我们正在尝试配置具有多个域的单个 kerberos 服务器（这是必需的），所以我最终创建了 2 个这样的数据库和每个数据库中的一些主体（一切都很好，我可以登录到两个数据库并查看不同的主体） ：
kdc.conf
[realms]
EXAMPLE1.COM =
{database_module=EXAMPLE1.COM
...}
EXAMPLE2.COM =
{database_module=EXAMPLE2.COM
...}
[dbmodules]
EXAMPLE1.COM=
{database_name=/var/kerberos/krb5kdc/principal
...}
EXAMPLE2.COM =
{database_name=/var/kerberos/krb5kdc/principal2
...}
krb5.conf 看起来像这样：
[realms]
EXAMPLE1.COM=
{ kdc= server.example1.com
admin_server = server.example1.com
default_domain = example1.com
...}
EXAMPLE2.COM =
{kdc= server.example2.com:61321
admin_server = server.example2.com:61321
default_domain = example2.com
...}
[domain_realm]
.example1.com = EXAMPLE1.COM
example1.com = EXAMPLE1.COM
.example2.com = EXAMPLE2.COM
example2.com = EXAMPLE2.COM
现在的问题是，kerberos 似乎不接受具有不同领域的 kdc，例如 example2（但它适用于 example1）：
kinit -V -t /tmp/krb5.example2.keytab user/example2@EXAMPLE2.com
keytab specified, forcing -k
Using default cache: /tmp/krb5cc_0
Using principal: user/example2@EXAMPLE2.com
Using keytab: /tmp/krb5.example2.keytab
kinit: Cannot contact any KDC for realm 'EXAMPLE2.com' while getting initial credentials
在修改建议grawity之后，我用 systemctl edit --full krb5kdc.service 编辑了服务文件并放在最后 -r EXAMPLE1 -r EXAMPLE2 现在它似乎工作得更好但我仍然收到一个我无法理解的错误（不确定如果我应该添加不同的端口或正在发生的事情）：
kinit -V -t /tmp/krb5.example2.keytab user/example2@EXAMPLE2.COM
keytab specified, forcing -k
Using default cache: /tmp/krb5cc_0
Using principal: user/example2@EXAMPLE2.COM
Using keytab: /tmp/krb5.example2.keytab
[355090] 1573732431.376189: Getting initial credentials for user/example2@EXAMPLE2.COM
[355090] 1573732431.376190: Looked up etypes in keytab: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, des-hmac-sha1, des, des-cbc-crc
[355090] 1573732431.376192: Sending unauthenticated request
[355090] 1573732431.376193: Sending request (201 bytes) to CPD4PRE.NEO4J.GENCAT.CAT
[355090] 1573732431.376194: Resolving hostname host.example2.com
[355090] 1573732431.376195: Initiating TCP connection to stream 10.53.48.79:88
[355090] 1573732431.376196: Sending TCP request to stream 10.53.48.79:88
[355090] 1573732431.376197: Received answer (218 bytes) from stream 10.53.48.79:88
[355090] 1573732431.376198: Terminating TCP connection to stream 10.53.48.79:88
[355090] 1573732431.376199: Response was not from master KDC
[355090] 1573732431.376200: Received error from KDC: -1765328370/KDC has no support for encryption type
[355090] 1573732431.376201: Getting initial credentials for user/example2@EXAMPLE2.COM
[355090] 1573732431.376202: Looked up etypes in keytab: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, des-hmac-sha1, des, des-cbc-crc
[355090] 1573732431.376204: Sending unauthenticated request
[355090] 1573732431.376205: Sending request (201 bytes) to EXAMPLE2.COM (master)
kinit: KDC has no support for encryption type while getting initial credentials
实际上我没有读到关于它需要不同端口的东西，所以我修改了它以使用 61321 但它没有在该端口上推任何套接字，它只是推我假设是第一个的默认端口 88（和默认）领域：{kdc= server.example2.com:61321 admin_server = server.example2.com:61321
root@example1.com:/root# netstat -netapl | 听听 | grep krb tcp 0 0 0.0.0.0:88 0.0.0.0:* LISTEN 0 9326395 362136/krb5kdc tcp6 0 0 :::88 :::* LISTEN 0 9326396 362136/krb5kdc root@example1.com:/root# ps -ef | grep -i krb 根 362136 1 0 13:04？00:00:00 /usr/sbin/krb5kdc -P /var/run/krb5kdc.pid -r EXAMPLE1.COM -r EXAMPLE2.COM root 363981 331025 0 13:08 pts/0 00:00:00 grep --color =自动 -i krb