使用AD来验证Linux的当前最佳实践(2013)

我现在使用的方法是 SSSD.它非常轻松,配置文件很干净. SSSD可以在安装时启用,也可以通过authconfig命令UI运行.我最近从本地auth转换了~200台Linux服务器到SSSD并使用了以下步骤.

这假设一个类似Red Hat的系统(RHel,CentOS,Fedora)……

1)下载SSSD.

yum install sssd

2).修改系统的authconfig设置.

3).使用以下命令更新/etc/sssd/sssd.conf配置文件内容：

# sssd.conf

[domain/default]

ldap_id_use_start_tls = false
ldap_scheR_715_11845@a = rfc2307bis
ldap_search_base = dc=mdmarra,dc=local
krb5_realm = MDMARRA.LOCAL
krb5_server = dc1.mdmarra.local
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
ldap_uri = ldap://dc1.mdmarra.local,ldap://dc2.mdmarra.local
krb5_kpasswd = dc1.mdmarra.local,dc2.mdmarra.local
krb5_kdcip = dc1.mdmarra.local,dc2.mdmarra.local
cache_credentials = True
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_force_upper_case_realm = True
ldap_user_object_class = person
ldap_group_object_class = group
ldap_user_gecos = displayName
ldap_user_home_directory = unixHomeDirectory
ldap_defaulT_Bind_dn = ldapuser@mdmarra.local
ldap_default_authtok_type = password
ldap_default_authtok = fdfXb52Ghk3F

[sssd]
services = nss,pam
config_file_version = 2

domains = default

[nss]
filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd

[pam]

[sudo]

[autofs]

[ssh]