (0x0100): Could not get TGT: 14 [Bad address]\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [sdap_cli_kinit_done] (0x0400): Cannot get a TGT: ret [1432158218](Authentication Failed)\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'artemis.example.com' as 'not working'\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [ad_user_data_cmp] (0x1000): Comparing LDAP with LDAP\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [ad_user_data_cmp] (0x1000): Comparing LDAP with LDAP\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [ad_user_data_cmp] (0x1000): Comparing LDAP with LDAP\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [fo_set_port_status] (0x0400): Marking port 389 of duplicate server 'artemis.example.com' as 'not working'\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD'\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [get_server_status] (0x1000): Status of server 'dc2012.example.com' is 'name resolved'\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'dc2012.example.com' is 'not working'\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [get_server_status] (0x1000): Status of server 'echo.example.com' is 'name resolved'\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'echo.example.com' is 'not working'\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [get_server_status] (0x1000): Status of server 'artemis.example.com' is 'name resolved'\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'artemis.example.com' is 'not working'\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [fo_resolve_service_send] (0x0020): No available servers for service 'AD'\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [child_sig_handler] (0x1000): Waiting for child [1814].\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [child_sig_handler] (0x0100): child [1814] finished successfully.\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [be_resolve_server_done] (0x1000): Server resolution failed: 5\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error])\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [be_ptask_enable] (0x0400): Task [Check if online (periodic)]: enabling task\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [be_ptask_schedule] (0x0400): Task [Check if online (periodic)]: scheduling task 62 seconds from now [1499163660]\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [be_run_offline_cb] (0x0080): Going offline. Running callbacks.\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [ad_subdomains_get_conn_done] (0x0080): No AD server is available, cannot get the subdomain list while offline\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [sdap_dyndns_get_addrs_done] (0x0080): No LDAP server is available, dynamic DNS update is skipped in offline mode.\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [sdap_dyndns_update_addrs_done] (0x0040): Can't get addresses for DNS update\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [ad_dyndns_sdap_update_done] (0x0040): Dynamic DNS update failed [1432158230]: Dynamic DNS update not possible while offline\n(Tue Jul  4 13:19:58 2017) [sssd[be[example.com]]] [ad_dyndns_nsupdate_done] (0x0040): Updating DNS entry failed [1432158230]: Dynamic DNS update not possible while offline\n(Tue Jul  4 13:19:59 2017) [sssd[be[example.com]]] [remove_krb5_info_files] (0x0200): Could not remove [/var/lib/sss/pubconf/kpasswdinfo.example.com], [2][No such file or directory]\n(Tue Jul  4 13:20:29 2017) [sssd[be[example.com]]] [be_primary_server_timeout] (0x0400): Looking for primary server!\n(Tue Jul  4 13:20:29 2017) [sssd[be[example.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD'\n(Tue Jul  4 13:20:29 2017) [sssd[be[example.com]]] [get_server_status] (0x1000): Status of server 'dc2012.example.com' is 'name resolved'\n(Tue Jul  4 13:20:29 2017) [sssd[be[example.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'dc2012.example.com' is 'not working'\n(Tue Jul  4 13:20:29 2017) [sssd[be[example.com]]] [get_port_status] (0x0100): Reseting the status of port 389 for server 'dc2012.example.com'\n(Tue Jul  4 13:20:29 2017) [sssd[be[example.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved\n(Tue Jul  4 13:20:29 2017) [sssd[be[example.com]]] [get_server_status] (0x1000): Status of server 'dc2012.example.com' is 'name resolved'\n(Tue Jul  4 13:20:29 2017) [sssd[be[example.com]]] [be_resolve_server_process] (0x1000): Saving the first resolved server\n(Tue Jul  4 13:20:29 2017) [sssd[be[example.com]]] [be_resolve_server_process] (0x0200): Found address for server dc2012.example.com: [10.20.20.1] TTL 3600\n(Tue Jul  4 13:20:29 2017) [sssd[be[example.com]]] [ad_resolve_callback] (0x0100): Constructed uri 'ldap://dc2012.example.com'\n(Tue Jul  4 13:20:29 2017) [sssd[be[example.com]]] [ad_resolve_callback] (0x0100): Constructed GC uri 'ldap://dc2012.example.com'\n(Tue Jul  4 13:20:29 2017) [sssd[be[example.com]]] [be_run_reconnect_cb] (0x0400): Reconnecting. Running callbacks.\n

\n

/var/log/sssd/krb5_child.log

\n

(Tue Jul  4 11:46:47 2017) [[sssd[krb5_child[29641]]]] [main] (0x0400): krb5_child started.\n(Tue Jul  4 11:46:47 2017) [[sssd[krb5_child[29641]]]] [unpack_buffer] (0x1000): total buffer size: [126]\n(Tue Jul  4 11:46:47 2017) [[sssd[krb5_child[29641]]]] [unpack_buffer] (0x0100): cmd [241] uid [1019815042] gid [1019817477] validate [false] enterprise principal [true] offline [false] UPN [mshepelev@example.com]\n(Tue Jul  4 11:46:47 2017) [[sssd[krb5_child[29641]]]] [unpack_buffer] (0x0100): ccname: [FILE:/tmp/krb5cc_1019815042_n1SyC3] keytab: [/etc/krb5.keytab]\n(Tue Jul  4 11:46:47 2017) [[sssd[krb5_child[29641]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment.\n(Tue Jul  4 11:46:47 2017) [[sssd[krb5_child[29641]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment.\n(Tue Jul  4 11:46:47 2017) [[sssd[krb5_child[29641]]]] [set_canonicalize_option] (0x0100): SSSD_KRB5_CANONICALIZE is set to [true]\n(Tue Jul  4 11:46:47 2017) [[sssd[krb5_child[29641]]]] [k5c_setup] (0x0100): Not using FAST.\n(Tue Jul  4 11:46:47 2017) [[sssd[krb5_child[29641]]]] [main] (0x0400): Will perform online auth\n(Tue Jul  4 11:46:47 2017) [[sssd[krb5_child[29641]]]] [tgt_req_child] (0x1000): Attempting to get a TGT\n(Tue Jul  4 11:46:47 2017) [[sssd[krb5_child[29641]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [example.com]\n(Tue Jul  4 11:46:47 2017) [[sssd[krb5_child[29641]]]] [get_and_save_tgt] (0x0100): TGT validation is disabled.\n(Tue Jul  4 11:46:47 2017) [[sssd[krb5_child[29641]]]] [k5c_send_data] (0x0200): Received error code 0\n(Tue Jul  4 11:46:47 2017) [[sssd[krb5_child[29641]]]] [main] (0x0400): krb5_child completed successfully\n

\n

/var/log/sssd/ldap_child.log

\n

(Tue Jul  4 13:22:26 2017) [[sssd[ldap_child[1956]]]] [main] (0x0020): ldap_child_get_tgt_sync failed.\n(Tue Jul  4 13:22:26 2017) [[sssd[ldap_child[1956]]]] [prepare_response] (0x0400): Building response for result [-1765328360]\n(Tue Jul  4 13:22:26 2017) [[sssd[ldap_child[1956]]]] [pack_buffer] (0x1000): result [14] krberr [-1765328360] msgsize [24] msg [Preauthentication failed]\n(Tue Jul  4 13:22:26 2017) [[sssd[ldap_child[1956]]]] [main] (0x0400): ldap_child completed successfully\n(Tue Jul  4 13:22:26 2017) [[sssd[ldap_child[1958]]]] [main] (0x0400): ldap_child started.\n(Tue Jul  4 13:22:26 2017) [[sssd[ldap_child[1958]]]] [unpack_buffer] (0x1000): total buffer size: 31\n(Tue Jul  4 13:22:26 2017) [[sssd[ldap_child[1958]]]] [unpack_buffer] (0x1000): realm_str size: 8\n(Tue Jul  4 13:22:26 2017) [[sssd[ldap_child[1958]]]] [unpack_buffer] (0x1000): got realm_str: example.com\n(Tue Jul  4 13:22:26 2017) [[sssd[ldap_child[1958]]]] [unpack_buffer] (0x1000): princ_str size: 7\n(Tue Jul  4 13:22:26 2017) [[sssd[ldap_child[1958]]]] [unpack_buffer] (0x1000): got princ_str: example480$\n(Tue Jul  4 13:22:26 2017) [[sssd[ldap_child[1958]]]] [unpack_buffer] (0x1000): keytab_name size: 0\n(Tue Jul  4 13:22:26 2017) [[sssd[ldap_child[1958]]]] [unpack_buffer] (0x1000): lifetime: 86400\n(Tue Jul  4 13:22:26 2017) [[sssd[ldap_child[1958]]]] [ldap_child_get_tgt_sync] (0x0100): Principal name is: [example480$@example.com]\n(Tue Jul  4 13:22:26 2017) [[sssd[ldap_child[1958]]]] [ldap_child_get_tgt_sync] (0x0100): Using keytab [default]\n(Tue Jul  4 13:22:26 2017) [[sssd[ldap_child[1958]]]] [ldap_child_get_tgt_sync] (0x0010): Failed to init credentials: Preauthentication failed\n(Tue Jul  4 13:22:26 2017) [[sssd[ldap_child[1958]]]] [main] (0x0020): ldap_child_get_tgt_sync failed.\n(Tue Jul  4 13:22:26 2017) [[sssd[ldap_child[1958]]]] [prepare_response] (0x0400): Building response for result [-1765328360]\n(Tue Jul  4 13:22:26 2017) [[sssd[ldap_child[1958]]]] [pack_buffer] (0x1000): result [14] krberr [-1765328360] msgsize [24] msg [Preauthentication failed]\n(Tue Jul  4 13:22:26 2017) [[sssd[ldap_child[1958]]]] [main] (0x0400): ldap_child completed successfully\n

\n

/var/log/sssd/sssd_nss.log

\n

(Tue Jul  4 13:22:31 2017) [sssd[nss]] [client_recv] (0x0200): Client disconnected!\n(Tue Jul  4 13:22:31 2017) [sssd[nss]] [accept_fd_handler] (0x0400): Client connected!\n(Tue Jul  4 13:22:31 2017) [sssd[nss]] [sss_cmd_get_version] (0x0200): Received client version [1].\n(Tue Jul  4 13:22:31 2017) [sssd[nss]] [sss_cmd_get_version] (0x0200): Offered version [1].\n(Tue Jul  4 13:22:31 2017) [sssd[nss]] [nss_cmd_endpwent] (0x0100): Terminating request info for all accounts\n(Tue Jul  4 13:22:31 2017) [sssd[nss]] [nss_cmd_endgrent] (0x0100): Terminating request info for all groups\n(Tue Jul  4 13:22:31 2017) [sssd[nss]] [nss_cmd_endpwent] (0x0100): Terminating request info for all accounts\n(Tue Jul  4 13:22:31 2017) [sssd[nss]] [nss_cmd_endgrent] (0x0100): Terminating request info for all groups\n(Tue Jul  4 13:22:31 2017) [sssd[nss]] [client_recv] (0x0200): Client disconnected!\n(Tue Jul  4 13:23:09 2017) [sssd[nss]] [accept_fd_handler] (0x0400): Client connected!\n(Tue Jul  4 13:23:09 2017) [sssd[nss]] [sss_cmd_get_version] (0x0200): Received client version [1].\n(Tue Jul  4 13:23:09 2017) [sssd[nss]] [sss_cmd_get_version] (0x0200): Offered version [1].\n(Tue Jul  4 13:23:09 2017) [sssd[nss]] [nss_cmd_endpwent] (0x0100): Terminating request info for all accounts\n(Tue Jul  4 13:23:09 2017) [sssd[nss]] [nss_cmd_endgrent] (0x0100): Terminating request info for all groups\n(Tue Jul  4 13:23:09 2017) [sssd[nss]] [client_recv] (0x0200): Client disconnected!\n(Tue Jul  4 13:23:09 2017) [sssd[nss]] [accept_fd_handler] (0x0400): Client connected!\n(Tue Jul  4 13:23:09 2017) [sssd[nss]] [sss_cmd_get_version] (0x0200): Received client version [1].\n(Tue Jul  4 13:23:09 2017) [sssd[nss]] [sss_cmd_get_version] (0x0200): Offered version [1].\n(Tue Jul  4 13:23:09 2017) [sssd[nss]] [nss_cmd_endpwent] (0x0100): Terminating request info for all accounts\n(Tue Jul  4 13:23:09 2017) [sssd[nss]] [nss_cmd_endgrent] (0x0100): Terminating request info for all groups\n(Tue Jul  4 13:23:09 2017) [sssd[nss]] [nss_cmd_endpwent] (0x0100): Terminating request info for all accounts\n(Tue Jul  4 13:23:09 2017) [sssd[nss]] [nss_cmd_endgrent] (0x0100): Terminating request info for all groups\n(Tue Jul  4 13:23:09 2017) [sssd[nss]] [client_recv] (0x0200): Client disconnected!\n

\n