{"id":1009,"date":"2022-11-17T10:26:24","date_gmt":"2022-11-17T02:26:24","guid":{"rendered":"http:\/\/www.rchen.top\/?p=1009"},"modified":"2022-11-17T10:26:28","modified_gmt":"2022-11-17T02:26:28","slug":"pam%e5%ae%89%e5%85%a8%e6%a1%86%e6%9e%b6%e5%af%bc%e8%87%b4ssh%e6%97%a0%e6%b3%95%e7%99%bb%e9%99%86%e7%9a%84%e6%8e%92%e6%9f%a5%e6%96%b9%e6%b3%95","status":"publish","type":"post","link":"https:\/\/www.rchen.top\/?p=1009","title":{"rendered":"PAM\u5b89\u5168\u6846\u67b6\u5bfc\u81f4ssh\u65e0\u6cd5\u767b\u9646\u7684\u6392\u67e5\u65b9\u6cd5"},"content":{"rendered":"<p style=\"margin: 0in; font-family: \u5b8b\u4f53; font-size: 12.0pt;\">\u95ee\u9898\u73b0\u8c61\uff1a\u51fa\u73b0\u7528\u6237\u8ba4\u8bc1\u9519\u8bef\uff08\u786e\u8ba4\u5bc6\u7801\u6b63\u786e\uff09<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-1010 \" src=\"http:\/\/www.rchen.top\/wp-content\/uploads\/2022\/11\/Pasted-2.png\" width=\"675\" height=\"397\" \/><\/p>\n<p style=\"margin: 0in; font-family: \u5b8b\u4f53; font-size: 12.0pt;\"><span lang=\"en-US\">\/var\/log\/secure <\/span><span lang=\"zh-CN\">\u63d0\u793a<\/span><span lang=\"en-US\">system error<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" width=\"1034\" height=\"36\" class=\"alignnone wp-image-1011 size-full\" src=\"http:\/\/www.rchen.top\/wp-content\/uploads\/2022\/11\/Pasted-3.png\" \/><\/p>\n<p style=\"margin: 0in; font-family: \u5b8b\u4f53; font-size: 12.0pt;\"><span lang=\"en-US\">\/var\/log\/message <\/span><span lang=\"zh-CN\">\u63d0\u793a<\/span> <span lang=\"zh-CN\">[sssd[krb5_child[18654]: Disk quota exceeded<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" width=\"1718\" height=\"594\" class=\"alignnone wp-image-1013 size-full\" src=\"http:\/\/www.rchen.top\/wp-content\/uploads\/2022\/11\/Pasted-5.png\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" width=\"1478\" height=\"696\" class=\"alignnone wp-image-1012 size-full\" src=\"http:\/\/www.rchen.top\/wp-content\/uploads\/2022\/11\/Pasted-4.png\" \/><\/p>\n<p style=\"margin: 0in; font-family: \u5b8b\u4f53; font-size: 12.0pt; color: #e84c22;\"><span style=\"font-weight: bold;\">\u95ee\u9898\u539f\u56e0\uff1a<\/span><\/p>\n<p style=\"margin: 0in; font-size: 11.25pt;\"><span lang=\"en-US\" style=\"font-family: Calibri; color: #5f5f5f; background: white;\">T<\/span><span lang=\"zh-CN\" style=\"font-family: \u5b8b\u4f53; color: #5f5f5f; background: white;\">he data is safe in the kernel and is not accidentally written to the hard disk by swapping.\u00a0However, there is a problem: the mechanism could be abused as a DOS attack if there were no quota mechanism that limits the maximum storage space.\u00a0And that\u2019s exactly what struck, because the Kerberos keyring has become too large over time.\u00a0Via\u00a0<\/span><span lang=\"zh-CN\" style=\"font-family: \u5b8b\u4f53; color: #e01e5a; background: #F8F8F8;\">\/proc\/sys\/kernel\/keys\/maxbytes<\/span><span lang=\"zh-CN\" style=\"font-family: \u5b8b\u4f53; color: #5f5f5f; background: white;\">is limited to a maximum of 20,000 bytes per user:<\/span><\/p>\n<p style=\"margin: 0in; font-family: \u5b8b\u4f53; font-size: 11.25pt; color: #e01e5a;\"><span style=\"background: #F8F8F8;\"># grep $UID \/proc\/key-users<\/span><\/p>\n<p style=\"margin: 0in; font-family: \u5b8b\u4f53; font-size: 11.25pt; color: #e01e5a;\"><span style=\"background: #F8F8F8;\">2260: 28 28\/28 \/28\/200 18733\/20000<\/span><\/p>\n<p style=\"margin: 0in; font-family: \u5b8b\u4f53; font-size: 11.25pt; color: #e01e5a;\">\n<p style=\"margin: 0in; font-family: \u5b8b\u4f53; font-size: 11.25pt; color: #e01e5a;\"><span style=\"font-weight: bold; background: #F8F8F8;\">\u89e3\u51b3\u65b9\u6848\uff1a<\/span><\/p>\n<p style=\"margin: 0in; font-family: \u5b8b\u4f53; font-size: 11.25pt; color: #e01e5a;\"><span lang=\"zh-CN\" style=\"font-weight: bold; background: #F8F8F8;\">\u8c03\u6574<\/span><span lang=\"zh-CN\" style=\"background: #F8F8F8;\">\/proc\/sys\/kernel\/keys\/maxbytes<\/span> <span lang=\"zh-CN\" style=\"background: #F8F8F8;\">\u6216<\/span> <span lang=\"zh-CN\" style=\"background: #F8F8F8;\">\/proc\/sys\/kernel\/keys\/max<\/span><span lang=\"en-US\" style=\"background: #F8F8F8;\">keys<\/span><span lang=\"zh-CN\" style=\"font-weight: bold; background: #F8F8F8;\">\u53c2\u6570<\/span><\/p>\n<p style=\"margin: 0in; font-family: \u5b8b\u4f53; font-size: 11.25pt; color: #5f5f5f;\"><span style=\"background: white;\">(The meaning of the values \u200b\u200bis described in more detail in &lt;man:keyrings(7)&gt;.) When trying to authenticate me, the SSSD got a new ticket and wanted to attach it to my keyring.\u00a0But that failed because of the quota limitation.<\/span><\/p>\n<p style=\"margin: 0in; font-family: \u5b8b\u4f53; font-size: 11.25pt; color: #5f5f5f;\"><span style=\"background: white;\">This can be changed globally for all users as follows:<\/span><\/p>\n<p style=\"margin: 0in; font-size: 11.25pt; color: #e01e5a;\"><span lang=\"zh-CN\" style=\"font-family: \u5b8b\u4f53; background: #F8F8F8;\"># sysctl -w kernel\/keys\/max<\/span><span lang=\"en-US\" style=\"font-family: Calibri; background: #F8F8F8;\">key<\/span><span lang=\"zh-CN\" style=\"font-family: \u5b8b\u4f53; background: #F8F8F8;\">s=<\/span><span lang=\"en-US\" style=\"font-family: Calibri; background: #F8F8F8;\">300<\/span><\/p>\n<p style=\"margin: 0in; font-size: 11.25pt; color: #e01e5a;\"><span lang=\"zh-CN\" style=\"font-family: \u5b8b\u4f53; background: #F8F8F8;\">kernel.keys.max<\/span><span lang=\"en-US\" style=\"font-family: Calibri; background: #F8F8F8;\">key<\/span><span lang=\"zh-CN\" style=\"font-family: \u5b8b\u4f53; background: #F8F8F8;\">s = <\/span><span lang=\"en-US\" style=\"font-family: Calibri; background: #F8F8F8;\">300<\/span><\/p>\n<p style=\"margin: 0in; font-family: \u5b8b\u4f53; font-size: 11.25pt; color: #5f5f5f;\">\n<p style=\"margin: 0in; font-family: \u5b8b\u4f53; font-size: 11.25pt; color: #e01e5a;\"><span style=\"background: #F8F8F8;\"># sysctl -w kernel\/keys\/maxbytes=64000<\/span><\/p>\n<p style=\"margin: 0in; font-family: \u5b8b\u4f53; font-size: 11.25pt; color: #e01e5a;\"><span style=\"background: #F8F8F8;\">kernel.keys.maxbytes = 64000<\/span><\/p>\n<p style=\"margin: 0in; font-family: \u5b8b\u4f53; font-size: 11.25pt; color: #5f5f5f;\"><span style=\"background: white;\">After that it was possible to register again.\u00a0In the statistics I could then see that the storage space was not sufficient:<\/span><\/p>\n<p style=\"margin: 0in; font-family: \u5b8b\u4f53; font-size: 11.25pt; color: #e01e5a;\"><span style=\"background: #F8F8F8;\"># grep $UID \/proc\/key-users<\/span><\/p>\n<p style=\"margin: 0in; font-family: \u5b8b\u4f53; font-size: 11.25pt; color: #e01e5a;\"><span style=\"background: #F8F8F8;\">2260: 29 29\/29 29\/200 20127\/64000<\/span><\/p>\n<p style=\"margin: 0in; font-family: \u5b8b\u4f53; font-size: 11.25pt;\"><span style=\"color: #5f5f5f; background: white;\">This adjustment can be made persistent, for example via a file such as\u00a0<\/span><span style=\"color: #e01e5a; background: #F8F8F8;\">\/etc\/sysctl.d\/sssd.conf<\/span><span style=\"color: #5f5f5f; background: white;\">, where this change is carried out at every start.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" width=\"840\" height=\"1050\" class=\"alignnone wp-image-1014 size-full\" src=\"http:\/\/www.rchen.top\/wp-content\/uploads\/2022\/11\/Pasted-6.png\" \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u95ee\u9898\u73b0\u8c61\uff1a\u51fa\u73b0\u7528\u6237\u8ba4\u8bc1\u9519\u8bef\uff08\u786e\u8ba4\u5bc6\u7801\u6b63\u786e\uff09 \/var\/log\/secure \u63d0\u793asystem error \/v [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":490,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[37],"tags":[14],"class_list":["post-1009","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","tag-linux"],"_links":{"self":[{"href":"https:\/\/www.rchen.top\/index.php?rest_route=\/wp\/v2\/posts\/1009","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rchen.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rchen.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rchen.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rchen.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1009"}],"version-history":[{"count":1,"href":"https:\/\/www.rchen.top\/index.php?rest_route=\/wp\/v2\/posts\/1009\/revisions"}],"predecessor-version":[{"id":1015,"href":"https:\/\/www.rchen.top\/index.php?rest_route=\/wp\/v2\/posts\/1009\/revisions\/1015"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rchen.top\/index.php?rest_route=\/wp\/v2\/media\/490"}],"wp:attachment":[{"href":"https:\/\/www.rchen.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1009"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rchen.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1009"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rchen.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1009"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}