Kerberos+LDAP+NFSv4 實現(xiàn)單點登錄(中)
金壇網(wǎng)站建設(shè)公司創(chuàng)新互聯(lián)公司,金壇網(wǎng)站設(shè)計制作，有大型網(wǎng)站制作公司豐富經(jīng)驗。已為金壇1000多家提供企業(yè)網(wǎng)站建設(shè)服務(wù)。企業(yè)網(wǎng)站搭建\成都外貿(mào)網(wǎng)站建設(shè)公司要多少錢，請找那個售后服務(wù)好的金壇做網(wǎng)站的公司定做！
五.nfs服務(wù)器的安裝
1.安裝nfs-kernel-serverroot@debian:~# apt-get install nfs-kernel-server nfs-common
修改/etc/default/nfs-kernel-server文件
將
NEED_SVCGSSD=""
改為
NEED_SVCGSSD="yes"
重啟nfs-kernel-server
重慶分公司
重慶分公司
root@debian:~# /etc/init.d/nfs-kernel-server stop
root@debian:~# /etc/init.d/nfs-kernel-server startroot@debian:~# ps -e |grep gss
10275 ? 00:00:00 rpc.svcgssd2.安裝libnss-ldapd、nslcd
為了獲取ldap用戶信息,要安裝libnss-ldapd、nslcd
在新立得選上libnss-ldapd、nslcd會自動將libpam-ldapd、nscd、nslcd-utils三個包打上安裝標(biāo)記,可手工將該三個包去掉安裝標(biāo)記,不需此三個包
root@debian:~# apt-get install libnss-ldapd nslcd
注意安裝nslcd配置過程中,提示輸入LDAP服務(wù)器地址的輸入框默認(rèn)了uri ldapi:/// ,一定要將 ldapi 改為 ldap ,因為ldapi:///表示用在unix域
1)nslcd
安裝過程中
ldap server uri 填 ldap://192.168.1.101/
ldap服務(wù)器搜索起點 填 dc=ctp,dc=net
查看配置文件
root@debian:~# cat /etc/nslcd.conf
#The user and group nslcd should run as.
uid nslcd
gid nslcd
#The location at which the LDAP server(s) should be reachable.
#填LDAP服務(wù)器地址,即kdc服務(wù)器地址
uri ldap://192.168.1.101/
#The search base that will be used for all queries.
base dc=ctp,dc=net
root@debian:~#2)libnss-ldapd
安裝過程中
name services to configure 選 [*] passwd
新建測試目錄root@debian:~# mkdir /home/linlin/share
將該目錄屬性改為用戶ID及用戶組ID都為4001,即為ldap用戶krblinlin的uidNumber/gidNumber,但并在nfs客/服兩主機本地不存在該ID用戶root@debian:~# chown 4001:4001 /home/linlin/share
2.1)假定沒選[*] passwd
linlin@debian:~$ ls -ld /home/linlin/share
drwxr-xr-x 2 4001 4001 4096 9月 18 21:13 /home/linlin/share則取不到ldap用戶信息
2.2)可重設(shè)libnss-ldapd,選上[*] passwdroot@debian:~# dpkg-reconfigure libnss-ldapd
...
┌───────────┤ 正在設(shè)定 libnss-ldapd ├──────────────────────────┐
│ For this package to work, you need to modify the /etc/nsswitch.conf file to use the ldap datasource. │
│ You can select the services that should have LDAP lookups enabled. The new LDAP lookups will be added│
│as the last datasource. Be sure to review these changes. │
│ Name services to configure: │
│ [ ] hosts │
│ [ ] netgroup │
│ [ ] networks │
│ [*] passwd │
│ [ ] protocols
.../etc/nsswitch.conf: enable LDAP lookups for passwdroot@debian:~#
查看配置文件,可見passwd一行后添加了ldap
root@debian:~# cat /etc/nsswitch.conf
passwd: compat ldap
group: compat
shadow: compat
gshadow: files
hosts: files mDNS4_minimal [NOTFOUND=return] dns
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis
root@debian:~#linlin@debian:~$ ls -ld /home/linlin/share
drwxr-xr-x 2 krblinlin 4001 4096 9月 18 21:13 /home/linlin/share則已獲取顯示ldap用戶信息,krblinlin為ldap用戶,同時也是Kerberos用戶
獲取用戶信息很重要,因為nfs客/服兩端的認(rèn)證用戶信息要匹配,即兩邊的域+用戶名要一致
注:本實驗只獲取ldap用戶的用戶名,無法獲取ldap用戶的所屬用戶組名(如上仍顯示用戶組ID 4001),但不影響實驗效果
3.網(wǎng)絡(luò)共享
本實驗?zāi)康腘FSv4認(rèn)證采用安全性強的gss/krb5認(rèn)證(Kerberos),而不是弱的系統(tǒng)認(rèn)證(AUTH_SYS)
編輯/etc/exports文件
root@debian:~# cat /etc/exports
/home/linlin/share gss/krb5(rw,sync,no_subtree_check)
root@debian:~#執(zhí)行導(dǎo)出root@debian:~# exportfs -r
查看導(dǎo)出
root@debian:~# exportfs -v
/home/linlin/share
gss/krb5(rw,wdelay,root_squash,no_subtree_check,sec=sys,rw,root_squash,no_all_squash)
root@debian:~#4.問題解決
nfs服務(wù)器沒有啟動rpc.idmapd,導(dǎo)致nfs客戶機沒寫權(quán)限
1)
root@debian:~# rpc.idmapd
rpc.idmapd: libnfsidmap: using (default) domain: ctp.net
rpc.idmapd: libnfsidmap: Realms list: 'CTP.NET'
rpc.idmapd: libnfsidmap: loaded plugin /lib/x86_64-linux-gnu/libnfsidmap/nsswitch.so for method nsswitch
root@debian:~# ps -e|grep rpc
634 ? 00:00:00 rpciod
757 ? 00:00:00 rpcbind
1188 ? 00:00:00 rpc.svcgssd
1261 ? 00:00:00 rpc.mountd
root@debian:~#手工運行rpc.idmapd仍沒啟動rpc.idmapd
2)
原來nfs服務(wù)器的nfs-common要重啟
root@debian:~# /etc/init.d/nfs-common stop
root@debian:~# /etc/init.d/nfs-common start
root@debian:~# ps -e|grep rpc
634 ? 00:00:00 rpciod
757 ? 00:00:00 rpcbind
14256 ? 00:00:00 rpc.svcgssd
14258 ? 00:00:00 rpc.mountd
15023 ? 00:00:00 rpc.statd
15041 ? 00:00:00 rpc.idmapd
root@debian:~#
nfs客戶機已可寫權(quán)限了
