Autentisering via LDAP och Kerberos i CentOS 7

Denna guide är under utveckling.

Installera följande:

root # yum install krb5-workstation pam_krb5 nss-pam-ldapd

Spara undan befintlig settings:

root # authconfig --savebackup=original

Kopiera CA cert till /etc/openldap/cacerts.

root # authconfig --enableldap --ldapserver="ldap://ns1.kerwien.se/" --ldapbasedn="dc=kerwien,dc=se" --enableldapstarttls --enablekrb5 --krb5kdc="ns1.kerwien.se" --krb5adminserver="ns1.kerwien.se" --krb5realm="KERWIEN.SE" --enablecache --update

Om certifikatet adderas till cacerts mappen efter authconfig kommandot måste följande kommandon köras:

root # cacertdir_rehash /etc/openldap/cacerts
root # systemctl restart nslcd

SSSD

Installera följande:

root # yum install krb5-workstation pam_krb5 sssd

Spara undan befintlig settings:

root # authconfig --savebackup=original

root # authconfig --enablekrb5 --krb5kdc="ns.example.com" --krb5adminserver="ns.example.com" --krb5realm="EXAMPLE.COM" --update

Testa att du kan skaffa en Kerberos ticket. Editera /etc/sssd/sssd.conf:

[sssd]
config_file_version = 2
services = nss
domains = LOCAL, example.com

[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
entry_cache_timeout = 300
entry_cache_nowait_percentage = 75

[domain/LOCAL]
id_provider = local
auth_provider = local
access_provider = permit

[domain/kerwien.se]
enumerate = true
auth_provider = krb5
krb5_server = ns.example.com
krb5_realm = EXAMPLE.COM
cache_credentials = true

access_provider = simple
chpass_provider = krb5

id_provider = ldap
ldap_uri = ldap://ns.example.com
ldap_search_base = dc=example,dc=com
ldap_id_use_start_tls = true
ldap_tls_cacert = /etc/openldap/cacerts/example.com-ca.crt

sudo_provider = none

root # chmod 600 /etc/sssd/sssd.conf

Kopiera ditt CA certifikat till filen /etc/openldap/cacerts/example.com-ca.crt, kör sedan kommandot:

root # cacertdir_rehash /etc/openldap/cacerts

Konfigurera SSSD:

root # authconfig --enablesssd --update

Start sssd:

root # systemctl enable sssd
root # systemctl start sssd

Kontrollera med:

root # getent passwd
root # getent group