所以我必须kinit
作为本地使用他的 key 表的某些主体。
由于远程服务器上的 Kerberose kdc 是通过 vpn 访问的,因此我需要使用 ssh
访问服务器,从而建立到服务的隧道。
为此,我做了以下事情:
ssh -L1088:localhost:88 -L10749:localhost:749 remote_server
admin_server = localhost:10749
kdc = localhost:1088
但是当我尝试启动时
KRB5_TRACE=/dev/stdout kinit -kt ${PRINCIPAL_KEYTAB}.keytab ${PRINCIPAL_NAME}
[12332] 1504171391.121253: Getting initial credentials for ${PRINCIPAL_NAME}
[12332] 1504171391.123940: Looked up etypes in keytab: des, des-cbc-crc, aes128-cts, rc4-hmac, aes256-cts, des3-cbc-sha1
[12332] 1504171391.124027: Sending request (227 bytes) to ${DOMAIN}
[12332] 1504171391.124613: Resolving hostname localhost
[12332] 1504171391.124988: Sending initial UDP request to dgram ::1:1088
[12332] 1504171391.125070: Sending initial UDP request to dgram 127.0.0.1:1088
[12332] 1504171391.125120: Initiating TCP connection to stream ::1:1088
[12332] 1504171391.125165: Terminating TCP connection to stream ::1:1088
[12332] 1504171391.125186: Initiating TCP connection to stream 127.0.0.1:1088
[12332] 1504171391.125216: Terminating TCP connection to stream 127.0.0.1:1088
kinit: Cannot contact any KDC for realm '${DOMAIN}' while getting initial credentials
ssh -vvv
重试并得到debug1: Connection to port 1088 forwarding to localhost port 88 requested.
debug2: fd 15 setting TCP_NODELAY
debug2: fd 15 setting O_NONBLOCK
debug3: fd 15 is O_NONBLOCK
debug1: channel 7: new [direct-tcpip]
debug3: send packet: type 90
debug1: Connection to port 1088 forwarding to localhost port 88 requested.
debug2: fd 16 setting TCP_NODELAY
debug2: fd 16 setting O_NONBLOCK
debug3: fd 16 is O_NONBLOCK
debug1: channel 8: new [direct-tcpip]
debug3: send packet: type 90
我尝试了 tcpdump,并且在本地尝试连接,但找不到任何收到到其他站点的包。
我编辑了 krb5.conf 中的所有其他信息。
我在这里缺少什么或者这可能吗?
PS:
netstat
说端口在两台机器上都存在并打开。我没有问题
kinit
在服务器本身。附言:
从我看到的 kdc 实际上正在监听端口
udp 88
不是tcp,这可能是个问题吗?
最佳答案
您可以强制 kerberos 仅使用 tcp,而不必同时传输 UDP 流量,如下所示:
[realms]
MY.REALM = {
kdc = tcp/localhost:1088
master_kdc = tcp/localhost:1088
admin_server = tcp/localhost:1749
}
现在像以前一样设置您的 tcp/ssh 隧道:
ssh -L1088:kdc.server:88 -L1749:kdc.server:749 ssh.hop
关于ssh - Kerberos,使用 ssh 隧道获取票证,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/45978328/