kerberos&ssh 原理、免密登錄搭建

原理

詳細介紹

參考oracle文檔：Kerberos 服務

安裝過程

1.安裝krb5

yum install -y krb5-server
yum install krb5-workstation pam_krb5 -y

用hosts代替dns

[root@localhost ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
10.130.98.196 example.com
10.130.98.196 kerberos.example.com
10.130.98.155 test1.example.com
10.130.98.156 test2.example.com

2.修改krb5配置

vim /etc/krb5.conf

# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
 pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
 default_realm = EXAMPLE.COM
 default_ccache_name = KEYRING:persistent:%{uid}

[realms]
 EXAMPLE.COM = {
  kdc = kerberos.example.com
  admin_server = kerberos.example.com
 }

[domain_realm]
 .example.com = EXAMPLE.COM
 example.com = EXAMPLE.COM

3.修改ssh配置

修改后需systemctl restart sshd

3.1 vim /etc/ssh/ssh_config

GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes

3.2 vim /etc/ssh/sshd_config

KerberosAuthentication yes

GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
GSSAPIStrictAcceptorCheck no
GSSAPIKeyExchange yes

4.創建數據庫

kdb5_util create -r EXAMPLE.COM -s  //建立keberbos鑒權數據庫
kadmin.local -q "addprinc root/[e-mail]" //創建庫管理員

5.啟動krb5

systemctl start kadmin
systemctl start krb5kdc
systemctl enable krb5kdc
systemctl enable kadmin

6.創建用戶

kadmin中

addprinc cjb

用listprincs查看用戶

要進kadmin，kdc上可kadmin.local,通用kadmin -p root/admin

7.創建服務主機

相當於在kdc注冊該服務

kadmin中

addprinc -randkey host/test1.example.com
addprinc -randkey host/test2.example.com

8.服務主機保存密鑰

在，test1上，kadmin

ktadd -k /etc/krb5.keytab host/test1.example.com

本地查看/etc/krb5.keytab

驗證klist -t -e -k /etc/krb5.keytab

可選，此步驟為在本地保存服務key，配置好即可實現免密鑰直接登錄

9.本地用戶獲取憑據

kinit cjb

查看獲取憑據信息klist

刪除憑據kdestroy

10.測試

ssh [e-mail]

已下載keytab則無需輸密碼，反之輸入kdc中cjb的密碼

安裝過程問題匯總

1 kadmin、kinit顯示無法連接

1.1 kdc上kadmin.local可用，kadmin不可用

參照方法2

1.2 檢查域名是否可訪問

可通過配置/etc/hosts解決

1.3 iptables

通過iptables -F關閉（生產環境不建議這么做）

2 ssh無法驗證通過

確保你要登錄的那台機子有當前身份賬號，無需設置密碼（如有設置密碼，驗證過程先是kdc在驗證本地密碼）

3 可以通過域名登錄，但無法使用ip

例 ssh cjb@10.130.98.156

解決方法：在kdc上注冊ip

參考鏈接

https://www.jianshu.com/p/78564a5ef983?tdsourcetag=s_pctim_aiomsg

https://www.cnblogs.com/gongxin12/articles/9851868.html

https://www.cnblogs.com/xiaodf/p/5968178.html

https://www.cnblogs.com/lsdb/p/11309245.html?tdsourcetag=s_pctim_aiomsg