***RHEL7***课程第5次：2020-02-21星期五

botang

***RHEL7***
1. 对INSTRUCTOR（老旧的技术）初始化  

1.1 时间服务器
        

1. [root@instructor etc]# service ntpd restart
   
2. Shutting down ntpd: [  OK  ]
   
3. Starting ntpd: [  OK  ]
   
4. [root@instructor etc]# ntpq
   
5. ntpq> peer
   
6.      remote           refid      st t when poll reach   delay   offset  jitter
   
7. ==============================================================================
   
8. LOCAL(0)        .LOCL.          10 l    5   64    1    0.000    0.000   0.000
   
9. ntpq> peer
   
10.      remote           refid      st t when poll reach   delay   offset  jitter
    
11. ==============================================================================
    
12. LOCAL(0)        .LOCL.          10 l   14   64    3    0.000    0.000   0.000
    
13. ntpq> peer
    
14.      remote           refid      st t when poll reach   delay   offset  jitter
    
15. ==============================================================================
    
16. LOCAL(0)        .LOCL.          10 l   50   64    3    0.000    0.000   0.000
    
17. ntpq> peer
    
18.      remote           refid      st t when poll reach   delay   offset  jitter
    
19. ==============================================================================
    
20. *LOCAL(0)        .LOCL.          10 l   59   64   17    0.000    0.000   0.000
    
21. ntpq>

复制代码

考试开机必做步骤：DESKTOP/SERVER

1. [root@desktop3 ~]# ntpdate -b 192.168.0.254
   
2. 21 Feb 20:40:10 ntpdate[66154]: step time server 192.168.0.254 offset -28788.322828 sec

复制代码

2. CA (tls CA)  + LDAP + KERBEROS

1. [root@instructor bin]# ./gls-setup-tls-ca
   
2. Generating a 1024 bit RSA private key
   
3. .........++++++
   
4. ...............++++++
   
5. writing new private key to 'private/example-ca.key'
   
6. -----
   
7. [root@instructor bin]# pwd
   
8. /root/bin
   
9. [root@instructor bin]#

复制代码

1. [root@instructor bin]# ./gls-setup-ldap  --reverse
   
2. [root@instructor bin]# ./gls-setup-ldap
   
3. Generating a 1024 bit RSA private key
   
4. ........++++++
   
5. .........++++++
   
6. writing new private key to 'slapd.key'
   
7. -----
   
8. Using configuration from /etc/pki/tls/openssl.cnf
   
9. Check that the request matches the signature
   
10. Signature ok
    
11. Certificate Details:
    
12.         Serial Number: 1 (0x1)
    
13.         Validity
    
14.             Not Before: Feb 21 12:59:00 2020 GMT
    
15.             Not After : Feb 20 12:59:00 2021 GMT
    
16.         Subject:
    
17.             countryName               = US
    
18.             stateOrProvinceName       = North Carolina
    
19.             organizationName          = Example, Inc.
    
20.             commonName                = instructor.example.com
    
21.         X509v3 extensions:
    
22.             X509v3 Basic Constraints:
    
23.                 CA:FALSE
    
24.             Netscape Comment:
    
25.                 OpenSSL Generated Certificate
    
26.             X509v3 Subject Key Identifier:
    
27.                 A6:08:BB:79:71:95:D9:CE:98:AA:81:65:9B:9A:FD:DF:30:2A:8D:DA
    
28.             X509v3 Authority Key Identifier:
    
29.                 keyid:83:5C:FB:11:1C:5D:5A:AB:44:9F:25:5C:80:F6:4E:03:6C:AF:23:41
    
30.                 DirName:/C=US/ST=North Carolina/L=Raleigh/O=Example, Inc./CN=example.com Certificate Authority
    
31.                 serial:A2:E8:65:EB:BA:30:06:D5
    
32. 
    
33. Certificate is to be certified until Feb 20 12:59:00 2021 GMT (365 days)
    
34. 
    
35. Write out database with 1 new entries
    
36. Data Base Updated
    
37. bdb_monitor_db_open: monitoring disabled; configure monitor database to enable
    
38. _#################### 100.00% eta   none elapsed            none fast!         
    
39. Closing DB...
    
40. bdb_monitor_db_open: monitoring disabled; configure monitor database to enable
    
41. _#################### 100.00% eta   none elapsed            none fast!         
    
42. Closing DB...
    
43. bdb_monitor_db_open: monitoring disabled; configure monitor database to enable
    
44. _#################### 100.00% eta   none elapsed            none fast!         
    
45. Closing DB...
    
46. [root@instructor bin]#

复制代码

为什么叫EXAMPLE.COM:
/etc/krb5.conf

1. [logging]
   
2. default = FILE:/var/log/krb5libs.log
   
3. kdc = FILE:/var/log/krb5kdc.log
   
4. admin_server = FILE:/var/log/kadmind.log
   
5. 
   
6. [libdefaults]
   
7. default_realm = EXAMPLE.COM
   
8. dns_lookup_realm = false
   
9. dns_lookup_kdc = false
   
10. ticket_lifetime = 24h
    
11. renew_lifetime = 7d
    
12. forwardable = true
    
13. 
    
14. [realms]
    
15. EXAMPLE.COM = {
    
16.   kdc = kerberos.example.com
    
17.   admin_server = kerberos.example.com
    
18. }
    
19. 
    
20. [domain_realm]
    
21. .example.com = EXAMPLE.COM
    
22. example.com = EXAMPLE.COM

复制代码

1. [root@instructor bin]# ./gls-setup-krb5 --reverse
   
2. Stopping Kerberos 5 KDC: [  OK  ]
   
3. ** Database '/var/kerberos/krb5kdc/principal' destroyed.
   
4. [root@instructor bin]# ./gls-setup-krb5
   
5. Loading random data
   
6. Initializing database '/var/kerberos/krb5kdc/principal' for realm 'EXAMPLE.COM',
   
7. master key name 'K/M@EXAMPLE.COM'
   
8. Authenticating as principal root/admin@EXAMPLE.COM with password.
   
9. kadmin.local:  add_principal -pw kerberos ldapuser1
   
10. WARNING: no policy specified for ldapuser1@EXAMPLE.COM; defaulting to no policy
    
11. Principal "ldapuser1@EXAMPLE.COM" created.
    
12. kadmin.local:  Authenticating as principal root/admin@EXAMPLE.COM with password.
    
13. kadmin.local:  add_principal -pw kerberos ldapuser2
    
14. WARNING: no policy specified for ldapuser2@EXAMPLE.COM; defaulting to no policy
    
15. Principal "ldapuser2@EXAMPLE.COM" created.
    
16. kadmin.local:  Authenticating as principal root/admin@EXAMPLE.COM with password.
    
17. kadmin.local:  add_principal -pw kerberos ldapuser3
    
18. WARNING: no policy specified for ldapuser3@EXAMPLE.COM; defaulting to no policy
    
19. Principal "ldapuser3@EXAMPLE.COM" created.
    
20. kadmin.local:  Authenticating as principal root/admin@EXAMPLE.COM with password.
    
21. kadmin.local:  add_principal -pw kerberos ldapuser4
    
22. WARNING: no policy specified for ldapuser4@EXAMPLE.COM; defaulting to no policy
    
23. Principal "ldapuser4@EXAMPLE.COM" created.
    
24. kadmin.local:  Authenticating as principal root/admin@EXAMPLE.COM with password.
    
25. kadmin.local:  add_principal -pw kerberos ldapuser5
    
26. WARNING: no policy specified for ldapuser5@EXAMPLE.COM; defaulting to no policy
    
27. Principal "ldapuser5@EXAMPLE.COM" created.
    
28. kadmin.local:  Authenticating as principal root/admin@EXAMPLE.COM with password.
    
29. kadmin.local:  add_principal -pw kerberos ldapuser6
    
30. WARNING: no policy specified for ldapuser6@EXAMPLE.COM; defaulting to no policy
    
31. Principal "ldapuser6@EXAMPLE.COM" created.
    
32. kadmin.local:  Authenticating as principal root/admin@EXAMPLE.COM with password.
    
33. kadmin.local:  add_principal -pw kerberos ldapuser7
    
34. WARNING: no policy specified for ldapuser7@EXAMPLE.COM; defaulting to no policy
    
35. Principal "ldapuser7@EXAMPLE.COM" created.
    
36. kadmin.local:  Authenticating as principal root/admin@EXAMPLE.COM with password.
    
37. kadmin.local:  add_principal -pw kerberos ldapuser8
    
38. WARNING: no policy specified for ldapuser8@EXAMPLE.COM; defaulting to no policy
    
39. Principal "ldapuser8@EXAMPLE.COM" created.
    
40. kadmin.local:  Authenticating as principal root/admin@EXAMPLE.COM with password.
    
41. kadmin.local:  add_principal -pw kerberos ldapuser9
    
42. WARNING: no policy specified for ldapuser9@EXAMPLE.COM; defaulting to no policy
    
43. Principal "ldapuser9@EXAMPLE.COM" created.
    
44. kadmin.local:  Authenticating as principal root/admin@EXAMPLE.COM with password.
    
45. kadmin.local:  add_principal -pw kerberos ldapuser10
    
46. WARNING: no policy specified for ldapuser10@EXAMPLE.COM; defaulting to no policy
    
47. Principal "ldapuser10@EXAMPLE.COM" created.
    
48. kadmin.local:  Authenticating as principal root/admin@EXAMPLE.COM with password.
    
49. kadmin.local:  add_principal -pw kerberos ldapuser11
    
50. WARNING: no policy specified for ldapuser11@EXAMPLE.COM; defaulting to no policy
    
51. Principal "ldapuser11@EXAMPLE.COM" created.
    
52. kadmin.local:  Authenticating as principal root/admin@EXAMPLE.COM with password.
    
53. kadmin.local:  add_principal -pw kerberos ldapuser12
    
54. WARNING: no policy specified for ldapuser12@EXAMPLE.COM; defaulting to no policy
    
55. Principal "ldapuser12@EXAMPLE.COM" created.
    
56. kadmin.local:  Authenticating as principal root/admin@EXAMPLE.COM with password.
    
57. kadmin.local:  add_principal -pw kerberos ldapuser13
    
58. WARNING: no policy specified for ldapuser13@EXAMPLE.COM; defaulting to no policy
    
59. Principal "ldapuser13@EXAMPLE.COM" created.
    
60. kadmin.local:  Authenticating as principal root/admin@EXAMPLE.COM with password.
    
61. kadmin.local:  add_principal -pw kerberos ldapuser14
    
62. WARNING: no policy specified for ldapuser14@EXAMPLE.COM; defaulting to no policy
    
63. Principal "ldapuser14@EXAMPLE.COM" created.
    
64. kadmin.local:  Authenticating as principal root/admin@EXAMPLE.COM with password.
    
65. kadmin.local:  add_principal -pw kerberos ldapuser15
    
66. WARNING: no policy specified for ldapuser15@EXAMPLE.COM; defaulting to no policy
    
67. Principal "ldapuser15@EXAMPLE.COM" created.
    
68. kadmin.local:  Authenticating as principal root/admin@EXAMPLE.COM with password.
    
69. kadmin.local:  add_principal -pw kerberos ldapuser16
    
70. WARNING: no policy specified for ldapuser16@EXAMPLE.COM; defaulting to no policy
    
71. Principal "ldapuser16@EXAMPLE.COM" created.
    
72. kadmin.local:  Authenticating as principal root/admin@EXAMPLE.COM with password.
    
73. kadmin.local:  add_principal -pw kerberos ldapuser17
    
74. WARNING: no policy specified for ldapuser17@EXAMPLE.COM; defaulting to no policy
    
75. Principal "ldapuser17@EXAMPLE.COM" created.
    
76. kadmin.local:  Authenticating as principal root/admin@EXAMPLE.COM with password.
    
77. kadmin.local:  add_principal -pw kerberos ldapuser18
    
78. WARNING: no policy specified for ldapuser18@EXAMPLE.COM; defaulting to no policy
    
79. Principal "ldapuser18@EXAMPLE.COM" created.
    
80. kadmin.local:  Authenticating as principal root/admin@EXAMPLE.COM with password.
    
81. kadmin.local:  add_principal -pw kerberos ldapuser19
    
82. WARNING: no policy specified for ldapuser19@EXAMPLE.COM; defaulting to no policy
    
83. Principal "ldapuser19@EXAMPLE.COM" created.
    
84. kadmin.local:  Authenticating as principal root/admin@EXAMPLE.COM with password.
    
85. kadmin.local:  add_principal -pw kerberos ldapuser20
    
86. WARNING: no policy specified for ldapuser20@EXAMPLE.COM; defaulting to no policy
    
87. Principal "ldapuser20@EXAMPLE.COM" created.

复制代码

很重要：

1. [root@instructor etc]# service kadmin status
   
2. kadmind is stopped
   
3. [root@instructor etc]# service kadmin start
   
4. Starting Kerberos 5 Admin Server: [  OK  ]
   
5. [root@instructor etc]# chkconfig  kadmin on
   
6. [root@instructor etc]# service krb5kdc status
   
7. krb5kdc is stopped
   
8. [root@instructor etc]# service krb5kdc start
   
9. Starting Kerberos 5 KDC: [  OK  ]
   
10. [root@instructor etc]# chkconfig krb5kdc on
    
11. [root@instructor etc]#

复制代码

1. [root@instructor certs]# pwd
   
2. /etc/pki/tls/certs
   
3. [root@instructor certs]# ls -l server*
   
4. -rw-------. 1 root root 3503 Apr 20  2019 server10.crt
   
5. -rw-------. 1 root root 4416 Apr 20  2019 server10.pem
   
6. -rw-------. 1 root root 3503 Apr 20  2019 server11.crt
   
7. -rw-------. 1 root root 4420 Apr 20  2019 server11.pem
   
8. -rw-------. 1 root root 3503 Apr 20  2019 server12.crt
   
9. -rw-------. 1 root root 4420 Apr 20  2019 server12.pem
   
10. -rw-------. 1 root root 3503 Apr 20  2019 server13.crt
    
11. -rw-------. 1 root root 4420 Apr 20  2019 server13.pem
    
12. -rw-------. 1 root root 3503 Apr 20  2019 server14.crt
    
13. -rw-------. 1 root root 4420 Apr 20  2019 server14.pem
    
14. -rw-------. 1 root root 3504 Apr 20  2019 server15.crt
    
15. -rw-------. 1 root root 4421 Apr 20  2019 server15.pem
    
16. -rw-------. 1 root root 3504 Apr 20  2019 server16.crt
    
17. -rw-------. 1 root root 4421 Apr 20  2019 server16.pem
    
18. -rw-------. 1 root root 3504 Apr 20  2019 server17.crt
    
19. -rw-------. 1 root root 4421 Apr 20  2019 server17.pem
    
20. -rw-------. 1 root root 3504 Apr 20  2019 server18.crt
    
21. -rw-------. 1 root root 4421 Apr 20  2019 server18.pem
    
22. -rw-------. 1 root root 3504 Apr 20  2019 server19.crt
    
23. -rw-------. 1 root root 4421 Apr 20  2019 server19.pem
    
24. -rw-------. 1 root root 3501 Apr 20  2019 server1.crt
    
25. -rw-------. 1 root root 4418 Apr 20  2019 server1.pem
    
26. -rw-------. 1 root root 3504 Apr 20  2019 server20.crt
    
27. -rw-------. 1 root root 4417 Apr 20  2019 server20.pem
    
28. -rw-------. 1 root root 3501 Apr 20  2019 server2.crt
    
29. -rw-------. 1 root root 4414 Apr 20  2019 server2.pem
    
30. -rw-------. 1 root root 3501 Apr 20  2019 server3.crt
    
31. -rw-------. 1 root root 4418 Apr 20  2019 server3.pem
    
32. -rw-------. 1 root root 3501 Apr 20  2019 server4.crt
    
33. -rw-------. 1 root root 4418 Apr 20  2019 server4.pem
    
34. -rw-------. 1 root root 3501 Apr 20  2019 server5.crt
    
35. -rw-------. 1 root root 4422 Apr 20  2019 server5.pem
    
36. -rw-------. 1 root root 3501 Apr 20  2019 server6.crt
    
37. -rw-------. 1 root root 4418 Apr 20  2019 server6.pem
    
38. -rw-------. 1 root root 3501 Apr 20  2019 server7.crt
    
39. -rw-------. 1 root root 4414 Apr 20  2019 server7.pem
    
40. -rw-------. 1 root root 3501 Apr 20  2019 server8.crt
    
41. -rw-------. 1 root root 4418 Apr 20  2019 server8.pem
    
42. -rw-------. 1 root root 3502 Apr 20  2019 server9.crt
    
43. -rw-------. 1 root root 4419 Apr 20  2019 server9.pem
    
44. [root@instructor certs]# rm -f  server*
    
45. [root@instructor certs]# cd ..
    
46. [root@instructor tls]# ls
    
47. cert.pem  certs  misc  openssl.cnf  openssl.cnf-gls  openssl.cnf-glsorig  private
    
48. [root@instructor tls]# cd private/
    
49. [root@instructor private]# ls
    
50. localhost.key  server13.key  server17.key  server20.key  server5.key  server9.key
    
51. server10.key   server14.key  server18.key  server2.key   server6.key
    
52. server11.key   server15.key  server19.key  server3.key   server7.key
    
53. server12.key   server16.key  server1.key   server4.key   server8.key
    
54. [root@instructor private]# ls -l server*
    
55. -rw-------. 1 root root 912 Apr 20  2019 server10.key
    
56. -rw-------. 1 root root 916 Apr 20  2019 server11.key
    
57. -rw-------. 1 root root 916 Apr 20  2019 server12.key
    
58. -rw-------. 1 root root 916 Apr 20  2019 server13.key
    
59. -rw-------. 1 root root 916 Apr 20  2019 server14.key
    
60. -rw-------. 1 root root 916 Apr 20  2019 server15.key
    
61. -rw-------. 1 root root 916 Apr 20  2019 server16.key
    
62. -rw-------. 1 root root 916 Apr 20  2019 server17.key
    
63. -rw-------. 1 root root 916 Apr 20  2019 server18.key
    
64. -rw-------. 1 root root 916 Apr 20  2019 server19.key
    
65. -rw-------. 1 root root 916 Apr 20  2019 server1.key
    
66. -rw-------. 1 root root 912 Apr 20  2019 server20.key
    
67. -rw-------. 1 root root 912 Apr 20  2019 server2.key
    
68. -rw-------. 1 root root 916 Apr 20  2019 server3.key
    
69. -rw-------. 1 root root 916 Apr 20  2019 server4.key
    
70. -rw-------. 1 root root 920 Apr 20  2019 server5.key
    
71. -rw-------. 1 root root 916 Apr 20  2019 server6.key
    
72. -rw-------. 1 root root 912 Apr 20  2019 server7.key
    
73. -rw-------. 1 root root 916 Apr 20  2019 server8.key
    
74. -rw-------. 1 root root 916 Apr 20  2019 server9.key
    
75. [root@instructor private]# rm -f server*
    
76. [root@instructor private]#

复制代码

1. [root@instructor bin]# pwd
   
2. /root/bin
   
3. [root@instructor bin]# ./gls-setup-gen-sslcerts

复制代码

3. 考试正式题目DESKTOP/SERVER接入远程用户：
类似于ipa-client-install

1. [root@desktop3 yum.repos.d]# yum -y install authconfig-gtk sssd krb5-workstation pam_krb5
   
2. Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager
   
3. This system is not registered with an entitlement server. You can use subscription-manager to register.
   
4. Base                                                                                | 4.3 kB  00:00:00     
   
5. (1/2): Base/group_gz                                                                | 146 kB  00:00:00     
   
6. (2/2): Base/primary_db                                                              | 4.2 MB  00:00:00     
   
7. Resolving Dependencies
   
8. --> Running transaction check
   
9. ---> Package authconfig-gtk.x86_64 0:6.2.8-30.el7 will be installed
   
10. ---> Package krb5-workstation.x86_64 0:1.15.1-34.el7 will be installed
    
11. --> Processing Dependency: libkadm5(x86-64) = 1.15.1-34.el7 for package: krb5-workstation-1.15.1-34.el7.x86_64
    
12. --> Processing Dependency: libkadm5clnt_mit.so.11(kadm5clnt_mit_11_MIT)(64bit) for package: krb5-workstation-1.15.1-34.el7.x86_64
    
13. --> Processing Dependency: libkadm5srv_mit.so.11(kadm5srv_mit_11_MIT)(64bit) for package: krb5-workstation-1.15.1-34.el7.x86_64
    
14. --> Processing Dependency: libkadm5clnt_mit.so.11()(64bit) for package: krb5-workstation-1.15.1-34.el7.x86_64
    
15. --> Processing Dependency: libkadm5srv_mit.so.11()(64bit) for package: krb5-workstation-1.15.1-34.el7.x86_64
    
16. ---> Package pam_krb5.x86_64 0:2.4.8-6.el7 will be installed
    
17. ---> Package sssd.x86_64 0:1.16.2-13.el7 will be installed
    
18. --> Processing Dependency: python-sssdconfig = 1.16.2-13.el7 for package: sssd-1.16.2-13.el7.x86_64
    
19. --> Processing Dependency: sssd-ad = 1.16.2-13.el7 for package: sssd-1.16.2-13.el7.x86_64
    
20. --> Processing Dependency: sssd-common = 1.16.2-13.el7 for package: sssd-1.16.2-13.el7.x86_64
    
21. --> Processing Dependency: sssd-ipa = 1.16.2-13.el7 for package: sssd-1.16.2-13.el7.x86_64
    
22. --> Processing Dependency: sssd-krb5 = 1.16.2-13.el7 for package: sssd-1.16.2-13.el7.x86_64
    
23. --> Processing Dependency: sssd-ldap = 1.16.2-13.el7 for package: sssd-1.16.2-13.el7.x86_64
    
24. --> Processing Dependency: sssd-proxy = 1.16.2-13.el7 for package: sssd-1.16.2-13.el7.x86_64
    
25. --> Running transaction check
    
26. ---> Package libkadm5.x86_64 0:1.15.1-34.el7 will be installed
    
27. ---> Package python-sssdconfig.noarch 0:1.16.2-13.el7 will be installed
    
28. ---> Package sssd-ad.x86_64 0:1.16.2-13.el7 will be installed
    
29. --> Processing Dependency: sssd-common-pac = 1.16.2-13.el7 for package: sssd-ad-1.16.2-13.el7.x86_64
    
30. --> Processing Dependency: sssd-krb5-common = 1.16.2-13.el7 for package: sssd-ad-1.16.2-13.el7.x86_64
    
31. --> Processing Dependency: libdhash.so.1(DHASH_0.4.3)(64bit) for package: sssd-ad-1.16.2-13.el7.x86_64
    
32. --> Processing Dependency: libdhash.so.1()(64bit) for package: sssd-ad-1.16.2-13.el7.x86_64
    
33. --> Processing Dependency: libsss_certmap.so.0()(64bit) for package: sssd-ad-1.16.2-13.el7.x86_64
    
34. ---> Package sssd-common.x86_64 0:1.16.2-13.el7 will be installed
    
35. --> Processing Dependency: libsss_autofs(x86-64) = 1.16.2-13.el7 for package: sssd-common-1.16.2-13.el7.x86_64
    
36. --> Processing Dependency: libsss_sudo(x86-64) = 1.16.2-13.el7 for package: sssd-common-1.16.2-13.el7.x86_64
    
37. --> Processing Dependency: libcares.so.2()(64bit) for package: sssd-common-1.16.2-13.el7.x86_64
    
38. --> Processing Dependency: libhttp_parser_strict.so.2()(64bit) for package: sssd-common-1.16.2-13.el7.x86_64
    
39. ---> Package sssd-ipa.x86_64 0:1.16.2-13.el7 will be installed
    
40. --> Processing Dependency: libipa_hbac(x86-64) = 1.16.2-13.el7 for package: sssd-ipa-1.16.2-13.el7.x86_64
    
41. --> Processing Dependency: libipa_hbac.so.0(IPA_HBAC_0.0.1)(64bit) for package: sssd-ipa-1.16.2-13.el7.x86_64
    
42. --> Processing Dependency: libipa_hbac.so.0(IPA_HBAC_0.1.0)(64bit) for package: sssd-ipa-1.16.2-13.el7.x86_64
    
43. --> Processing Dependency: libipa_hbac.so.0()(64bit) for package: sssd-ipa-1.16.2-13.el7.x86_64
    
44. ---> Package sssd-krb5.x86_64 0:1.16.2-13.el7 will be installed
    
45. ---> Package sssd-ldap.x86_64 0:1.16.2-13.el7 will be installed
    
46. ---> Package sssd-proxy.x86_64 0:1.16.2-13.el7 will be installed
    
47. --> Running transaction check
    
48. ---> Package c-ares.x86_64 0:1.10.0-3.el7 will be installed
    
49. ---> Package http-parser.x86_64 0:2.7.1-5.el7_4 will be installed
    
50. ---> Package libdhash.x86_64 0:0.5.0-32.el7 will be installed
    
51. ---> Package libipa_hbac.x86_64 0:1.16.2-13.el7 will be installed
    
52. ---> Package libsss_autofs.x86_64 0:1.16.2-13.el7 will be installed
    
53. ---> Package libsss_certmap.x86_64 0:1.16.2-13.el7 will be installed
    
54. ---> Package libsss_sudo.x86_64 0:1.16.2-13.el7 will be installed
    
55. ---> Package sssd-common-pac.x86_64 0:1.16.2-13.el7 will be installed
    
56. ---> Package sssd-krb5-common.x86_64 0:1.16.2-13.el7 will be installed
    
57. --> Finished Dependency Resolution
    
58. 
    
59. Dependencies Resolved
    
60. 
    
61. ===========================================================================================================
    
62. Package                         Arch                 Version                     Repository          Size
    
63. ===========================================================================================================
    
64. Installing:
    
65. authconfig-gtk                  x86_64               6.2.8-30.el7                Base               109 k
    
66. krb5-workstation                x86_64               1.15.1-34.el7               Base               816 k
    
67. pam_krb5                        x86_64               2.4.8-6.el7                 Base               158 k
    
68. sssd                            x86_64               1.16.2-13.el7               Base               134 k
    
69. Installing for dependencies:
    
70. c-ares                          x86_64               1.10.0-3.el7                Base                78 k
    
71. http-parser                     x86_64               2.7.1-5.el7_4               Base                28 k
    
72. libdhash                        x86_64               0.5.0-32.el7                Base                29 k
    
73. libipa_hbac                     x86_64               1.16.2-13.el7               Base               143 k
    
74. libkadm5                        x86_64               1.15.1-34.el7               Base               177 k
    
75. libsss_autofs                   x86_64               1.16.2-13.el7               Base               144 k
    
76. libsss_certmap                  x86_64               1.16.2-13.el7               Base               171 k
    
77. libsss_sudo                     x86_64               1.16.2-13.el7               Base               143 k
    
78. python-sssdconfig               noarch               1.16.2-13.el7               Base               161 k
    
79. sssd-ad                         x86_64               1.16.2-13.el7               Base               263 k
    
80. sssd-common                     x86_64               1.16.2-13.el7               Base               1.4 M
    
81. sssd-common-pac                 x86_64               1.16.2-13.el7               Base               205 k
    
82. sssd-ipa                        x86_64               1.16.2-13.el7               Base               353 k
    
83. sssd-krb5                       x86_64               1.16.2-13.el7               Base               176 k
    
84. sssd-krb5-common                x86_64               1.16.2-13.el7               Base               209 k
    
85. sssd-ldap                       x86_64               1.16.2-13.el7               Base               227 k
    
86. sssd-proxy                      x86_64               1.16.2-13.el7               Base               169 k
    
87. 
    
88. Transaction Summary
    
89. ===========================================================================================================
    
90. Install  4 Packages (+17 Dependent packages)
    
91. 
    
92. Total download size: 5.2 M
    
93. Installed size: 10 M
    
94. Downloading packages:
    
95. (1/21): authconfig-gtk-6.2.8-30.el7.x86_64.rpm                                      | 109 kB  00:00:00     
    
96. (2/21): http-parser-2.7.1-5.el7_4.x86_64.rpm                                        |  28 kB  00:00:00     
    
97. (3/21): krb5-workstation-1.15.1-34.el7.x86_64.rpm                                   | 816 kB  00:00:00     
    
98. (4/21): libdhash-0.5.0-32.el7.x86_64.rpm                                            |  29 kB  00:00:00     
    
99. (5/21): c-ares-1.10.0-3.el7.x86_64.rpm                                              |  78 kB  00:00:00     
    
100. (6/21): libipa_hbac-1.16.2-13.el7.x86_64.rpm                                        | 143 kB  00:00:00     
     
101. (7/21): libkadm5-1.15.1-34.el7.x86_64.rpm                                           | 177 kB  00:00:00     
     
102. (8/21): libsss_autofs-1.16.2-13.el7.x86_64.rpm                                      | 144 kB  00:00:00     
     
103. (9/21): libsss_certmap-1.16.2-13.el7.x86_64.rpm                                     | 171 kB  00:00:00     
     
104. (10/21): libsss_sudo-1.16.2-13.el7.x86_64.rpm                                       | 143 kB  00:00:00     
     
105. (11/21): pam_krb5-2.4.8-6.el7.x86_64.rpm                                            | 158 kB  00:00:00     
     
106. (12/21): python-sssdconfig-1.16.2-13.el7.noarch.rpm                                 | 161 kB  00:00:00     
     
107. (13/21): sssd-1.16.2-13.el7.x86_64.rpm                                              | 134 kB  00:00:00     
     
108. (14/21): sssd-ad-1.16.2-13.el7.x86_64.rpm                                           | 263 kB  00:00:00     
     
109. (15/21): sssd-common-pac-1.16.2-13.el7.x86_64.rpm                                   | 205 kB  00:00:00     
     
110. (16/21): sssd-ipa-1.16.2-13.el7.x86_64.rpm                                          | 353 kB  00:00:00     
     
111. (17/21): sssd-krb5-1.16.2-13.el7.x86_64.rpm                                         | 176 kB  00:00:00     
     
112. (18/21): sssd-common-1.16.2-13.el7.x86_64.rpm                                       | 1.4 MB  00:00:00     
     
113. (19/21): sssd-krb5-common-1.16.2-13.el7.x86_64.rpm                                  | 209 kB  00:00:00     
     
114. (20/21): sssd-ldap-1.16.2-13.el7.x86_64.rpm                                         | 227 kB  00:00:00     
     
115. (21/21): sssd-proxy-1.16.2-13.el7.x86_64.rpm                                        | 169 kB  00:00:00     
     
116. -----------------------------------------------------------------------------------------------------------
     
117. Total                                                                      5.0 MB/s | 5.2 MB  00:00:01     
     
118. Running transaction check
     
119. Running transaction test
     
120. Transaction test succeeded
     
121. Running transaction
     
122.   Installing : libdhash-0.5.0-32.el7.x86_64                                                           1/21
     
123.   Installing : libsss_certmap-1.16.2-13.el7.x86_64                                                                              2/21
     
124.   Installing : libsss_autofs-1.16.2-13.el7.x86_64                                                                               3/21
     
125.   Installing : python-sssdconfig-1.16.2-13.el7.noarch                                                                           4/21
     
126.   Installing : c-ares-1.10.0-3.el7.x86_64                                                                                       5/21
     
127.   Installing : libsss_sudo-1.16.2-13.el7.x86_64                                                                                 6/21
     
128.   Installing : http-parser-2.7.1-5.el7_4.x86_64                                                                                 7/21
     
129.   Installing : sssd-common-1.16.2-13.el7.x86_64                                                                                 8/21
     
130.   Installing : sssd-krb5-common-1.16.2-13.el7.x86_64                                                                            9/21
     
131.   Installing : sssd-common-pac-1.16.2-13.el7.x86_64                                                                            10/21
     
132.   Installing : sssd-ad-1.16.2-13.el7.x86_64                                                                                    11/21
     
133.   Installing : sssd-krb5-1.16.2-13.el7.x86_64                                                                                  12/21
     
134.   Installing : sssd-ldap-1.16.2-13.el7.x86_64                                                                                  13/21
     
135.   Installing : sssd-proxy-1.16.2-13.el7.x86_64                                                                                 14/21
     
136.   Installing : libipa_hbac-1.16.2-13.el7.x86_64                                                                                15/21
     
137.   Installing : sssd-ipa-1.16.2-13.el7.x86_64                                                                                   16/21
     
138.   Installing : libkadm5-1.15.1-34.el7.x86_64                                                                                   17/21
     
139.   Installing : krb5-workstation-1.15.1-34.el7.x86_64                                                                           18/21
     
140.   Installing : sssd-1.16.2-13.el7.x86_64                                                                                       19/21
     
141.   Installing : pam_krb5-2.4.8-6.el7.x86_64                                                                                     20/21
     
142.   Installing : authconfig-gtk-6.2.8-30.el7.x86_64                                                                              21/21
     
143. Base/productid                                                                                                | 1.6 kB  00:00:00     
     
144.   Verifying  : sssd-krb5-1.16.2-13.el7.x86_64                                                         1/21
     
145.   Verifying  : sssd-ipa-1.16.2-13.el7.x86_64                                                          2/21
     
146.   Verifying  : sssd-common-pac-1.16.2-13.el7.x86_64                                                   3/21
     
147.   Verifying  : sssd-proxy-1.16.2-13.el7.x86_64                                                        4/21
     
148.   Verifying  : libkadm5-1.15.1-34.el7.x86_64                                                          5/21
     
149.   Verifying  : krb5-workstation-1.15.1-34.el7.x86_64                                                  6/21
     
150.   Verifying  : libipa_hbac-1.16.2-13.el7.x86_64                                                       7/21
     
151.   Verifying  : http-parser-2.7.1-5.el7_4.x86_64                                                       8/21
     
152.   Verifying  : authconfig-gtk-6.2.8-30.el7.x86_64                                                     9/21
     
153.   Verifying  : libsss_certmap-1.16.2-13.el7.x86_64                                                   10/21
     
154.   Verifying  : sssd-ad-1.16.2-13.el7.x86_64                                                          11/21
     
155.   Verifying  : sssd-common-1.16.2-13.el7.x86_64                                                      12/21
     
156.   Verifying  : libsss_sudo-1.16.2-13.el7.x86_64                                                      13/21
     
157.   Verifying  : libdhash-0.5.0-32.el7.x86_64                                                          14/21
     
158.   Verifying  : pam_krb5-2.4.8-6.el7.x86_64                                                           15/21
     
159.   Verifying  : c-ares-1.10.0-3.el7.x86_64                                                            16/21
     
160.   Verifying  : python-sssdconfig-1.16.2-13.el7.noarch                                                17/21
     
161.   Verifying  : libsss_autofs-1.16.2-13.el7.x86_64                                                    18/21
     
162.   Verifying  : sssd-ldap-1.16.2-13.el7.x86_64                                                        19/21
     
163.   Verifying  : sssd-1.16.2-13.el7.x86_64                                                             20/21
     
164.   Verifying  : sssd-krb5-common-1.16.2-13.el7.x86_64                                                 21/21
     
165. 
     
166. Installed:
     
167.   authconfig-gtk.x86_64 0:6.2.8-30.el7               krb5-workstation.x86_64 0:1.15.1-34.el7              
     
168.   pam_krb5.x86_64 0:2.4.8-6.el7                      sssd.x86_64 0:1.16.2-13.el7                          
     
169. 
     
170. Dependency Installed:
     
171.   c-ares.x86_64 0:1.10.0-3.el7                          http-parser.x86_64 0:2.7.1-5.el7_4                 
     
172.   libdhash.x86_64 0:0.5.0-32.el7                        libipa_hbac.x86_64 0:1.16.2-13.el7                 
     
173.   libkadm5.x86_64 0:1.15.1-34.el7                       libsss_autofs.x86_64 0:1.16.2-13.el7               
     
174.   libsss_certmap.x86_64 0:1.16.2-13.el7                 libsss_sudo.x86_64 0:1.16.2-13.el7                 
     
175.   python-sssdconfig.noarch 0:1.16.2-13.el7              sssd-ad.x86_64 0:1.16.2-13.el7                     
     
176.   sssd-common.x86_64 0:1.16.2-13.el7                    sssd-common-pac.x86_64 0:1.16.2-13.el7            
     
177.   sssd-ipa.x86_64 0:1.16.2-13.el7                       sssd-krb5.x86_64 0:1.16.2-13.el7                  
     
178.   sssd-krb5-common.x86_64 0:1.16.2-13.el7               sssd-ldap.x86_64 0:1.16.2-13.el7                  
     
179.   sssd-proxy.x86_64 0:1.16.2-13.el7                    
     
180. 
     
181. Complete!

复制代码

4. 实现类似于ipa host-add server$i.example.com  ipa host-add desktop$i.example.com的功能：

1. [root@instructor etc]# kadmin.local
   
2. Authenticating as principal root/admin@EXAMPLE.COM with password.
   
3. kadmin.local:  addprinc root/admin
   
4. WARNING: no policy specified for root/admin@EXAMPLE.COM; defaulting to no policy
   
5. Enter password for principal "root/admin@EXAMPLE.COM":
   
6. Re-enter password for principal "root/admin@EXAMPLE.COM":
   
7. Principal "root/admin@EXAMPLE.COM" created.
   
8. kadmin.local:  ?
   
9. Available kadmin.local requests:
   
10. 
    
11. add_principal, addprinc, ank
    
12.                          Add principal
    
13. delete_principal, delprinc
    
14.                          Delete principal
    
15. modify_principal, modprinc
    
16.                          Modify principal
    
17. change_password, cpw     Change password
    
18. get_principal, getprinc  Get principal
    
19. list_principals, listprincs, get_principals, getprincs
    
20.                          List principals
    
21. add_policy, addpol       Add policy
    
22. modify_policy, modpol    Modify policy
    
23. delete_policy, delpol    Delete policy
    
24. get_policy, getpol       Get policy
    
25. list_policies, listpols, get_policies, getpols
    
26.                          List policies
    
27. get_privs, getprivs      Get privileges
    
28. ktadd, xst               Add entry(s) to a keytab
    
29. ktremove, ktrem          Remove entry(s) from a keytab
    
30. lock                     Lock database exclusively (use with extreme caution!)
    
31. unlock                   Release exclusive database lock
    
32. purgekeys                Purge previously retained old keys from a principal
    
33. list_requests, lr, ?     List available requests.
    
34. quit, exit, q            Exit program.
    
35. kadmin.local:  list_principals
    
36. K/M@EXAMPLE.COM
    
37. kadmin/admin@EXAMPLE.COM
    
38. kadmin/changepw@EXAMPLE.COM
    
39. kadmin/instructor.example.com@EXAMPLE.COM
    
40. krbtgt/EXAMPLE.COM@EXAMPLE.COM
    
41. ldapuser10@EXAMPLE.COM
    
42. ldapuser11@EXAMPLE.COM
    
43. ldapuser12@EXAMPLE.COM
    
44. ldapuser13@EXAMPLE.COM
    
45. ldapuser14@EXAMPLE.COM
    
46. ldapuser15@EXAMPLE.COM
    
47. ldapuser16@EXAMPLE.COM
    
48. ldapuser17@EXAMPLE.COM
    
49. ldapuser18@EXAMPLE.COM
    
50. ldapuser19@EXAMPLE.COM
    
51. ldapuser1@EXAMPLE.COM
    
52. ldapuser20@EXAMPLE.COM
    
53. ldapuser2@EXAMPLE.COM
    
54. ldapuser3@EXAMPLE.COM
    
55. ldapuser4@EXAMPLE.COM
    
56. ldapuser5@EXAMPLE.COM
    
57. ldapuser6@EXAMPLE.COM
    
58. ldapuser7@EXAMPLE.COM
    
59. ldapuser8@EXAMPLE.COM
    
60. ldapuser9@EXAMPLE.COM
    
61. root/admin@EXAMPLE.COM
    
62. kadmin.local:  addprinc -randkey host/instructor.example.com
    
63. WARNING: no policy specified for host/instructor.example.com@EXAMPLE.COM; defaulting to no policy
    
64. Principal "host/instructor.example.com@EXAMPLE.COM" created.
    
65. kadmin.local:  addprinc -randkey host/server3.example.com
    
66. WARNING: no policy specified for host/server3.example.com@EXAMPLE.COM; defaulting to no policy
    
67. Principal "host/server3.example.com@EXAMPLE.COM" created.
    
68. kadmin.local:  addprinc -randkey host/desktop3.example.com
    
69. WARNING: no policy specified for host/desktop3.example.com@EXAMPLE.COM; defaulting to no policy
    
70. Principal "host/desktop3.example.com@EXAMPLE.COM" created.
    
71. kadmin.local:  addprinc -randkey nfs/server3.example.com
    
72. WARNING: no policy specified for nfs/server3.example.com@EXAMPLE.COM; defaulting to no policy
    
73. Principal "nfs/server3.example.com@EXAMPLE.COM" created.
    
74. kadmin.local:  list_principals
    
75. K/M@EXAMPLE.COM
    
76. host/desktop3.example.com@EXAMPLE.COM
    
77. host/instructor.example.com@EXAMPLE.COM
    
78. host/server3.example.com@EXAMPLE.COM
    
79. kadmin/admin@EXAMPLE.COM
    
80. kadmin/changepw@EXAMPLE.COM
    
81. kadmin/instructor.example.com@EXAMPLE.COM
    
82. krbtgt/EXAMPLE.COM@EXAMPLE.COM
    
83. ldapuser10@EXAMPLE.COM
    
84. ldapuser11@EXAMPLE.COM
    
85. ldapuser12@EXAMPLE.COM
    
86. ldapuser13@EXAMPLE.COM
    
87. ldapuser14@EXAMPLE.COM
    
88. ldapuser15@EXAMPLE.COM
    
89. ldapuser16@EXAMPLE.COM
    
90. ldapuser17@EXAMPLE.COM
    
91. ldapuser18@EXAMPLE.COM
    
92. ldapuser19@EXAMPLE.COM
    
93. ldapuser1@EXAMPLE.COM
    
94. ldapuser20@EXAMPLE.COM
    
95. ldapuser2@EXAMPLE.COM
    
96. ldapuser3@EXAMPLE.COM
    
97. ldapuser4@EXAMPLE.COM
    
98. ldapuser5@EXAMPLE.COM
    
99. ldapuser6@EXAMPLE.COM
    
100. ldapuser7@EXAMPLE.COM
     
101. ldapuser8@EXAMPLE.COM
     
102. ldapuser9@EXAMPLE.COM
     
103. nfs/server3.example.com@EXAMPLE.COM
     
104. root/admin@EXAMPLE.COM
     
105. kadmin.local:  

复制代码

1. [root@instructor etc]# kadmin.local
   
2. Authenticating as principal root/admin@EXAMPLE.COM with password.
   
3. kadmin.local:  addprinc root/admin
   
4. WARNING: no policy specified for root/admin@EXAMPLE.COM; defaulting to no policy
   
5. Enter password for principal "root/admin@EXAMPLE.COM":
   
6. Re-enter password for principal "root/admin@EXAMPLE.COM":
   
7. Principal "root/admin@EXAMPLE.COM" created.
   
8. kadmin.local:  ?
   
9. Available kadmin.local requests:
   
10. 
    
11. add_principal, addprinc, ank
    
12.                          Add principal
    
13. delete_principal, delprinc
    
14.                          Delete principal
    
15. modify_principal, modprinc
    
16.                          Modify principal
    
17. change_password, cpw     Change password
    
18. get_principal, getprinc  Get principal
    
19. list_principals, listprincs, get_principals, getprincs
    
20.                          List principals
    
21. add_policy, addpol       Add policy
    
22. modify_policy, modpol    Modify policy
    
23. delete_policy, delpol    Delete policy
    
24. get_policy, getpol       Get policy
    
25. list_policies, listpols, get_policies, getpols
    
26.                          List policies
    
27. get_privs, getprivs      Get privileges
    
28. ktadd, xst               Add entry(s) to a keytab
    
29. ktremove, ktrem          Remove entry(s) from a keytab
    
30. lock                     Lock database exclusively (use with extreme caution!)
    
31. unlock                   Release exclusive database lock
    
32. purgekeys                Purge previously retained old keys from a principal
    
33. list_requests, lr, ?     List available requests.
    
34. quit, exit, q            Exit program.
    
35. kadmin.local:  list_principals
    
36. K/M@EXAMPLE.COM
    
37. kadmin/admin@EXAMPLE.COM
    
38. kadmin/changepw@EXAMPLE.COM
    
39. kadmin/instructor.example.com@EXAMPLE.COM
    
40. krbtgt/EXAMPLE.COM@EXAMPLE.COM
    
41. ldapuser10@EXAMPLE.COM
    
42. ldapuser11@EXAMPLE.COM
    
43. ldapuser12@EXAMPLE.COM
    
44. ldapuser13@EXAMPLE.COM
    
45. ldapuser14@EXAMPLE.COM
    
46. ldapuser15@EXAMPLE.COM
    
47. ldapuser16@EXAMPLE.COM
    
48. ldapuser17@EXAMPLE.COM
    
49. ldapuser18@EXAMPLE.COM
    
50. ldapuser19@EXAMPLE.COM
    
51. ldapuser1@EXAMPLE.COM
    
52. ldapuser20@EXAMPLE.COM
    
53. ldapuser2@EXAMPLE.COM
    
54. ldapuser3@EXAMPLE.COM
    
55. ldapuser4@EXAMPLE.COM
    
56. ldapuser5@EXAMPLE.COM
    
57. ldapuser6@EXAMPLE.COM
    
58. ldapuser7@EXAMPLE.COM
    
59. ldapuser8@EXAMPLE.COM
    
60. ldapuser9@EXAMPLE.COM
    
61. root/admin@EXAMPLE.COM
    
62. kadmin.local:  addprinc -randkey host/instructor.example.com
    
63. WARNING: no policy specified for host/instructor.example.com@EXAMPLE.COM; defaulting to no policy
    
64. Principal "host/instructor.example.com@EXAMPLE.COM" created.
    
65. kadmin.local:  addprinc -randkey host/server3.example.com
    
66. WARNING: no policy specified for host/server3.example.com@EXAMPLE.COM; defaulting to no policy
    
67. Principal "host/server3.example.com@EXAMPLE.COM" created.
    
68. kadmin.local:  addprinc -randkey host/desktop3.example.com
    
69. WARNING: no policy specified for host/desktop3.example.com@EXAMPLE.COM; defaulting to no policy
    
70. Principal "host/desktop3.example.com@EXAMPLE.COM" created.
    
71. kadmin.local:  addprinc -randkey nfs/server3.example.com
    
72. WARNING: no policy specified for nfs/server3.example.com@EXAMPLE.COM; defaulting to no policy
    
73. Principal "nfs/server3.example.com@EXAMPLE.COM" created.
    
74. kadmin.local:  list_principals
    
75. K/M@EXAMPLE.COM
    
76. host/desktop3.example.com@EXAMPLE.COM
    
77. host/instructor.example.com@EXAMPLE.COM
    
78. host/server3.example.com@EXAMPLE.COM
    
79. kadmin/admin@EXAMPLE.COM
    
80. kadmin/changepw@EXAMPLE.COM
    
81. kadmin/instructor.example.com@EXAMPLE.COM
    
82. krbtgt/EXAMPLE.COM@EXAMPLE.COM
    
83. ldapuser10@EXAMPLE.COM
    
84. ldapuser11@EXAMPLE.COM
    
85. ldapuser12@EXAMPLE.COM
    
86. ldapuser13@EXAMPLE.COM
    
87. ldapuser14@EXAMPLE.COM
    
88. ldapuser15@EXAMPLE.COM
    
89. ldapuser16@EXAMPLE.COM
    
90. ldapuser17@EXAMPLE.COM
    
91. ldapuser18@EXAMPLE.COM
    
92. ldapuser19@EXAMPLE.COM
    
93. ldapuser1@EXAMPLE.COM
    
94. ldapuser20@EXAMPLE.COM
    
95. ldapuser2@EXAMPLE.COM
    
96. ldapuser3@EXAMPLE.COM
    
97. ldapuser4@EXAMPLE.COM
    
98. ldapuser5@EXAMPLE.COM
    
99. ldapuser6@EXAMPLE.COM
    
100. ldapuser7@EXAMPLE.COM
     
101. ldapuser8@EXAMPLE.COM
     
102. ldapuser9@EXAMPLE.COM
     
103. nfs/server3.example.com@EXAMPLE.COM
     
104. root/admin@EXAMPLE.COM
     
105. kadmin.local:  q
     
106. [root@instructor etc]# kinit root/admin
     
107. Password for root/admin@EXAMPLE.COM:
     
108. [root@instructor etc]# ls -l krb5.keytab
     
109. krb5.keytab         krb5.keytab.client  krb5.keytab.server  
     
110. [root@instructor etc]# ls -l krb5.keytab*
     
111. -rw-------. 1 root root 1376 Jun 29  2019 krb5.keytab
     
112. -rw-------. 1 root root  466 Jun 29  2019 krb5.keytab.client
     
113. -rw-------. 1 root root 1376 Jun 29  2019 krb5.keytab.server
     
114. [root@instructor etc]# rm -f  krb5.keytab*
     
115. [root@instructor etc]# kadmin.local
     
116. Authenticating as principal root/admin@EXAMPLE.COM with password.
     
117. kadmin.local:  ktadd host/desktop3.example.com
     
118. Entry for principal host/desktop3.example.com with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab WRFILE:/etc/krb5.keytab.
     
119. Entry for principal host/desktop3.example.com with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:/etc/krb5.keytab.
     
120. Entry for principal host/desktop3.example.com with kvno 2, encryption type des3-cbc-sha1 added to keytab WRFILE:/etc/krb5.keytab.
     
121. Entry for principal host/desktop3.example.com with kvno 2, encryption type arcfour-hmac added to keytab WRFILE:/etc/krb5.keytab.
     
122. Entry for principal host/desktop3.example.com with kvno 2, encryption type des-hmac-sha1 added to keytab WRFILE:/etc/krb5.keytab.
     
123. Entry for principal host/desktop3.example.com with kvno 2, encryption type des-cbc-md5 added to keytab WRFILE:/etc/krb5.keytab.
     
124. kadmin.local:  q
     
125. [root@instructor etc]# cp krb5.keytab  /var/ftp/pub/krb5.keytab.client
     
126. [root@instructor etc]# ktutil
     
127. ktutil:  read_kt /var/ftp/pub/krb5.keytab.client
     
128. ktutil:  l
     
129. slot KVNO Principal
     
130. ---- ---- ---------------------------------------------------------------------
     
131.    1    2    host/desktop3.example.com@EXAMPLE.COM
     
132.    2    2    host/desktop3.example.com@EXAMPLE.COM
     
133.    3    2    host/desktop3.example.com@EXAMPLE.COM
     
134.    4    2    host/desktop3.example.com@EXAMPLE.COM
     
135.    5    2    host/desktop3.example.com@EXAMPLE.COM
     
136.    6    2    host/desktop3.example.com@EXAMPLE.COM
     
137. ktutil:  q
     
138. [root@instructor etc]# kinit root/admin
     
139. Password for root/admin@EXAMPLE.COM:
     
140. [root@instructor etc]# kadmin.local
     
141. Authenticating as principal root/admin@EXAMPLE.COM with password.
     
142. kadmin.local:  ktadd host/server3.example.com
     
143. Entry for principal host/server3.example.com with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab WRFILE:/etc/krb5.keytab.
     
144. Entry for principal host/server3.example.com with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:/etc/krb5.keytab.
     
145. Entry for principal host/server3.example.com with kvno 2, encryption type des3-cbc-sha1 added to keytab WRFILE:/etc/krb5.keytab.
     
146. Entry for principal host/server3.example.com with kvno 2, encryption type arcfour-hmac added to keytab WRFILE:/etc/krb5.keytab.
     
147. Entry for principal host/server3.example.com with kvno 2, encryption type des-hmac-sha1 added to keytab WRFILE:/etc/krb5.keytab.
     
148. Entry for principal host/server3.example.com with kvno 2, encryption type des-cbc-md5 added to keytab WRFILE:/etc/krb5.keytab.
     
149. kadmin.local:  ktadd nfs/server3.example.com
     
150. Entry for principal nfs/server3.example.com with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab WRFILE:/etc/krb5.keytab.
     
151. Entry for principal nfs/server3.example.com with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:/etc/krb5.keytab.
     
152. Entry for principal nfs/server3.example.com with kvno 2, encryption type des3-cbc-sha1 added to keytab WRFILE:/etc/krb5.keytab.
     
153. Entry for principal nfs/server3.example.com with kvno 2, encryption type arcfour-hmac added to keytab WRFILE:/etc/krb5.keytab.
     
154. Entry for principal nfs/server3.example.com with kvno 2, encryption type des-hmac-sha1 added to keytab WRFILE:/etc/krb5.keytab.
     
155. Entry for principal nfs/server3.example.com with kvno 2, encryption type des-cbc-md5 added to keytab WRFILE:/etc/krb5.keytab.
     
156. kadmin.local:  q
     
157. [root@instructor etc]# cp krb5.keytab  /var/ftp/pub/krb5.keytab.server
     
158. [root@instructor etc]# ktutil
     
159. ktutil:  read_kt /var/ftp/pub/krb5.keytab.server
     
160. ktutil:  l
     
161. slot KVNO Principal
     
162. ---- ---- ---------------------------------------------------------------------
     
163.    1    2    host/desktop3.example.com@EXAMPLE.COM
     
164.    2    2    host/desktop3.example.com@EXAMPLE.COM
     
165.    3    2    host/desktop3.example.com@EXAMPLE.COM
     
166.    4    2    host/desktop3.example.com@EXAMPLE.COM
     
167.    5    2    host/desktop3.example.com@EXAMPLE.COM
     
168.    6    2    host/desktop3.example.com@EXAMPLE.COM
     
169.    7    2     host/server3.example.com@EXAMPLE.COM
     
170.    8    2     host/server3.example.com@EXAMPLE.COM
     
171.    9    2     host/server3.example.com@EXAMPLE.COM
     
172.   10    2     host/server3.example.com@EXAMPLE.COM
     
173.   11    2     host/server3.example.com@EXAMPLE.COM
     
174.   12    2     host/server3.example.com@EXAMPLE.COM
     
175.   13    2      nfs/server3.example.com@EXAMPLE.COM
     
176.   14    2      nfs/server3.example.com@EXAMPLE.COM
     
177.   15    2      nfs/server3.example.com@EXAMPLE.COM
     
178.   16    2      nfs/server3.example.com@EXAMPLE.COM
     
179.   17    2      nfs/server3.example.com@EXAMPLE.COM
     
180.   18    2      nfs/server3.example.com@EXAMPLE.COM
     
181. ktutil:  

复制代码

1. [root@instructor pub]# chmod 644 krb5.keytab.*

复制代码

在DESKTOP操作：

1. [root@desktop3 yum.repos.d]# wget -O /etc/krb5.keytab http://instructor.example.com/pub/krb5.keytab.client
   
2. --2020-02-21 22:17:56--  http://instructor.example.com/pub/krb5.keytab.client
   
3. Resolving instructor.example.com (instructor.example.com)... 192.168.0.254
   
4. Connecting to instructor.example.com (instructor.example.com)|192.168.0.254|:80... connected.
   
5. HTTP request sent, awaiting response... 200 OK
   
6. Length: 466 [text/plain]
   
7. Saving to: ‘/etc/krb5.keytab’
   
8. 
   
9. 100%[=================================================================>] 466         --.-K/s   in 0s      
   
10. 
    
11. 2020-02-21 22:17:56 (44.5 MB/s) - ‘/etc/krb5.keytab’ saved [466/466]
    
12. 
    
13. [root@desktop3 yum.repos.d]# systemctl status nfs-secure
    
14. ● rpc-gssd.service - RPC security service for NFS client and server
    
15.    Loaded: loaded (/usr/lib/systemd/system/rpc-gssd.service; static; vendor preset: disabled)
    
16.    Active: inactive (dead)
    
17. Condition: start condition failed at Sat 2020-02-22 03:54:00 CST; 5h 35min left
    
18. [root@desktop3 yum.repos.d]# systemctl enable nfs-secure
    
19. [root@desktop3 yum.repos.d]# systemctl restart  nfs-secure
    
20. [root@desktop3 yum.repos.d]# systemctl status  nfs-secure
    
21. ● rpc-gssd.service - RPC security service for NFS client and server
    
22.    Loaded: loaded (/usr/lib/systemd/system/rpc-gssd.service; static; vendor preset: disabled)
    
23.    Active: active (running) since Fri 2020-02-21 22:38:59 CST; 5s ago
    
24.   Process: 68839 ExecStart=/usr/sbin/rpc.gssd $GSSDARGS (code=exited, status=0/SUCCESS)
    
25. Main PID: 68840 (rpc.gssd)
    
26.     Tasks: 1
    
27.    CGroup: /system.slice/rpc-gssd.service
    
28.            └─68840 /usr/sbin/rpc.gssd
    
29. 
    
30. Feb 21 22:38:59 desktop3.example.com systemd[1]: Starting RPC security service for NFS client and server...
    
31. Feb 21 22:38:59 desktop3.example.com systemd[1]: Started RPC security service for NFS client and server.
    
32. Hint: Some lines were ellipsized, use -l to show in full.
    
33. [root@desktop3 yum.repos.d]#

复制代码

SERVER上操作：如果是RedHat Enterprise Linux 7.0 (RH299）还要enable和restart   nfs-secure-server !!!!!!

1. [root@server3 ~]# wget -O /etc/krb5.keytab http://instructor.example.com/pub/krb5.keytab.server
   
2. --2020-02-21 22:17:20--  http://instructor.example.com/pub/krb5.keytab.server
   
3. Resolving instructor.example.com (instructor.example.com)... 192.168.0.254
   
4. Connecting to instructor.example.com (instructor.example.com)|192.168.0.254|:80... connected.
   
5. HTTP request sent, awaiting response... 200 OK
   
6. Length: 1376 (1.3K) [text/plain]
   
7. Saving to: ‘/etc/krb5.keytab’
   
8. 
   
9. 100%[======================================>] 1,376       --.-K/s   in 0s      
   
10. 
    
11. 2020-02-21 22:17:20 (152 MB/s) - ‘/etc/krb5.keytab’ saved [1376/1376]
    
12. 
    
13. [root@server3 ~]# systemctl status nfs-secure
    
14. ● rpc-gssd.service - RPC security service for NFS client and server
    
15.    Loaded: loaded (/usr/lib/systemd/system/rpc-gssd.service; static; vendor preset: disabled)
    
16.    Active: inactive (dead)
    
17. Condition: start condition failed at Sat 2020-02-22 03:54:34 CST; 5h 36min left
    
18. [root@server3 ~]# systemctl enable  nfs-secure
    
19. [root@server3 ~]# systemctl enable  nfs-secure-server
    
20. Failed to execute operation: No such file or directory
    
21. [root@server3 ~]# cat /etc/redhat-release
    
22. Red Hat Enterprise Linux Server release 7.6 (Maipo)
    
23. [root@server3 ~]# systemctl restart   nfs-secure
    
24. [root@server3 ~]# systemctl status nfs-secure
    
25. ● rpc-gssd.service - RPC security service for NFS client and server
    
26.    Loaded: loaded (/usr/lib/systemd/system/rpc-gssd.service; static; vendor preset: disabled)
    
27.    Active: active (running) since Fri 2020-02-21 22:20:19 CST; 5s ago
    
28.   Process: 59132 ExecStart=/usr/sbin/rpc.gssd $GSSDARGS (code=exited, status=0/SUCCESS)
    
29. Main PID: 59133 (rpc.gssd)
    
30.     Tasks: 1
    
31.    CGroup: /system.slice/rpc-gssd.service
    
32.            └─59133 /usr/sbin/rpc.gssd
    
33. 
    
34. Feb 21 22:20:18 server3.example.com systemd[1]: Starting RPC security servic....
    
35. Feb 21 22:20:19 server3.example.com systemd[1]: Started RPC security service....
    
36. Hint: Some lines were ellipsized, use -l to show in full.

复制代码

nfs-secure(nfs-secure-server)类似于RHEL8的nfs-idmapd -----------有并且只有这些进程是跟krb5.keytab有关的。