Ubuntu服务器Kerberos迁移后客户端登录失败问题求助

大家好，我现在遇到了Kerberos迁移后的登录故障，想请各位帮忙排查下：

我们正在把Debian服务器上的Active Directory迁移到Ubuntu服务器，目前已经配置好LDAP（Slapd）、libnss、Kerberos、PAM和NFS，但客户端尝试登录时，服务器会抛出Kerberos相关错误，客户端这边则是闪一下黑屏就回到登录界面。

Kerberos迁移操作步骤 #

Kerberos是通过apt包管理器安装的，之后我从旧Debian服务器复制了以下文件到新Ubuntu服务器：

• krb5.conf
• krb5.keytab
• krb5kdc目录
• /var/lib/krb5kdc目录

新服务器上的错误日志 #

下面是新服务器的Kerberos日志片段：

Sep 17 17:50:01 cs2s krb5kdc[2383]: AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), DEPRECATED:des3-cbc-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 10.0.0.90: NEEDED_PREAUTH: n.dajnowski@CS for krbtgt/CS@CS, Additional pre-authentication required

Sep 17 17:50:01 cs2s krb5kdc[2383]: AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), DEPRECATED:des3-cbc-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 10.0.0.90: ISSUE: authtime 1694973001, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, n.dajnowski@CS for krbtgt/CS@CS

Sep 17 17:50:01 cs2s krb5kdc[2383]: TGS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), DEPRECATED:des3-cbc-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 10.0.0.90: ISSUE: authtime 1694973001, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, n.dajnowski@CS for host/cs2s.cs@CS

Sep 17 17:50:35 cs2s krb5kdc[2383]: AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), DEPRECATED:des3-cbc-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 10.0.0.254: NEEDED_PREAUTH: test@CS for krbtgt/CS@CS, Additional pre-authentication required

Sep 17 17:50:35 cs2s krb5kdc[2383]: preauth (encrypted_timestamp) verify failure: Preauthentication failed

Sep 17 17:50:35 cs2s krb5kdc[2383]: AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), DEPRECATED:des3-cbc-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 10.0.0.254: PREAUTH_FAILED: test@CS for krbtgt/CS@CS, Preauthentication failed

旧服务器的成功情况对比 #

在旧Debian服务器上测试登录是完全正常的，我留意到旧服务器日志里的主体是cs2s.cs@CS，但新服务器日志里显示的是CS@CS，不知道这会不会是导致故障的原因？

我本身对Kerberos这类技术比较陌生，想请教各位大佬，该怎么正确配置新的Ubuntu服务器来解决这个登录失败的问题呢？

备注：内容来源于stack exchange，提问作者guest123