VIM配置:vim-airline插件安装
705 2023-04-03 01:52:02
将/etc/pam.d/system-auth:
#%PAM-1.0# This file is auto-generated.# User changes will be destroyed the next time authconfig is run.auth required pam_env.soauth sufficient pam_fprintd.soauth sufficient pam_unix.so nullok try_first_passauth requisite pam_succeed_if.so uid >= 500 quietauth sufficient pam_ldap.so use_first_passauth required pam_deny.soaccount required pam_unix.so broken_shadowaccount sufficient pam_localuser.soaccount sufficient pam_succeed_if.so uid < 500 quietaccount [default=bad success=ok user_unknown=ignore] pam_ldap.soaccount required pam_permit.sopassword requisite pam_cracklib.so try_first_pass retry=3 type=password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtokpassword sufficient pam_ldap.so use_authtokpassword required pam_deny.sosession optional pam_keyinit.so revokesession required pam_limits.sosession [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uidsession required pam_unix.sosession optional pam_ldap.so
编辑:在回复评论时,这是/etc/pam.d/login:
#%PAM-1.0auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.soauth include system-authaccount required pam_nologin.soaccount include system-authpassword include system-auth# pam_selinux.so close should be the first session rulesession required pam_selinux.so closesession required pam_loginuid.sosession optional pam_console.so# pam_selinux.so open should only be followed by sessions to be executed in the user contextsession required pam_selinux.so opensession required pam_namespace.sosession optional pam_keyinit.so force revokesession include system-auth-session optional pam_ck_connector.so
让我补充一点,我所知道的授权就是我在过去一小时左右的时间里所能解决的问题 – 我出于绝望而解决了这个问题,因为我们的IT人员没有.所以请相应地说出你的答案.我对Linux有一个合理的熟悉程度.
编辑:响应另一条评论,这是典型登录尝试期间/ var / log / secure中显示的内容(两次都正确输入密码).服务器名称和IP等信息已更改.
Oct 28 07:37:41 myserver sshd[944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=asus-laptop-abc.def.ghi.edu user=mattOct 28 07:37:41 myserver sshd[944]: pam_ldap: ldap_starttls_s: Operations errorOct 28 07:37:43 myserver sshd[944]: Failed password for matt from 123.456.78.90 port 12345 ssh2Oct 28 07:37:47 myserver sshd[944]: pam_sss(sshd:account): Access denied for user matt: 10 (User not known to the underlying authentication module)Oct 28 07:37:47 myserver sshd[944]: Accepted password for matt from 123.456.78.90 port 12345 ssh2Oct 28 07:37:47 myserver sshd[944]: pam_unix(sshd:session): session opened for user matt by (uid=0)
有趣的是,上面的内容与我第一次输入真正不正确的密码时的情况有所不同,在这种情况下,在第一次pam_ldap调用之后会有另外一行:
Oct 28 08:13:13 myserver sshd[1054]: pam_ldap: error trying to bind as user "uid=matt,ou=People,dc=abc,dc=ghi,dc=edu" (Invalid credentials)
因此,系统知道在前一种情况下凭据是正确的,但无论如何都无法登录?!这就是当我调用use sudo时会发生什么,这也会强制双重登录(在这种情况下使用nano来读取/ var / log / secure):
Oct 28 08:13:27 myserver sudo: pam_unix(sudo:auth): authentication failure; logname=matt uid=1000 euid=0 tty=/dev/pts/2 ruser=matt rhost= user=mattOct 28 08:13:32 myserver sudo: matt : TTY=pts/2 ; PWD=/home_dir/home/matt ; USER=root ; COMMAND=/bin/nano /var/log/secure
编辑:当我以root身份登录时,此问题不存在!它在第一次尝试时接受密码,/ var / log / secure看起来像这样,我认为这是正常的:
Oct 29 14:25:58 myserver sshd[7074]: Accepted password for root from 123.456.78.90 port 12345 ssh2Oct 29 14:25:58 myserver sshd[7074]: pam_unix(sshd:session): session opened for user root by (uid=0)我似乎没有足够的代表发表评论,所以这是在黑暗的尝试答案中的一点点.
pam_ldap: ldap_starttls_s: Operations error
我不得不怀疑你的日志的这一部分是否表明了罪魁祸首.我怀疑你的ldap配置是以某种方式错误处理导致连接失败.
请注意每个模块的响应:
pam_ldap: ldap_starttls_s: Operations errorpam_sss(sshd:account): Access denied for user matt: 10 (User not known to the underlying authentication module)pam_unix(sshd:session): session opened for user matt by (uid=0)
所以我们这里有的是ldap说它因错误而失败,sss说它不知道你是谁,而且当地的auth说成功了.
需要考虑的方向:
> ldap服务器日志中是否有任何错误?>如果可能,您可以禁用TLS并查看是否有效?> ldapsearch有效吗?