Простите, что кратко описал проблему. Дело в том, что мне нужны перемещаемые профили, и надеюсь, для них SPN не нужен. У меня настроены и соединены два виртуальных контроллера домена, которые работают исправно. Конфигурировал SSSD по данному руководству:
https://docs.altlinux.org/ru-RU/alt-domain/11.0/html/alt-domain/sssd-winbind.html. Я уверен, что сделал ошибку как минимум в конфигурации PAM (/etc/pam.d/system-auth), так как не понял что конкретно нужно делать в нем.
Конфиги связанные с SSSD:
# nano /etc/pam.d/system-auth
Спойлер
#%PAM-1.0
auth [success=4 perm_denied=ignore default=die] pam_localuser.so
auth [success=1 default=bad] pam_succeed_if.so uid >= 500 quiet
auth [default=1] pam_permit.so
auth substack system-auth-sss-only
auth [default=1] pam_permit.so
auth substack system-auth-local-only
auth substack system-auth-common
account [success=4 perm_denied=ignore default=die] pam_localuser.so
account [success=1 default=bad] pam_succeed_if.so uid >= 500 quiet
account [default=1] pam_permit.so
account substack system-auth-sss-only
account [default=1] pam_permit.so
account substack system-auth-local-only
account substack system-auth-common
password [success=4 perm_denied=ignore default=die] pam_localuser.so
password [success=1 default=bad] pam_succeed_if.so uid >= 500 quiet
password [default=1] pam_permit.so
password substack system-auth-sss-only
password [default=1] pam_permit.so
password substack system-auth-local-only
password substack system-auth-common
session [success=4 perm_denied=ignore default=die] pam_localuser.so
session [success=1 default=bad] pam_succeed_if.so uid >= 500 quiet
session [default=1] pam_permit.so
session substack system-auth-sss-only
session [default=1] pam_permit.so
session substack system-auth-local-only
session substack system-auth-common
# nano /etc/sssd/sssd.conf
Спойлер
[sssd]
config_file_version = 2
services = nss, pam
enumerate = true
# Managed by system facility command:
## control sssd-drop-privileges unprivileged|privileged|default
user = root
# SSSD will not start if you do not configure any domains.
[nss]
debug_level = 1
[pam]
debug_level = 1
[domain/DOOMIN11.ALT]
use_fully_qualified_names = false
id_provider = ad
auth_provider = ad
chpass_provider = ad
access_provider = ad
default_shell = /bin/bash
fallback_homedir = /home/%d/%u
debug_level = 0
cache_credentials = true
ad_gpo_ignore_unreadable = true
ad_gpo_access_control = permissive
ad_update_samba_machine_account_password = true
# nano /etc/nsswitch.conf
Спойлер
#
# Please refer to nsswitch.conf(5) for more information on this file.
#
# This is the Name Service Switch configuration file. This file should
# be sorted with the most-used databases at the beginning.
#
# Specifying '[NOTFOUND=return]' means that the search for an entry
# should stop if the search with the previous service turned up nothing.
# Note that if the search failed due to some other reason (like no NIS
# server responding) then the search continues with the next service.
#
# Legal name services are:
#
# files Use local files
# tcb Use local tcb shadow files, see tcb(5)
# db Use local database files under /var/db
# nis or yp Use NIS (NIS version 2), also called YP
# nisplus or nis+ Use NIS+ (NIS version 3)
# dns Use DNS (Domain Name Service)
# compat Use NIS in compatibility mode
# hesiod Use Hesiod for user lookups
# [NOTFOUND=return] Stop searching if not found so far
#
passwd: files sss
shadow: tcb files sss
group: files [SUCCESS=merge] sss
gshadow: files
hosts: files myhostname dns
# To use db, put the "db" in front of "files" for things you want to be
# looked up first in the db files.
#
#passwd: db files nisplus nis
#shadow: db tcb files nisplus nis
#group: db files nisplus nis
#
#hosts: db files nisplus nis dns
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files
# Example - obey only what nisplus tells us...
#services: nisplus [NOTFOUND=return] files
#networks: nisplus [NOTFOUND=return] files
#protocols: nisplus [NOTFOUND=return] files
#rpc: nisplus [NOTFOUND=return] files
#ethers: nisplus [NOTFOUND=return] files
#netmasks: nisplus [NOTFOUND=return] files
#bootparams: nisplus [NOTFOUND=return] files
#netgroup: nisplus
#publickey: nisplus
automount: files
aliases: files
P.S. Неужели эти конфиги нужно редактировать на рабочих машинах, а не КД?
