在Kerberized Linux机器上添加本地用户/密码

前端之家收集整理的这篇文章主要介绍了在Kerberized Linux机器上添加本地用户/密码前端之家小编觉得挺不错的,现在分享给大家,也给大家做个参考。
现在,如果我尝试添加一个不在大学的Kerberos领域的非系统用户,我会被提示输入Kerberos密码.显然没有输入密码,所以我只需按回车即可看到:
  1. passwd: Authentication token manipulation error
  2. passwd: password unchanged

键入passwd newuser对同一消息有同样的问题.

我尝试使用pwconv,希望只需要一个影子条目,但它什么都没改变.

我希望能够添加不在域中的本地用户并为他们提供本地密码而不必担心Kerberos.

我在Ubuntu 10.04上.这是我的/etc/pam.d/common-*文件(Ubuntu的pam-auth-update软件包生成的默认值):

将/etc/pam.d/common-account

  1. # here are the per-package modules (the "Primary" block)
  2. account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so
  3. # here's the fallback if no module succeeds
  4. account requisite pam_deny.so
  5. # prime the stack with a positive return value if there isn't one already;
  6. # this avoids us returning an error just because nothing sets a success code
  7. # since the modules above will each just jump around
  8. account required pam_permit.so
  9. # and here are more per-package modules (the "Additional" block)
  10. account required pam_krb5.so minimum_uid=1000
  11. # end of pam-auth-update config

将/etc/pam.d/common-auth

  1. # here are the per-package modules (the "Primary" block)
  2. auth [success=2 default=ignore] pam_krb5.so minimum_uid=1000
  3. auth [success=1 default=ignore] pam_unix.so nullok_secure try_first_pass
  4. # here's the fallback if no module succeeds
  5. auth requisite pam_deny.so
  6. # prime the stack with a positive return value if there isn't one already;
  7. # this avoids us returning an error just because nothing sets a success code
  8. # since the modules above will each just jump around
  9. auth required pam_permit.so
  10. # and here are more per-package modules (the "Additional" block)
  11. # end of pam-auth-update config

/etc/pam.d/common-password

  1. # here are the per-package modules (the "Primary" block)
  2. password requisite pam_krb5.so minimum_uid=1000
  3. password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass sha512
  4. # here's the fallback if no module succeeds
  5. password requisite pam_deny.so
  6. # prime the stack with a positive return value if there isn't one already;
  7. # this avoids us returning an error just because nothing sets a success code
  8. # since the modules above will each just jump around
  9. password required pam_permit.so
  10. # and here are more per-package modules (the "Additional" block)
  11. # end of pam-auth-update config

/etc/pam.d/common-session

  1. # here are the per-package modules (the "Primary" block)
  2. session [default=1] pam_permit.so
  3. # here's the fallback if no module succeeds
  4. session requisite pam_deny.so
  5. # prime the stack with a positive return value if there isn't one already;
  6. # this avoids us returning an error just because nothing sets a success code
  7. # since the modules above will each just jump around
  8. session required pam_permit.so
  9. # and here are more per-package modules (the "Additional" block)
  10. session optional pam_krb5.so minimum_uid=1000
  11. session required pam_unix.so
  12. # end of pam-auth-update config

解决方法

通过pam-auth-update命令暂时调整

>您可以使用pam-auth-update暂时停用Kerberos.所以它看起来像这样:
[] Kerberos身份验证
>然后,您可以添加用户/更改密码.
>完成后,使用pam-auth-update重新激活Kerberos.所以它看起来像这样:
[*] Kerberos身份验证

另见:pam-auth-update manpage

猜你在找的Linux相关文章