使用 ldap、pam-ccreds 和 nss_updatedb 进行离线身份验证

Question

我已经设置了一台带有 ldap 身份验证的 linux 机器（debian 6.0.7），配置如下：

/etc/nsswitch.conf

passwd:         compat ldap [NOTFOUND=return UNAVAIL=continue] db
group:          compat ldap [NOTFOUND=return UNAVAIL=continue] db
shadow:         compat ldap

/etc/pam.d/common-account

# here are the per-package modules (the "Primary" block)
account [user_unknown=ignore authinfo_unavail=ignore default=ok]        pam_unix.so
account [success=ok user_unknown=ignore authinfo_unavail=ignore default=ignore] pam_succeed_if.so uid < 1000 debug
account [success=done default=ignore authinfo_unavail=1]     pam_ldap.so debug
# here's the fallback if no module succeeds
account requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config

/etc/pam.d/common-auth

# here are the per-package modules (the "Primary" block)
auth    [success=done default=ignore]      pam_unix.so nullok_secure
auth    requisite       pam_succeed_if.so uid >= 1000 quiet
auth    requisite       pam_succeed_if.so gid >= 1000 quiet
auth    requisite       pam_succeed_if.so user notingroup root
auth    requisite       pam_succeed_if.so user notingroup wheel
auth    [success=3 default=2 authinfo_unavail=ignore]      pam_ldap.so use_first_pass
auth    [success=2 default=ignore]      pam_ccreds.so minimum_uid=1000 action=validate use_first_pass
auth    [default=ignore]                pam_ccreds.so minimum_uid=1000 action=update
# here's the fallback if no module succeeds
auth    requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth    optional                        pam_ccreds.so minimum_uid=1000 action=store
# end of pam-auth-update config

/etc/pam.d/common-password

# here are the per-package modules (the "Primary" block)
password        [success=2 default=ignore]      pam_unix.so obscure sha512
password        [success=1 user_unknown=ignore default=die authinfo_unavail=ignore]     pam_ldap.so try_first_pass
# here's the fallback if no module succeeds
password        requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password        required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
password        optional        pam_gnome_keyring.so
# end of pam-auth-update config

/etc/pam.d/common-session

# here are the per-package modules (the "Primary" block)
session [default=1]                     pam_permit.so
# here's the fallback if no module succeeds
session requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
session required        pam_unix.so
session required        pam_mkhomedir.so skel=/etc/skel umask=0022
session optional        pam_ldap.so
# end of pam-auth-update config

在普通帐户中，如果 ldap 服务器不可用，我必须跳转到 pam_permit，否则具有缓存凭据的用户无法进行身份验证，但我认为这不是一个好主意。

我还在运行 nss_updatedb ldap 来缓存密码和组。

一切正常，即使是离线身份验证。问题是当我在 ldap 上禁用用户时（将 shadowexpire 设置为 1）。当机器在线时，身份验证系统通知该帐户被禁用，但当机器离线时，禁用的用户可以使用缓存的凭据登录。我相信这是因为影子信息没有被缓存。

这是一种缓存禁用用户影子信息的方法，即使机器离线也无法登录？

Answer 1

pam_ccreds README 说目前不支持。您可以重置用户的密码，而不是使用 shadowexpire。

Answer 2

感谢您分享您的配置！我把/etc/pam.d/common-account从

account [user_unknown=ignore authinfo_unavail=ignore default=ok]        pam_unix.so

到

account [success=done user_unknown=ignore authinfo_unavail=ignore default=ok]        pam_unix.so

问题在于，当 LDAP 服务器不可用时，即使使用了正确的密码，本地用户也会被拒绝。 success=done 一旦 pam_unix.so 表示没问题，就会终止链。