儲存文件中缺少綁定 DN 條目 - 為領域初始化數據庫時

我正在嘗試在 Centos 6.3 上使用 ldap 後端執行 kerberos 在使用以下命令創建領域後：

kdb5_ldap_util -D "cn=admin,dc=example,dc=com" create -sscope sub -sf /var/kerberos/krb5kdc/example_stash.keyfile -r EXAMPLE.COM -s

我正在嘗試執行kdc並得到：

Starting Kerberos 5 KDC: krb5kdc: cannot initialize realm EXAMPLE.COM - see log file for details

日誌顯示這樣的錯誤：

krb5kdc: Error reading password from stash:  Bind DN entry missing in stash file - while initializing database for realm EXAMPLE.COM

krb5.conf文件：

[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
[realms]
EXAMPLE.COM = {
kdc = kerberos.example.com
admin_server = kerberos.example.com
master_kdc = kerberos.example.com
default_domain = example.com
database_module = ldap_example
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
kerberos.example.com = EXAMPLE.COM
[appdefaults]
pam = {
debug = true
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
[dbmodules]
ldap_example = {
db_library = kldap
## DN for the global Kerberos container entry
ldap_kerberos_container_dn = ou=kerberos,ou=Services,dc=example,dc=com
ldap_kdc_dn = cn=krbadmin,ou=Services,dc=example,dc=com       ## this object needs to have READ rights on the realm container, principal container and realm sub-trees
ldap_kadmind_dn = "cn=krbadmin,ou=Services,dc=example,dc=com" ## this object needs to have READ and WRITE rights on the realm container, principal container and realm sub-trees
ldap_service_password_file = /var/kerberos/krb5kdc/example_stash.keyfile
ldap_servers = ldap://kerberos.example.com
ldap_conns_per_server = 5
}

兩者ou=kerberos,ou=Services,dc=example,dc=com兼而有之cn=krbadmin,ou=Services,dc=example,dc=com。境界在下ou=kerberos。kdb5_ldap_util可以列出來：

kdb5_ldap_util -D cn=admin,dc=example,dc=com list -r EXAMPLE.COM
Password for "cn=admin,dc=example,dc=com": 
EXAMPLE.COM

儲存文件是新創建的，它在創建領域之前不存在。我已經試著問叔叔了，但沒有運氣。

與領域一起創建的儲存文件在使用 OpenLDAP 後端時沒有用，因為它不包含 DN。它看起來像獨立的儲存文件。

您必須使用以下命令創建儲存文件：

kdb5_ldap_util -D "cn=admin,dc=example,dc=com" stashsrvpw -f /var/kerberos/krb5kdc/example_stash.keyfile "cn=krbadmin,ou=Services,dc=example,dc=com"

krb5.conf 不支持內聯註釋的另一件事。

引用自：https://serverfault.com/questions/505044