kdb5_util轉儲給服務器錯誤

我一直在試圖傾倒我Kerberos數據庫使用kdb5_util轉儲（文件名）（LDAP後端），但我得到：kdb5_util轉儲給服務器錯誤

kdb5_util load_dump version 6 
kdb5_util: error performing Kerberos version 5 release 1.8 dump (Server error) 
policy default 0  0  1  1  1  0  0  0  0

的Kerberos KDC和日誌的kadmin無關，ldap.log給出 5月31日12:40:17 kdc slapd [28020]：connection_input：conn = 1091推遲操作：綁定

一切工作正常，創建，刪除，校長認證，沒問題。只是傾銷數據庫失敗。據我所知，後端不應該對轉儲有任何影響。

任何想法，我可以調試或解決這個問題？我錯過了什麼？

的/etc/krb5.conf

[libdefaults] 
     default_realm = REALM.EXAMPLE.COM 
     kdc_timesync = 1 
     ccache_type  = 4 
     forwardable  = true 
     proxiable  = true 

[realms] 
     REALM.EXAMPLE.COM = { 
       kdc    = kdc.realm.example.com 
       admin_server = kdc.realm.example.com 
       kpasswd_server = kdc.realm.example.com 
     } 

[domain_realm] 
     .realm.example.com = REALM.EXAMPLE.COM

/etc/krb5kdc/kdc.conf

[realms] 
    REALM.EXAMPLE.COM = { 
     default_domain = realm.example.com 
     database_module = ldapconf 

     acl_file  = /etc/krb5kdc/kadm5.acl 
     key_stash_file = /etc/krb5kdc/.master 

     max_life  = 10h 0m 0s 
     max_renewable_life = 7d 0h 0m 0s 

     master_key_type   = aes256-cts 
     supported_enctypes  = aes256-cts-hmac-sha1-96:normal 
#aes128-cts-hmac-sha1-96:normal arcfour-hmac:normal 
     default_principal_flags = +preauth 

     pkinit_identity = FILE:/etc/krb5kdc/kdc-cert.pem,/etc/krb5kdc/.kdc-key.pem 
     pkinit_anchors = FILE:/etc/krb5kdc/ca-cert.pem 

     dict_file  = /root/bad_passwords.dict 
    } 

[dbmodules] 
     ldapconf = { 
       db_library     = kldap 
       ldap_kerberos_container_dn = "cn=kerberos,dc=realm,dc=example,dc=com" 
       ldap_kdc_dn    = "cn=kerberos-kdc,dc=realm,dc=example,dc=com" 
       ldap_kadmind_dn   = "cn=kerberos-admin,dc=realm,dc=example,dc=com" 
       ldap_servers    = ldapi:/// 
       ldap_service_password_file = /etc/krb5kdc/.service 
    } 
[logging] 
kdc   = FILE:/var/log/kerberos/kdc.log 
admin_server = FILE:/var/log/kerberos/kadmin.log 
default  = FILE:/var/log/kerberos/kerberos.log

來源

2017-05-31 Kestrel

發現了這個問題，在最後：的LDAP後端有500搜索請求硬盤大小限制。有501位用戶在背後咬我！修復： – Kestrel

在最後調試後發現了問題：

的LDAP後端有一個硬搜索請求的大小限制爲500。有501位用戶在背後咬我！

修復：

# 
# remove sizelimit for ldap search 
# 
# apply with ldapmodify -Y EXTERNAL -H ldapi:/// -f sizelimit.ldif 
# 
dn: olcDatabase={1}hdb,cn=config 
changetype: modify 
add: olcLimits 
olcLimits: dn.exact="cn=kerberos-admin,dc=realm,dc=example,dc=com" size=unlimited

應用，重啓slapd的，並轉儲興高采烈地走了

來源

2017-06-08 12:33:40 Kestrel

kdb5_util轉儲給服務器錯誤

回答

相關問題