在 rhel8 上升级 sssd 会破坏 docker 容器中的 PAM 身份验证

Question

我在 docker 容器中遇到 PAM 身份验证问题（用于 RStudio 服务器的身份验证），/var/lib/sss 安装在容器中，因此 PAM 身份验证有效。但在 sssd-2.7.3-4.el8_7.3 上它不再有效，下面的日志来自 /var/log/sssd/sssd_pam.log。结果，我不得不对 sssd 'yum versionlock add sssd-0:2.6.2-4.el8_6.1.*' 进行版本锁定，这不是一个好的做法。有谁知道可能出了什么问题？

      *  (2023-02-08  9:24:58): [pam] [get_client_cred] (0x4000): Client [0x55d1b39ddf20][24] creds: euid[0] egid[0] pid[673277] cmd_line['/usr/lib/rstudio-server/bin/rserver-pam'].
   *  (2023-02-08  9:24:58): [pam] [setup_client_idle_timer] (0x4000): Idle timer re-set for client [0x55d1b39ddf20][24]
   *  (2023-02-08  9:24:58): [pam] [accept_fd_handler] (0x0400): [CID#1] Client [cmd /usr/lib/rstudio-server/bin/rserver-pam][uid 0][0x55d1b39ddf20][24] connected to privileged pipe!
   *  (2023-02-08  9:24:58): [pam] [sss_cmd_get_version] (0x0200): [CID#1] Received client version [3].
   *  (2023-02-08  9:24:58): [pam] [sss_cmd_get_version] (0x0200): [CID#1] Offered version [3].
   *  (2023-02-08  9:24:58): [pam] [pam_cmd_authenticate] (0x0100): [CID#1] entering pam_cmd_authenticate
   *  (2023-02-08  9:24:58): [pam] [sss_domain_get_state] (0x1000): [CID#1] Domain mydomain.com is Active
   *  (2023-02-08  9:24:58): [pam] [sss_parse_name] (0x0100): [CID#1] Domain not provided!
   *  (2023-02-08  9:24:58): [pam] [sss_parse_name_for_domains] (0x0200): [CID#1] name 'admin-jnk' matched without domain, user is admin-jnk
   *  (2023-02-08  9:24:58): [pam] [pam_print_data] (0x0100): [CID#1] command: SSS_PAM_AUTHENTICATE
   *  (2023-02-08  9:24:58): [pam] [pam_print_data] (0x0100): [CID#1] domain: not set
   *  (2023-02-08  9:24:58): [pam] [pam_print_data] (0x0100): [CID#1] user: admin-jnk
   *  (2023-02-08  9:24:58): [pam] [pam_print_data] (0x0100): [CID#1] service: rstudio
   *  (2023-02-08  9:24:58): [pam] [pam_print_data] (0x0100): [CID#1] tty: not set
   *  (2023-02-08  9:24:58): [pam] [pam_print_data] (0x0100): [CID#1] ruser: not set
   *  (2023-02-08  9:24:58): [pam] [pam_print_data] (0x0100): [CID#1] rhost: not set
   *  (2023-02-08  9:24:58): [pam] [pam_print_data] (0x0100): [CID#1] authtok type: 1 (Password)
   *  (2023-02-08  9:24:58): [pam] [pam_print_data] (0x0100): [CID#1] newauthtok type: 0 (No authentication token available)
   *  (2023-02-08  9:24:58): [pam] [pam_print_data] (0x0100): [CID#1] priv: 1
   *  (2023-02-08  9:24:58): [pam] [pam_print_data] (0x0100): [CID#1] cli_pid: 3667
   *  (2023-02-08  9:24:58): [pam] [pam_print_data] (0x0100): [CID#1] child_pid: 0
   *  (2023-02-08  9:24:58): [pam] [pam_print_data] (0x0100): [CID#1] logon name: admin-jnk
   *  (2023-02-08  9:24:58): [pam] [pam_print_data] (0x0100): [CID#1] flags: 0
   *  (2023-02-08  9:24:58): [pam] [cache_req_set_plugin] (0x2000): [CID#1] CR #0: Setting "Initgroups by name" plugin
   *  (2023-02-08  9:24:58): [pam] [cache_req_send] (0x0400): [CID#1] CR #0: REQ_TRACE: New request [CID #1] 'Initgroups by name'
   *  (2023-02-08  9:24:58): [pam] [cache_req_process_input] (0x0400): [CID#1] CR #0: Parsing input name [admin-jnk]
   *  (2023-02-08  9:24:58): [pam] [sss_domain_get_state] (0x1000): [CID#1] Domain mydomain.com is Active
   *  (2023-02-08  9:24:58): [pam] [sss_parse_name] (0x0100): [CID#1] Domain not provided!
   *  (2023-02-08  9:24:58): [pam] [sss_parse_name_for_domains] (0x0200): [CID#1] name 'admin-jnk' matched without domain, user is admin-jnk
   *  (2023-02-08  9:24:58): [pam] [cache_req_set_name] (0x0400): [CID#1] CR #0: Setting name [admin-jnk]
   *  (2023-02-08  9:24:58): [pam] [cache_req_domain_copy_cr_domains] (0x0040): [CID#1] No requested domains found, please check configuration options for typos.

/etc/sssd/sssd.conf

[sssd]
domains = mydomain.com
config_file_version = 2
services = nss, pam, autofs

[domain/mydomain.com]
ad_domain = mydomain.com
krb5_realm = MYDOMAIN.COM
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /mydomain/bruker/%u
access_provider = simple
simple_allow_groups = RBAG_Linux@mydomain.com

试图改变 sssd.conf 但没有任何帮助。

Answer 1

我也有同样的问题。 在主机上将 RedHat 8.6 (sssd 2.6.2-4) 升级到 RedHat 8.7 (sssd 2.7.3-4)，一旦我执行基于 Ubuntu 20.04 的容器，就不再可以进行 pam 身份验证（即 su 和 sudo 失败）。 日志与您发布的内容相似。