sssd服务是一个守护进程，该进程可以用来访问多种验证服务器，如LDAP，Kerberos等，并提供授权。SSSD是 介于本地用户和数据存储之间的进程，本地客户端首先连接SSSD，再由SSSD联系外部资源提供者(一台远程服务器)
(1)避免了本地每个客户端程序对认证服务器大量连接，所有本地程序仅联系SSSD，由SSSD连接认证服务器或SSSD缓存，有效的降低了负载。
(2)允许离线授权。SSSD可以缓存远程服务器的用户认证身份，这允许在远程认证服务器宕机是，继续成功授权用户访问必要的资源。
集成sssd
所有节点安装相关服务
yum -y install openldap-clients sssd authconfig nss-pam-ldapd
将OpenLDAP服务器的/etc/openldap/certs目录下的ldap.key和ldap.crt文件拷贝至OpenLDAP所有客户端节点/etc/openldap/cacerts目录下
[root@cdh1 ~]# scp ldap.key cdh2.macro.com:/etc/openldap/cacerts/ [root@cdh1 ~]# scp ldap.crt cdh3.macro.com:/etc/openldap/cacerts/
在所有客户端节点上执行如下命令
[root@cdh2 cacerts]# cacertdir_rehash /etc/openldap/cacerts/
3.所有节点执行如下命令启用sssd服务（在如下参数中--enableldaptls 如果OpenLDAP服务未启用TLS则将此参数修改为--disableldaptls）
[root@cdh2 cacerts]# authconfig --enablesssd --enablesssdauth --enablerfc2307bis --enableldap --enableldapauth --enableldaptls --disableforcelegacy --disablekrb5 --ldapserver ldap://cdh1.macro.com --ldapbasedn "dc=macro,dc=com" --enablemkhomedir --update
4.修改/etc/sssd/sssd.conf文件，在执行authconfig命令时会默认生成，如果文件不存在则新建，文件内容如下:
[root@cdh2 cacerts]# vim /etc/sssd/sssd.conf [root@cdh1 home]# cat /etc/sssd/sssd.conf [domain/default] autofs_provider = ldap ldap_schema = rfc2307bis krb5_realm = MACRO.COM ldap_search_base = dc=macro,dc=com krb5_server = cdh1.macro.com id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldap://cdh1.macro.com ldap_id_use_start_tls = True ldap_tls_reqcert = allow cache_credentials = True ldap_tls_cacertdir = /etc/openldap/cacerts [sssd] services = nss, pam, autofs config_file_version = 2 domains = default [nss] homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp]
修改sssd.conf文件权限
[root@cdh2 sssd]# chmod 600 /etc/sssd/sssd.conf
5.启动sssd服务并加入系统自启动
[root@cdh2 sssd]# systemctl start sssd [root@cdh2 sssd]# systemctl enable sssd [root@cdh2 sssd]# systemctl status sssd
6.至此完成sssd的配置，可以通过id查看用户OpenLDAP的用户
[user_w@cdh1 root]$ more /etc/passwd |grep etl_user [user_w@cdh1 root]$ id etl_user uid=50001(etl_user) gid=50001(etl_user) groups=50001(etl_user)
OpenLDAP与SSH集成
1.修改配置文件/etc/ssh/sshd_config，使ssh通过pam认证账户
#PasswordAuthentication yes #PermitEmptyPasswords no PasswordAuthentication yes # and ChallengeResponseAuthentication to 'no'. # WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several # problems. UsePAM yes
2.修改配置文件/etc/pam.d/sshd，以确认调用pam认证文件
# pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session required pam_namespace.so session optional pam_keyinit.so force revoke session include password-auth session include postlogin session required pam_mkhomedir.so # Used with polkit to reauthorize users in remote sessions -session optional pam_reauthorize.so prepare
3.修改配置文件
[root@cdh2 sssd]# vim /etc/pam.d/password-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth [default=1 success=ok] pam_localuser.so auth [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so forward_pass #auth sufficient pam_ldap.so forward_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so #account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok #password sufficient pam_ldap.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_mkhomedir.so umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so #session optional pam_ldap.so
4.修改/etc/pam.d/system-auth配置文件
[root@cdh1 ~]# cat /etc/pam.d/system-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth [default=1 success=ok] pam_localuser.so auth [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so forward_pass #auth sufficient pam_ldap.so forward_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so #account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok #password sufficient pam_ldap.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_mkhomedir.so umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so #session optional pam_sss.so session optional pam_ldap.so
5.重启sshd服务
systemctl restart sshd
至此就完成了OpenLDAP与SSH的集成。
验证SSH登录
1.确认etl_user用户只存在于OpenLDAP
[root@cdh1 ~]# more /etc/passwd |grep etl_user [root@cdh1 ~]# id etl_user uid=50001(etl_user) gid=50001(etl_user) groups=50001(etl_user)
2.su切换到etl_user用户
[root@cdh1 ~]# su etl_user [etl_user@cdh1 root]$ cd ~ [etl_user@cdh1 ~]$ pwd /home/etl_user [etl_user@cdh1 ~]$ id uid=50001(etl_user) gid=50001(etl_user) groups=50001(etl_user)
3.ssh登录本机
[root@cdh1 ~]# ssh etl_user@localhost etl_user@localhost's password: Last login: Thu Oct 1 22:20:08 2020 [etl_user@cdh1 ~]$ pwd /home/etl_user [etl_user@cdh1 ~]$ id uid=50001(etl_user) gid=50001(etl_user) groups=50001(etl_user)
4.ssh远程登录
[root@cdh1 ~]# ssh etl_user@cdh2.macro.com etl_user@cdh2.macro.com's password: Last login: Thu Oct 1 21:41:19 2020 from 192.168.0.171 [etl_user@cdh2 ~]$ pwd /home/etl_user [etl_user@cdh2 ~]$ id uid=50001(etl_user) gid=50001(etl_user) groups=50001(etl_user)
