这是设置：

> Windows 2012 AD域(realdomain.tld)
> Fedora 25工作站(wksf25.realdomain.tld)
> CentOS 7服务器(sc7.realdomain.tld)
> Ubuntu 16.04服务器(su16.realdomain.tld)

一切都通过领域加入AD,这没有问题.所有东西也可以登录或通过kinit获得Kerberos门票.从wksf25到sc7的SSH工作正常,我可以使用登录wkfs25时获得的kerberos票证通过SSH登录.

以下是Ubuntu的设置步骤：

>安装包：

apt install realmd oddjob oddjob-mkhomedir sssd sssd-tools adcli samba-common krb5-user chrony packagekit libpam-krb5

>编辑chrony.conf以使用AD DC.
>设置realmd.conf：vim /etc/realmd.conf

[users]
default-home = /home/%D/%U

[realdomain.tld]
fully-qualified-names = no
manage-system = no
automatic-id-mapping = yes

>加入域：域加入-vU domainuser realdomain.tld
>允许登录：领域允许-R realdomain.tld -g linuxadmins
>特定于Ubuntu – 设置pam以在登录时创建homedir：`vim /etc/pam.d/common-session’

session optional        pam_mkhomedir.so umask=0077

>特定于Ubuntu – 在OpenSSH中启用GSSAPI身份验证：vim / etc / ssh / sshd_config

GSSAPIAuthentiction yes
GSSAPICleanupCredentials no

>使用域帐户登录并确保一切正常.此时所有工作都可以通过ubuntu服务器上的Kerberos票证减去无密码SSH登录.

这是我从领域列表中得到的：

realdomain.tld
  type: kerberos
  realm-name: REALDOMAIN.TLD
  domain-name: realdomain.tld
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: sssd-tools
  required-package: sssd
  required-package: libnss-sss
  required-package: libpam-sss
  required-package: adcli
  required-package: samba-common-bin
  login-formats: %U
  login-policy: allow-permitted-logins
  permitted-logins: 
  permitted-groups: linuxusers

sssd.conf：

[sssd]
domains = realdomain.tld
config_file_version = 2
services = nss,pam

[domain/realdomain.tld]
ad_domain = realdomain.tld
krb5_realm = REALDOAMIN.TLD
realmd_tags = joined-with-adcli 
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /home/%d/%u
access_provider = simple
simple_allow_groups = linuxusers

krb5.conf的：

[libdefaults]
    dns_lookup_realm = false
    ticket_lifetime = 24h
    renew_lifetime = 7d
    forwardable = true
    rdns = false
    default_ccache_name = KEYRING:persistent:%{uid}

    default_realm = REALDOMAIN.TLD

[realms]
    REALDOMAIN.TLD = {
    }

[domain_realm]
    realdomain.org = REALDOMAIN.TLD
    .realdomain.org = REALDOMAIN.TLD

我错过了什么？