我们正在尝试配置具有多个域的单个kerberos服务器（这是必需的），所以我最终创建了2个这样的数据库以及每个数据库中的一些主体（一切都很好，我可以登录到这两个数据库并查看不同的主体）：
kdc.conf
[realms]
EXAMPLE1.COM =
{database_module=EXAMPLE1.COM
...}
EXAMPLE2.COM =
{database_module=EXAMPLE2.COM
...}
[dbmodules]
EXAMPLE1.COM=
{database_name=/var/kerberos/krb5kdc/principal
...}
EXAMPLE2.COM =
{database_name=/var/kerberos/krb5kdc/principal2
...}
krb5.conf看起来像这样：
[realms]
EXAMPLE1.COM=
{ kdc= server.example1.com
admin_server = server.example1.com
default_domain = example1.com
...}
EXAMPLE2.COM =
{kdc= server.example2.com:61321
admin_server = server.example2.com:61321
default_domain = example2.com
...}
[domain_realm]
.example1.com = EXAMPLE1.COM
example1.com = EXAMPLE1.COM
.example2.com = EXAMPLE2.COM
example2.com = EXAMPLE2.COM
现在的问题是，kerberos似乎不接受example2处于不同领域的kdc（但它适用于example1）：
kinit -V -t /tmp/krb5.example2.keytab user/example2@EXAMPLE2.com
keytab specified,forcing -k
Using default cache: /tmp/krb5cc_0
Using principal: user/example2@EXAMPLE2.com
Using keytab: /tmp/krb5.example2.keytab
kinit: Cannot contact any KDC for realm 'EXAMPLE2.com' while getting initial credentials
在修改后建议修改后，我使用systemctl edit --full krb5kdc.service编辑了服务文件，并将其放置在末尾-r Example1 -r EXAMPLE2，现在看来效果更好，但我仍然遇到错误，我无法理解（不确定我是否应该添加不同的端口或发生了什么）：
kinit -V -t /tmp/krb5.example2.keytab user/example2@EXAMPLE2.COM
keytab specified,forcing -k
Using default cache: /tmp/krb5cc_0
Using principal: user/example2@EXAMPLE2.COM
Using keytab: /tmp/krb5.example2.keytab
[355090] 1573732431.376189: Getting initial credentials for user/example2@EXAMPLE2.COM
[355090] 1573732431.376190: Looked up etypes in keytab: aes256-cts,aes128-cts,des3-cbc-sha1,rc4-hmac,des-hmac-sha1,des,des-cbc-crc
[355090] 1573732431.376192: Sending unauthenticated request
[355090] 1573732431.376193: Sending request (201 bytes) to cpd4PRE.NEO4J.GENCAT.CAT
[355090] 1573732431.376194: Resolving hostname host.example2.com
[355090] 1573732431.376195: Initiating TCP connection to stream 10.53.48.79:88
[355090] 1573732431.376196: Sending TCP request to stream 10.53.48.79:88
[355090] 1573732431.376197: Received answer (218 bytes) from stream 10.53.48.79:88
[355090] 1573732431.376198: Terminating TCP connection to stream 10.53.48.79:88
[355090] 1573732431.376199: Response was not from master KDC
[355090] 1573732431.376200: Received error from KDC: -1765328370/KDC has no support for encryption type
[355090] 1573732431.376201: Getting initial credentials for user/example2@EXAMPLE2.COM
[355090] 1573732431.376202: Looked up etypes in keytab: aes256-cts,des-cbc-crc
[355090] 1573732431.376204: Sending unauthenticated request
[355090] 1573732431.376205: Sending request (201 bytes) to EXAMPLE2.COM (master)
kinit: KDC has no support for encryption type while getting initial credentials
实际上，我没有读到有关它需要不同端口的信息，因此我对其进行了修改，以便使用61321，但它没有推高该端口上的任何套接字，它只是推了默认端口88（Im asuming用于该端口）第一（也是默认）领域： {kdc = server.example2.com:61321 admin_server = server.example2.com:61321
root@example1.com：/ root＃netstat -netapl | grep LISTEN | grep krb tcp 0 0 0.0.0.0:88 0.0.0.0:* LISTEN 0 9326395 362136 / krb5kdc tcp6 0 0 ::: 88 ::: *监听0 9326396 362136 / krb5kdc root@example1.com：/ root＃ps -ef | grep -i krb 根362136 1 0 13:04 00:00:00 / usr / sbin / krb5kdc -P /var/run/krb5kdc.pid -r Example1.COM -r Example2.COM 根363981 331025 0 13:08 pts / 0 00:00:00 grep --color = auto -i krb