1

我一直在尝试使用 kdb5_util 转储（文件名）转储我的 Kerberos 数据库（ldap 后端），但我得到：

kdb5_util load_dump version 6
kdb5_util: error performing Kerberos version 5 release 1.8 dump (Server error)
policy  default    0       0       1       1       1       0       0       0       0

Kerberos KDC 和 Kadmin 日志什么都没有，ldap.log 给出 May 31 12:40:17 kdc slapd[28020]: connection_input: conn=1091 deferring operation: binding

其他一切正常，创建，删除，主体身份验证，没问题。只是转储数据库失败。据我了解，后端不应该对转储产生任何影响。

有什么想法可以调试或解决这个问题吗？我错过了什么？

/etc/krb5.conf

[libdefaults]
        default_realm   = REALM.EXAMPLE.COM
        kdc_timesync    = 1
        ccache_type     = 4
        forwardable     = true
        proxiable       = true

[realms]
        REALM.EXAMPLE.COM = {
                kdc             = kdc.realm.example.com
                admin_server    = kdc.realm.example.com
                kpasswd_server  = kdc.realm.example.com
        }

[domain_realm]
        .realm.example.com  = REALM.EXAMPLE.COM

/etc/krb5kdc/kdc.conf

[realms]
    REALM.EXAMPLE.COM = {
        default_domain  = realm.example.com
        database_module = ldapconf

        acl_file        = /etc/krb5kdc/kadm5.acl
        key_stash_file  = /etc/krb5kdc/.master

       max_life        = 10h 0m 0s
       max_renewable_life = 7d 0h 0m 0s

        master_key_type         = aes256-cts
        supported_enctypes      = aes256-cts-hmac-sha1-96:normal
#aes128-cts-hmac-sha1-96:normal arcfour-hmac:normal
        default_principal_flags = +preauth

        pkinit_identity = FILE:/etc/krb5kdc/kdc-cert.pem,/etc/krb5kdc/.kdc-key.pem
        pkinit_anchors  = FILE:/etc/krb5kdc/ca-cert.pem

        dict_file       = /root/bad_passwords.dict
    }

[dbmodules]
        ldapconf = {
                db_library                 = kldap
                ldap_kerberos_container_dn = "cn=kerberos,dc=realm,dc=example,dc=com"
                ldap_kdc_dn                = "cn=kerberos-kdc,dc=realm,dc=example,dc=com"
                ldap_kadmind_dn            = "cn=kerberos-admin,dc=realm,dc=example,dc=com"
                ldap_servers               = ldapi:///
                ldap_service_password_file = /etc/krb5kdc/.service
    }
[logging]
kdc          = FILE:/var/log/kerberos/kdc.log
admin_server = FILE:/var/log/kerberos/kadmin.log
default      = FILE:/var/log/kerberos/kerberos.log
4

1 回答 1

1

最后调试后发现问题：

LDAP 后端对搜索请求的大小限制为 500。有 501 个用户在背后咬我！

使固定：

#
# remove sizelimit for ldap search
#
# apply with ldapmodify -Y EXTERNAL -H ldapi:/// -f sizelimit.ldif
#
dn: olcDatabase={1}hdb,cn=config
changetype: modify
add: olcLimits
olcLimits:  dn.exact="cn=kerberos-admin,dc=realm,dc=example,dc=com" size=unlimited

申请，重新启动 slapd，然后愉快地转储

于 2017-06-08T12:33:40.883 回答