linux服务器加入AD域（sssd）~ 通过域用户ssh登录加域的linux服务器
<p>搭建域控：参考 https://www.cnblogs.com/taosiyu/p/12009120.html</p><p>域控计算机全名： WIN-3PLKM2PLE6E.zhihu.test.com</p>
<p>域：zhihu.test.com</p>
<p>域控管理员：kingsoft</p>
<p>普通用户：zhangmingda</p>
<p>普通组：dev</p>
<p>IP：192.168.3.3</p>
<p>注： 域控同时做DNS服务器</p>
<p> </p>
<p>Linux服务器：</p>
<div class="cnblogs_code">
<pre># <span style="color: rgba(0, 0, 255, 1)">cat</span> /etc/redhat-<span style="color: rgba(0, 0, 0, 1)">release
CentOS Linux release </span><span style="color: rgba(128, 0, 128, 1)">7.7</span>.<span style="color: rgba(128, 0, 128, 1)">1908</span> (Core)</pre>
</div>
<p>操作步骤：</p>
<p>安装所需包文件：</p>
<div class="cnblogs_code">
<pre><span style="color: rgba(0, 0, 255, 1)">yum</span> <span style="color: rgba(0, 0, 255, 1)">install</span> -y krb5-workstation realmd sssd samba-common adcli oddjob oddjob-mkhomedir samba samba-common-tools</pre>
</div>
<p>编辑/etc/resolve.conf文件，将DNS指向DC</p>
<div class="cnblogs_code">
<pre># <span style="color: rgba(0, 0, 255, 1)">cat</span> /etc/<span style="color: rgba(0, 0, 0, 1)">resolv.conf
; generated by </span>/usr/sbin/dhclient-<span style="color: rgba(0, 0, 0, 1)">script
<span style="color: rgba(255, 0, 0, 1)"><strong>nameserver </strong></span></span><span style="color: rgba(255, 0, 0, 1)"><strong>192.168.3.3</strong></span><span style="color: rgba(0, 0, 0, 1)">
nameserver </span><span style="color: rgba(128, 0, 128, 1)">198.18</span>.<span style="color: rgba(128, 0, 128, 1)">254.31</span><span style="color: rgba(0, 0, 0, 1)">
# </pre>
</div>
<p>编辑/etc/hosts文件，添加DC的IP及域的对应关系</p>
<div class="cnblogs_code">
<pre># <span style="color: rgba(0, 0, 255, 1)">cat</span> /etc/<span style="color: rgba(0, 0, 0, 1)">hosts
</span><span style="color: rgba(128, 0, 128, 1)">127.0</span>.<span style="color: rgba(128, 0, 128, 1)">0.1</span><span style="color: rgba(0, 0, 0, 1)"> localhost localhost.localdomain localhost4 localhost4.localdomain4
::</span><span style="color: rgba(128, 0, 128, 1)">1</span><span style="color: rgba(0, 0, 0, 1)"> localhost localhost.localdomain localhost6 localhost6.localdomain6
</span><span style="color: rgba(128, 0, 128, 1)">192.168</span>.<span style="color: rgba(128, 0, 128, 1)">3.3</span> WIN-<span style="color: rgba(0, 0, 0, 1)">3PLKM2PLE6E.zhihu.test.com
# </pre>
</div>
<p>将Linux机器加入域</p>
<div class="cnblogs_code">
<pre># realm <span style="color: rgba(0, 0, 255, 1)">join</span> WIN-3PLKM2PLE6E.zhihu.test.com -U kingsoft</pre>
<pre>Password for kingsoft: </pre>
</div>
<p>发现可以成功发现域了</p>
<div class="cnblogs_code">
<pre># realm list
zhihu.test.com
type: kerberos
realm</span>-<span style="color: rgba(0, 0, 0, 1)">name: ZHIHU.TEST.COM
domain</span>-<span style="color: rgba(0, 0, 0, 1)">name: zhihu.test.com
configured: kerberos</span>-<span style="color: rgba(0, 0, 0, 1)">member
server</span>-software: active-<span style="color: rgba(0, 0, 0, 1)">directory
client</span>-<span style="color: rgba(0, 0, 0, 1)">software: sssd
required</span>-<span style="color: rgba(0, 0, 0, 1)">package: oddjob
required</span>-package: oddjob-<span style="color: rgba(0, 0, 0, 1)">mkhomedir
required</span>-<span style="color: rgba(0, 0, 0, 1)">package: sssd
required</span>-<span style="color: rgba(0, 0, 0, 1)">package: adcli
required</span>-package: samba-common-<span style="color: rgba(0, 0, 0, 1)">tools
</span><span style="color: rgba(0, 0, 255, 1)">login</span>-formats: %<span style="color: rgba(0, 0, 0, 1)">U
</span><span style="color: rgba(0, 0, 255, 1)">login</span>-policy: allow-realm-<span style="color: rgba(0, 0, 0, 1)">logins
# </pre>
</div>
<p>将组dev加入域</p>
<div class="cnblogs_code">
<pre># realm permit -<span style="color: rgba(0, 0, 0, 1)">g dev@zhihu.test.com
# </pre>
</div>
<p>可以看到用户kingsoft,zhangmingda可以被成功发现</p>
<div class="cnblogs_code">
<pre># <span style="color: rgba(0, 0, 255, 1)">id</span><span style="color: rgba(0, 0, 0, 1)"> zhangmingda@zhihu.test.com
uid</span>=<span style="color: rgba(128, 0, 128, 1)">1724201104</span>(zhangmingda) gid=<span style="color: rgba(128, 0, 128, 1)">1724200513</span>(domain users) <span style="color: rgba(0, 0, 255, 1)">groups</span>=<span style="color: rgba(128, 0, 128, 1)">1724200513</span><span style="color: rgba(0, 0, 0, 1)">(domain users)
# <span style="color: rgba(0, 0, 255, 1)">id</span><span style="color: rgba(0, 0, 0, 1)"> zhudong@zhihu.test.com
uid</span>=<span style="color: rgba(128, 0, 128, 1)">1724201108</span>(zhudong) gid=<span style="color: rgba(128, 0, 128, 1)">1724200513</span>(domain users) <span style="color: rgba(0, 0, 255, 1)">groups</span>=<span style="color: rgba(128, 0, 128, 1)">1724200513</span><span style="color: rgba(0, 0, 0, 1)">(domain users)
# <span style="color: rgba(0, 0, 255, 1)">id</span><span style="color: rgba(0, 0, 0, 1)"> kingsoft@zhihu.test.com
uid</span>=<span style="color: rgba(128, 0, 128, 1)">1724201000</span>(kingsoft) gid=<span style="color: rgba(128, 0, 128, 1)">1724200513</span>(domain users) <span style="color: rgba(0, 0, 255, 1)">groups</span>=<span style="color: rgba(128, 0, 128, 1)">1724200513</span><span style="color: rgba(0, 0, 0, 1)">(domain users)
# <span style="color: rgba(0, 0, 255, 1)">id</span><span style="color: rgba(0, 0, 0, 1)"> administrator@zhihu.test.com
uid</span>=<span style="color: rgba(128, 0, 128, 1)">1724200500</span>(administrator) gid=<span style="color: rgba(128, 0, 128, 1)">1724200513</span>(domain users) <span style="color: rgba(0, 0, 255, 1)">groups</span>=<span style="color: rgba(128, 0, 128, 1)">1724200513</span>(domain users),<span style="color: rgba(128, 0, 128, 1)">1724200520</span>(group policy creator owners),<span style="color: rgba(128, 0, 128, 1)">1724200519</span>(enterprise admins),<span style="color: rgba(128, 0, 128, 1)">1724200512</span>(domain admins),<span style="color: rgba(128, 0, 128, 1)">1724200572</span>(denied rodc password replication group),<span style="color: rgba(128, 0, 128, 1)">1724200518</span><span style="color: rgba(0, 0, 0, 1)">(schema admins)
#</pre>
</div>
<p>为使用户不需用带域名就可以被识别，需要修改配置文件/etc/sssd/sssd.conf，将use_fully_qualified_names行的True值修改为False</p>
<div class="cnblogs_code">
<pre># <span style="color: rgba(0, 0, 255, 1)">cat</span> /etc/sssd/<span style="color: rgba(0, 0, 0, 1)">sssd.conf
domains </span>=<span style="color: rgba(0, 0, 0, 1)"> zhihu.test.com
config_file_version </span>= <span style="color: rgba(128, 0, 128, 1)">2</span><span style="color: rgba(0, 0, 0, 1)">
services </span>=<span style="color: rgba(0, 0, 0, 1)"> nss, pam
ad_server </span>= win-<span style="color: rgba(0, 0, 0, 1)">3plkm2ple6e.zhihu.test.com
ad_domain </span>=<span style="color: rgba(0, 0, 0, 1)"> zhihu.test.com
krb5_realm </span>=<span style="color: rgba(0, 0, 0, 1)"> ZHIHU.TEST.COM
realmd_tags </span>= manages-system joined-with-<span style="color: rgba(0, 0, 0, 1)">adcli
cache_credentials </span>=<span style="color: rgba(0, 0, 0, 1)"> True
id_provider </span>=<span style="color: rgba(0, 0, 0, 1)"> ad
krb5_store_password_if_offline </span>=<span style="color: rgba(0, 0, 0, 1)"> True
default_shell </span>= /bin/<span style="color: rgba(0, 0, 0, 1)">bash
ldap_id_mapping </span>=<span style="color: rgba(0, 0, 0, 1)"> True
use_fully_qualified_names </span>=<span style="color: rgba(0, 0, 0, 1)"><span style="color: rgba(255, 0, 0, 1)"> False</span>
fallback_homedir </span>= /home/%u@%<span style="color: rgba(0, 0, 0, 1)">d
access_provider </span>=<span style="color: rgba(0, 0, 0, 1)"> simple
simple_allow_groups </span>=<span style="color: rgba(0, 0, 0, 1)"> dev@zhihu.test.com, ops@zhihu.test.com
# </pre>
</div>
<p>重启sssd服务，重新列出预控信息</p>
<div class="cnblogs_code">
<pre># systemctl restart sssd
# realm list
# realm list
zhihu.test.com
type: kerberos
realm</span>-<span style="color: rgba(0, 0, 0, 1)">name: ZHIHU.TEST.COM
domain</span>-<span style="color: rgba(0, 0, 0, 1)">name: zhihu.test.com
configured: kerberos</span>-<span style="color: rgba(0, 0, 0, 1)">member
server</span>-software: active-<span style="color: rgba(0, 0, 0, 1)">directory
client</span>-<span style="color: rgba(0, 0, 0, 1)">software: sssd
required</span>-<span style="color: rgba(0, 0, 0, 1)">package: oddjob
required</span>-package: oddjob-<span style="color: rgba(0, 0, 0, 1)">mkhomedir
required</span>-<span style="color: rgba(0, 0, 0, 1)">package: sssd
required</span>-<span style="color: rgba(0, 0, 0, 1)">package: adcli
required</span>-package: samba-common-<span style="color: rgba(0, 0, 0, 1)">tools
</span><span style="color: rgba(0, 0, 255, 1)">login</span>-formats: %<span style="color: rgba(0, 0, 0, 1)">U
</span><span style="color: rgba(0, 0, 255, 1)">login</span>-policy: allow-permitted-<span style="color: rgba(0, 0, 0, 1)">logins
permitted</span>-<span style="color: rgba(0, 0, 0, 1)">logins:
permitted</span>-<span style="color: rgba(0, 0, 255, 1)">groups</span><span style="color: rgba(0, 0, 0, 1)">: dev@zhihu.test.com, ops@zhihu.test.com
#</pre>
</div>
<p>发现不加域信息，Linux服务器也可以识别域用户</p>
<div class="cnblogs_code">
<pre># <span style="color: rgba(0, 0, 255, 1)">id</span><span style="color: rgba(0, 0, 0, 1)"> zhangmingda
uid</span>=<span style="color: rgba(128, 0, 128, 1)">1724201104</span>(zhangmingda) gid=<span style="color: rgba(128, 0, 128, 1)">1724200513</span>(domain users) <span style="color: rgba(0, 0, 255, 1)">groups</span>=<span style="color: rgba(128, 0, 128, 1)">1724200513</span><span style="color: rgba(0, 0, 0, 1)">(domain users)
#</pre>
</div>
<p>使用域用户ssh登录服务器</p>
<div class="cnblogs_code">
<pre># <span style="color: rgba(0, 0, 255, 1)">ssh</span> zhangmingda@<span style="color: rgba(128, 0, 128, 1)">192.168</span>.<span style="color: rgba(128, 0, 128, 1)">8.27</span><span style="color: rgba(0, 0, 0, 1)">
zhangmingda@</span><span style="color: rgba(128, 0, 128, 1)">192.168</span>.<span style="color: rgba(128, 0, 128, 1)">8.27</span><span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">s password: </span>
Last <span style="color: rgba(0, 0, 255, 1)">login</span>: Tue Nov <span style="color: rgba(128, 0, 128, 1)">17</span> <span style="color: rgba(128, 0, 128, 1)">13</span>:<span style="color: rgba(128, 0, 128, 1)">07</span>:<span style="color: rgba(128, 0, 128, 1)">03</span> <span style="color: rgba(128, 0, 128, 1)">2020</span> from <span style="color: rgba(128, 0, 128, 1)">192.168</span>.<span style="color: rgba(128, 0, 128, 1)">8.27</span><span style="color: rgba(0, 0, 0, 1)">
$ <span style="color: rgba(0, 0, 255, 1)">ls</span><span style="color: rgba(0, 0, 0, 1)">
$<span style="color: rgba(0, 0, 255, 1)">sudo</span> <span style="color: rgba(0, 0, 255, 1)">su</span> -<span style="color: rgba(0, 0, 0, 1)"> root
We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:
#</span><span style="color: rgba(128, 0, 128, 1)">1</span><span style="color: rgba(0, 0, 0, 1)">) Respect the privacy of others.
#</span><span style="color: rgba(128, 0, 128, 1)">2</span><span style="color: rgba(0, 0, 0, 1)">) Think before you type.
#</span><span style="color: rgba(128, 0, 128, 1)">3</span><span style="color: rgba(0, 0, 0, 1)">) With great power comes great responsibility.
[</span><span style="color: rgba(0, 0, 255, 1)">sudo</span>] password <span style="color: rgba(0, 0, 255, 1)">for</span><span style="color: rgba(0, 0, 0, 1)"> zhangmingda:
zhangmingda is not </span><span style="color: rgba(0, 0, 255, 1)">in</span> the sudoers <span style="color: rgba(0, 0, 255, 1)">file</span><span style="color: rgba(0, 0, 0, 1)">.This incident will be reported.
$</pre>
</div>
<p>编辑 /etc/sudoers.d/waagent 文件，将需要root权限的用户加入到其下</p>
<div class="cnblogs_code">
<pre>$ <span style="color: rgba(0, 0, 255, 1)">sudo</span> <span style="color: rgba(0, 0, 255, 1)">cat</span> /etc/sudoers.d/<span style="color: rgba(0, 0, 0, 1)">waagent
ltsstone ALL</span>=<span style="color: rgba(0, 0, 0, 1)">(ALL) ALL
zhangmingda ALL</span>=<span style="color: rgba(0, 0, 0, 1)">(ALL) ALL
$</pre>
</div>
<div class="cnblogs_code">
<pre>$ <span style="color: rgba(0, 0, 255, 1)">sudo</span> <span style="color: rgba(0, 0, 255, 1)">su</span> -<span style="color: rgba(0, 0, 0, 1)"> root
Last </span><span style="color: rgba(0, 0, 255, 1)">login</span>: Tue Nov <span style="color: rgba(128, 0, 128, 1)">17</span> <span style="color: rgba(128, 0, 128, 1)">14</span>:<span style="color: rgba(128, 0, 128, 1)">28</span>:<span style="color: rgba(128, 0, 128, 1)">41</span> CST <span style="color: rgba(128, 0, 128, 1)">2020</span> on pts/<span style="color: rgba(128, 0, 128, 1)">1</span><span style="color: rgba(0, 0, 0, 1)">
# </pre>
</div>
<p> </p><br><br>
来源：https://www.cnblogs.com/zhangmingda/p/13994027.html
頁:
[1]