问题[samba](computer)

我想运行 Samba ADDC。我在路由器（带有bind和isc-dhcp的linux）上配置了网络，它管理一些子网（LAN / WAN / DMZ /等）。

我想在一个子网上创建 ADDC，但我想在同一子网中拥有一些其他设备。我有该子网的名称“.subnet.intranet”，以及内部的一些设备。Samba ADDC 有自己的 DNS 服务器，我可以同时使用这两个 DNS 吗？仅 ADDC 需要其他或不同的子网名称吗？我需要为 ADDC 创建单独的 VLAN 和子网吗？我有 IPcam、打印机和其他一些非 Windows 设备。它可以成为该域的一部分（在同一子网中），还是需要我将其移到外部，或者正确的方法是什么？

有人可以解释一下如何使用“混合”设备建立网络的正确方法吗？

当我将带有 ADDC 的 PC 移到公司外部 (.subnet.intranet) 时会发生什么情况，我仍然可以在本地登录和工作（登录到域帐户并在将来处理本地文档，我为 samba 共享和 RDP 启用 openVPN）？

目前我使用 NT4 域 ant 工作正常，但我想升级到 ADDC。子网中的所有PC都是win10pro或win11pro。

环境

我有两台 Samba 服务器用作文件服务器。旧的运行 CentOS 7，新的运行 Rocky Linux，我正在努力淘汰旧的。我正在 Windows 10 上的 Office 2016 中打开相关文件。

问题：

每当我打开存储在两者中较新的一个上的任何 Office 文件时，Office 总是基于“此文件源自 Internet”在受保护的视图中打开它。这不会影响旧系统。两个系统位于同一工作组和同一子网中。我已将新系统的网络驱动器名称添加到信任中心的受信任位置，但它仍然向我显示此消息。

期望的状态：

我希望将服务器识别为本地网络的一部分，这样我就不必每次需要编辑文档时都关闭保护模式。

我正在审查远程 Samba 服务器提供的本地目录的权限。服务器本身是 Linux (Ubuntu 16.04)。本机是Centos 7，运行时getcifsacl得到数据，例如下面返回。我从未见过这样的 SID，它们不一定与其中的内容相匹配man setcifsacl.

Samba 服务器安全性是 ADS。

REVISION:0x1
CONTROL:0x9004
OWNER:S-1-5-21-107619651-339024737-1120166462-8298
GROUP:S-1-22-2-48
ACL:S-1-5-21-107619651-339024737-1120166462-3274:ALLOWED/OI|CI/FULL
ACL:S-1-5-21-107619651-339024737-1120166462-512:ALLOWED/OI|CI/FULL
ACL:S-1-5-21-107619651-339024737-1120166462-10452:ALLOWED/OI|CI/READ
ACL:S-1-22-1-10403:ALLOWED/OI|CI/FULL
ACL:S-1-22-1-10387:ALLOWED/OI|CI/READ
ACL:S-1-22-1-10369:ALLOWED/OI|CI/READ
ACL:S-1-22-1-10111:ALLOWED/OI|CI/READ
ACL:S-1-5-21-107619651-339024737-1120166462-1480:ALLOWED/OI|CI/READ
ACL:Everyone@WORLD AUTHORITY:ALLOWED/OI|CI/
ACL:S-1-5-21-107619651-339024737-1120166462-8298:ALLOWED/0x0/FULL
ACL:S-1-5-21-107619651-339024737-1120166462-10315:ALLOWED/0x0/READ
ACL:S-1-22-2-48:ALLOWED/0x0/FULL
ACL:S-1-22-1-10298:ALLOWED/0x0/READ
ACL:S-1-5-21-107619651-339024737-1120166462-4073:ALLOWED/0x0/READ
ACL:CREATOR OWNER@CREATOR AUTHORITY:ALLOWED/OI|CI|IO/FULL
ACL:CREATOR GROUP@CREATOR AUTHORITY:ALLOWED/OI|CI|IO/FULL
ACL:S-1-22-1-10298:ALLOWED/OI|CI|IO/FULL
ACL:S-1-5-21-107619651-339024737-1120166462-4073:ALLOWED/OI|CI|IO/FULL

4组数字是什么？例如：所有者：S-1-5-21- 107619651-339024737-1120166462-8298

我假设它是某种类型的 UID，但它映射到谁以及在什么系统上？Samba 服务器还是 ADS？

具体对于我的用例，唯一可识别的是 GROUP 中的“48”，这是应该分配的 Linux 组的 GID。

手册页描述了很多，但是对于它没有涵盖的任何内容，您能否提供可以更详细地解释此输出的资源？

两周来一直试图解决一个问题，但没有成功。所以我会把它分解成更小的问题，希望能理解这个过程并找到解决方案。

我们有一个 Windows AD 域，其中一些 Linux (Debian) 客户端通过 sssd 加入。加入域的 Linux 客户端向 DC 服务器发送安全事件（事件 ID：4624、4768、4769、4770、4634、4661、4623）。所有事件都在 AD 上填充。所以设备正在通信。我们的问题在于这些事件中的一些值（字段）（例如，TargetUserName 显示主机名而不是用户名 - 我们需要它来显示用户名，以便我们的 SSO 代理可以读取用户状态）。

问题 1：Linux 客户端上的事件是如何/在哪里生成的？我想知道哪个文件生成了上述安全事件，以便我可以仔细查看并在需要时进行修改。

问题 2：Linux 客户端通过哪种方法告诉 KDC (AD) 域用户已登录/退出/处于活动状态/已更改组等？它是使用主机的 keytab (/etc/krb5.keytab) 进行通信还是使用 /tmp/krb5cc_**** _下生成的用户令牌文件？

如果需要，我可以在此处提供 sssd、smbclient、krb5 任何配置文件。

免责声明：
我仍在尝试充分学习和了解如何正确维护 samba 域控制器。

问题：

我有一个带有 AD 控制的工作 samba 安装，但现在，就在我最后一台计算机加入一个月后，它不再工作了。在 Windows 上，它显示“未知用户或密码”，但我已检查它们是否正确。

我尝试在“smb.conf”中将日志级别设置为 3，并且在尝试加入计算机时会记录下来：

[2022/10/04 12:11:58.018256,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ [email protected] from ipv4:172.27.2.58:50124 for krbtgt/[email protected]
[2022/10/04 12:11:58.039839,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: 128
[2022/10/04 12:11:58.040080,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- [email protected]
[2022/10/04 12:11:58.040191,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- [email protected]
[2022/10/04 12:11:58.040341,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: No preauth found, returning PREAUTH-REQUIRED -- [email protected]
[2022/10/04 12:11:58.043598,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/04 12:11:58.054880,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ [email protected] from ipv4:172.27.2.58:50125 for krbtgt/[email protected]
[2022/10/04 12:11:58.076255,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: encrypted-timestamp, 128
[2022/10/04 12:11:58.076483,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- [email protected]
[2022/10/04 12:11:58.076587,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- [email protected]
[2022/10/04 12:11:58.077527,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: ENC-TS Pre-authentication succeeded -- [email protected] using aes256-cts-hmac-sha1-96
[2022/10/04 12:11:58.077840,  3] ../../auth/auth_log.c:635(log_authentication_event_human_readable)
  Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)]\[[email protected]] at [Tue, 04 Oct 2022 12:11:58.077747 CEST] with [aes256-cts-hmac-sha1-96] status [NT_STATUS_OK] workstation [(null)] remote host [ipv4:172.27.2.58:50125] became [EXAMPLE]\[admuser] [S-1-5-21-578677625-3635414378-1858279571-1104]. local host [NULL] 
  {"timestamp": "2022-10-04T12:11:58.086113+0200", "type": "Authentication", "Authentication": {"version": {"major": 1, "minor": 2}, "eventId": 4624, "logonId": "c61be2b0d84a3e12", "logonType": 3, "status": "NT_STATUS_OK", "localAddress": null, "remoteAddress": "ipv4:172.27.2.58:50125", "serviceDescription": "Kerberos KDC", "authDescription": "ENC-TS Pre-authentication", "clientDomain": null, "clientAccount": "[email protected]", "workstation": null, "becameAccount": "admuser", "becameDomain": "EXAMPLE", "becameSid": "S-1-5-21-578677625-3635414378-1858279571-1104", "mappedAccount": "admuser", "mappedDomain": "EXAMPLE", "netlogonComputer": null, "netlogonTrustAccount": null, "netlogonNegotiateFlags": "0x00000000", "netlogonSecureChannelType": 0, "netlogonTrustAccountSid": null, "passwordType": "aes256-cts-hmac-sha1-96", "duration": 31663}}
[2022/10/04 12:11:58.160727,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ authtime: 2022-10-04T12:11:58 starttime: unset endtime: 2022-10-04T22:11:58 renew till: 2022-10-11T12:11:58
[2022/10/04 12:11:58.161033,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, arcfour-hmac-md5, 24, -135, 3, using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96
[2022/10/04 12:11:58.161206,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Requested flags: renewable-ok, canonicalize, renewable, forwardable
[2022/10/04 12:11:58.165799,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/04 12:11:58.178036,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed to verify authenticator checksum: Decrypt integrity check failed for checksum type rsa-md5, key type aes256-cts-hmac-sha1-96
[2022/10/04 12:11:58.178282,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed parsing TGS-REQ from ipv4:172.27.2.58:50126

可以看到，这里报认证成功。到目前为止，它与此处的问题相同，因此我尝试了以下命令：

 root@SMBDC1:~# host -t SRV _ldap._tcp.example.net
    _ldap._tcp.example.net has SRV record 0 100 389 smbdc1.example.net.
 root@SMBDC1:~# host -t SRV _kerebros._udp.example.net
    Host _kerebros._udp.example.net not found: 3(NXDOMAIN)
 root@SMBDC1:~# host -t A focal.exapmle.net
    Host focal.example.net not found: 3(NXDOMAIN)
    
 root@SMBDC1:~# dig -t SRV _kerebros._udp.frankini.net
    
    ; <<>> DiG 9.16.1-Ubuntu <<>> -t SRV _kerebros._udp.frankini.net
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 138
    ;; flags: qr aa rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
    
    ;; QUESTION SECTION:
    ;_kerebros._udp.frankini.net.   IN      SRV
    
    ;; AUTHORITY SECTION:
    frankini.net.           3600    IN      SOA        
    smbdc1.frankini.net. hostmaster.        frankini.net. 55 900 600 86400 3600
    
    ;; Query time: 3 msec
    ;; SERVER: 172.27.1.1#53(172.27.1.1)
    ;; WHEN: Fri Oct 07 21:44:12 CEST 2022
    ;; MSG SIZE  rcvd: 99

这原本可行，但现在我得到“找不到主机”......可能会发生什么变化？

我的设置

router:     172.27.0.1
smbdc:      172.27.1.1
dns:        172.27.1.2

dhcp range: 172.27.2.2 - 172.27.2.254

Samba runs on an Orange Pi Zero and I connect to it through Putty and FileZilla

I route communication between the xxx.xxx.0.xxx, xxx.xxx.1.xxx and xxx.xxx.2.xxx ip ranges and set the network mask to be 255.255.0.0

系统

 OS:    Armbian 22.05.3 Focal with Linux 5.15.48-sunxi
 SAMBA: Samba version 4.13.17-Ubuntu

配置文件

# Global parameters
[global]
    dns forwarder = 172.27.1.2
    netbios name = SMBDC1
    realm = EXAMPLE.NET
    server role = active directory domain controller
    workgroup = EXAMPLE
    idmap_ldb:use rfc2307 = yes
    host msdfs = yes
    log level = 3

[sysvol]
    path = /var/lib/samba/sysvol
    read only = No

[netlogon]
    path = /var/lib/samba/sysvol/example.net/scripts
    read only = No

更新：

我制作了磁盘的映像作为备份，然后进行了一系列测试，但均未成功。所以我最终将图像恢复到磁盘上，现在突然这些命令起作用了：

root@SMBDC1:~# host -t SRV _ldap._tcp.example.net
    _ldap._tcp.example.net has SRV record 0 100 389 smbdc1.example.net.
root@SMBDC1:~# host -t SRV _kerberos._udp.example.net
    _kerberos._udp.example.net has SRV record 0 100 88 smbdc1.example.net.
root@SMBDC1:~# host -t A SMBDC1.example.net
    SMBDC1.example.net has address 172.27.1.4

所以现在的情况是这样的：

我使用我的域管理员用户而不是“管理员”将计算机“ TESTING-W11 ”添加到域中。它仅在我执行“[email protected]”而不是“user”时才有效，以前曾经工作过。如果有人问，是的，我也尝试过使用管理员，它只能作为“[email protected]”使用

计算机重新启动后，我尝试登录，但它显示错误的用户名或密码。

这是登录尝试的日志文件：

[2022/10/12 19:39:25.980185,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ user2@EXAMPLE from ipv4:172.27.2.26:50574 for krbtgt/EXAMPLE@EXAMPLE
[2022/10/12 19:39:26.008882,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: 128
[2022/10/12 19:39:26.009229,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- user2@EXAMPLE
[2022/10/12 19:39:26.009433,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- user2@EXAMPLE
[2022/10/12 19:39:26.009709,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: No preauth found, returning PREAUTH-REQUIRED -- user2@EXAMPLE
[2022/10/12 19:39:26.013190,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.024021,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ user2@EXAMPLE from ipv4:172.27.2.26:50575 for krbtgt/EXAMPLE@EXAMPLE
[2022/10/12 19:39:26.051743,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: encrypted-timestamp, 128
[2022/10/12 19:39:26.052093,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- user2@EXAMPLE
[2022/10/12 19:39:26.052302,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- user2@EXAMPLE
[2022/10/12 19:39:26.052948,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: ENC-TS Pre-authentication succeeded -- user2@EXAMPLE using aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.053349,  3] ../../auth/auth_log.c:635(log_authentication_event_human_readable)
  Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)]\ [user2@EXAMPLE] at [Wed, 12 Oct 2022 19:39:26.053205 CEST] with [aes256-cts-hmac-sha1-96] status [NT_STATUS_OK] workstation [(null)] remote host [ipv4:172.27.2.26:50575] became [EXAMPLE]\[user2] [S-1-5-21-578677625-3635414378-1858279571-1105]. local host [NULL] 
  {"timestamp": "2022-10-12T19:39:26.053767+0200", "type": "Authentication", "Authentication": {"version": {"major": 1, "minor": 2}, "eventId": 4624, "logonId": "d3433331ec6a5bf7", "logonType": 3, "status": "NT_STATUS_OK", "localAddress": null, "remoteAddress": "ipv4:172.27.2.26:50575", "serviceDescription": "Kerberos KDC", "authDescription": "ENC-TS Pre-authentication", "clientDomain": null, "clientAccount": "user2@EXAMPLE", "workstation": null, "becameAccount": "user2", "becameDomain": "EXAMPLE", "becameSid": "S-1-5-21-578677625-3635414378-1858279571-1105", "mappedAccount": "user2", "mappedDomain": "EXAMPLE", "netlogonComputer": null, "netlogonTrustAccount": null, "netlogonNegotiateFlags": "0x00000000", "netlogonSecureChannelType": 0, "netlogonTrustAccountSid": null, "passwordType": "aes256-cts-hmac-sha1-96", "duration": 30203}}
[2022/10/12 19:39:26.089947,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ authtime: 2022-10-12T19:39:26 starttime: unset endtime: 2022-10-13T05:39:26 renew till: 2022-10-19T19:39:26
[2022/10/12 19:39:26.090338,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, arcfour-hmac-md5, 24, -135, 3, using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.090474,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Requested flags: renewable-ok, canonicalize, renewable, forwardable
[2022/10/12 19:39:26.097520,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.106943,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed to verify authenticator checksum: Decrypt integrity check failed for checksum type rsa-md5, key type aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.107170,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed parsing TGS-REQ from ipv4:172.27.2.26:50576
[2022/10/12 19:39:26.110456,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.114239,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ [email protected] from ipv4:172.27.2.26:50577 for krbtgt/[email protected]
[2022/10/12 19:39:26.127198,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: 128
[2022/10/12 19:39:26.127410,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- [email protected]
[2022/10/12 19:39:26.127580,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- [email protected]
[2022/10/12 19:39:26.127768,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: No preauth found, returning PREAUTH-REQUIRED -- [email protected]
[2022/10/12 19:39:26.130816,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.140450,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ [email protected] from ipv4:172.27.2.26:50578 for krbtgt/[email protected]
[2022/10/12 19:39:26.152897,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: encrypted-timestamp, 128
[2022/10/12 19:39:26.153102,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- [email protected]
[2022/10/12 19:39:26.153210,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- [email protected]
[2022/10/12 19:39:26.153583,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: ENC-TS Pre-authentication succeeded -- [email protected] using aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.153816,  3] ../../auth/auth_log.c:635(log_authentication_event_human_readable)
  Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)]\[[email protected]] at [Wed, 12 Oct 2022 19:39:26.153732 CEST] with [aes256-cts-hmac-sha1-96] status [NT_STATUS_OK] workstation [(null)] remote host [ipv4:172.27.2.26:50578] became [EXAMPLE]\[user2] [S-1-5-21-578677625-3635414378-1858279571-1105]. local host [NULL]
  {"timestamp": "2022-10-12T19:39:26.154039+0200", "type": "Authentication", "Authentication": {"version": {"major": 1, "minor": 2}, "eventId": 4624, "logonId": "869dfe1fc68f82a8", "logonType": 3, "status": "NT_STATUS_OK", "localAddress": null, "remoteAddress": "ipv4:172.27.2.26:50578", "serviceDescription": "Kerberos KDC", "authDescription": "ENC-TS Pre-authentication", "clientDomain": null, "clientAccount": "[email protected]", "workstation": null, "becameAccount": "user2", "becameDomain": "EXAMPLE", "becameSid": "S-1-5-21-578677625-3635414378-1858279571-1105", "mappedAccount": "user2", "mappedDomain": "EXAMPLE", "netlogonComputer": null, "netlogonTrustAccount": null, "netlogonNegotiateFlags": "0x00000000", "netlogonSecureChannelType": 0, "netlogonTrustAccountSid": null, "passwordType": "aes256-cts-hmac-sha1-96", "duration": 13913}}
[2022/10/12 19:39:26.182189,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ authtime: 2022-10-12T19:39:26 starttime: unset endtime: 2022-10-13T05:39:26 renew till: 2022-10-19T19:39:26
[2022/10/12 19:39:26.182483,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, arcfour-hmac-md5, 24, -135, 3, using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.182612,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Requested flags: renewable-ok, canonicalize, renewable, forwardable
[2022/10/12 19:39:26.187831,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.197162,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed to verify authenticator checksum: Decrypt integrity check failed for checksum type rsa-md5, key type aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.197385,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed parsing TGS-REQ from ipv4:172.27.2.26:50579
[2022/10/12 19:39:26.202216,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.206268,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ [email protected] from ipv4:172.27.2.26:50580 for krbtgt/[email protected]
[2022/10/12 19:39:26.218896,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: 128
[2022/10/12 19:39:26.219112,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- [email protected]
[2022/10/12 19:39:26.219220,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- [email protected]
[2022/10/12 19:39:26.219367,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: No preauth found, returning PREAUTH-REQUIRED -- [email protected]
[2022/10/12 19:39:26.226212,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.236585,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ [email protected] from ipv4:172.27.2.26:50581 for krbtgt/[email protected]
[2022/10/12 19:39:26.249060,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: encrypted-timestamp, 128
[2022/10/12 19:39:26.249272,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- [email protected]
[2022/10/12 19:39:26.249377,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- [email protected]
[2022/10/12 19:39:26.249842,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: ENC-TS Pre-authentication succeeded -- [email protected] using aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.250084,  3] ../../auth/auth_log.c:635(log_authentication_event_human_readable)
  Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)]\[[email protected]] at [Wed, 12 Oct 2022 19:39:26.250002 CEST] with [aes256-cts-hmac-sha1-96] status [NT_STATUS_OK] workstation [(null)] remote host [ipv4:172.27.2.26:50581] became [EXAMPLE]\[user2] [S-1-5-21-578677625-3635414378-1858279571-1105]. local host [NULL] 
  {"timestamp": "2022-10-12T19:39:26.250309+0200", "type": "Authentication", "Authentication": {"version": {"major": 1, "minor": 2}, "eventId": 4624, "logonId": "b111aea5f91526ac", "logonType": 3, "status": "NT_STATUS_OK", "localAddress": null, "remoteAddress": "ipv4:172.27.2.26:50581", "serviceDescription": "Kerberos KDC", "authDescription": "ENC-TS Pre-authentication", "clientDomain": null, "clientAccount": "[email protected]", "workstation": null, "becameAccount": "user2", "becameDomain": "EXAMPLE", "becameSid": "S-1-5-21-578677625-3635414378-1858279571-1105", "mappedAccount": "user2", "mappedDomain": "EXAMPLE", "netlogonComputer": null, "netlogonTrustAccount": null, "netlogonNegotiateFlags": "0x00000000", "netlogonSecureChannelType": 0, "netlogonTrustAccountSid": null, "passwordType": "aes256-cts-hmac-sha1-96", "duration": 13999}}
[2022/10/12 19:39:26.278425,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ authtime: 2022-10-12T19:39:26 starttime: unset endtime: 2022-10-13T05:39:26 renew till: 2022-10-19T19:39:26
[2022/10/12 19:39:26.278721,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, arcfour-hmac-md5, 24, -135, 3, using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.278850,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Requested flags: renewable-ok, canonicalize, renewable, forwardable
[2022/10/12 19:39:26.284069,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.293333,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed to verify authenticator checksum: Decrypt integrity check failed for checksum type rsa-md5, key type aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.293567,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed parsing TGS-REQ from ipv4:172.27.2.26:50582
[2022/10/12 19:39:26.297119,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.301280,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ [email protected] from ipv4:172.27.2.26:50583 for krbtgt/[email protected]
[2022/10/12 19:39:26.314043,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: 128
[2022/10/12 19:39:26.314253,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- [email protected]
[2022/10/12 19:39:26.314361,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- [email protected]
[2022/10/12 19:39:26.314507,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: No preauth found, returning PREAUTH-REQUIRED -- [email protected]
[2022/10/12 19:39:26.317995,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.328064,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ [email protected] from ipv4:172.27.2.26:50584 for krbtgt/[email protected]
[2022/10/12 19:39:26.340620,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: encrypted-timestamp, 128
[2022/10/12 19:39:26.340832,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- [email protected]
[2022/10/12 19:39:26.340934,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- [email protected]
[2022/10/12 19:39:26.341304,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: ENC-TS Pre-authentication succeeded -- [email protected] using aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.341534,  3] ../../auth/auth_log.c:635(log_authentication_event_human_readable)
  Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)]\[[email protected]] at [Wed, 12 Oct 2022 19:39:26.341453 CEST] with [aes256-cts-hmac-sha1-96] status [NT_STATUS_OK] workstation [(null)] remote host [ipv4:172.27.2.26:50584] became [EXAMPLE]\[user2] [S-1-5-21-578677625-3635414378-1858279571-1105]. local host [NULL] 
  {"timestamp": "2022-10-12T19:39:26.341761+0200", "type": "Authentication", "Authentication": {"version": {"major": 1, "minor": 2}, "eventId": 4624, "logonId": "4baa7d35daccf446", "logonType": 3, "status": "NT_STATUS_OK", "localAddress": null, "remoteAddress": "ipv4:172.27.2.26:50584", "serviceDescription": "Kerberos KDC", "authDescription": "ENC-TS Pre-authentication", "clientDomain": null, "clientAccount": "[email protected]", "workstation": null, "becameAccount": "user2", "becameDomain": "EXAMPLE", "becameSid": "S-1-5-21-578677625-3635414378-1858279571-1105", "mappedAccount": "user2", "mappedDomain": "EXAMPLE", "netlogonComputer": null, "netlogonTrustAccount": null, "netlogonNegotiateFlags": "0x00000000", "netlogonSecureChannelType": 0, "netlogonTrustAccountSid": null, "passwordType": "aes256-cts-hmac-sha1-96", "duration": 13987}}
[2022/10/12 19:39:26.369985,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ authtime: 2022-10-12T19:39:26 starttime: unset endtime: 2022-10-13T05:39:26 renew till: 2022-10-19T19:39:26
[2022/10/12 19:39:26.370274,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, arcfour-hmac-md5, 24, -135, 3, using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.370405,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Requested flags: renewable-ok, canonicalize, renewable, forwardable
[2022/10/12 19:39:26.375775,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.385121,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed to verify authenticator checksum: Decrypt integrity check failed for checksum type rsa-md5, key type aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.385343,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed parsing TGS-REQ from ipv4:172.27.2.26:50585
[2022/10/12 19:39:26.388686,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'

日志文件有问题吗？

我想知道您需要做什么才能看到映射到 pi 的 samba 网络驱动器上的点文件。如果我touch test123在我的 pi 上执行 a ，我可以在我的 windows 10 机器上看到这个文件，但是如果我执行 a touch .test123，这个文件不会出现：

pi@raspberrypi:~/devel/thermostat $ touch test123
pi@raspberrypi:~/devel/thermostat $ touch .test123

p:\devel\thermostat>dir test123
 Volume in drive P is pi
 Volume Serial Number is DB2B-A983

 Directory of p:\devel\thermostat

2022-04-16  03:42 PM                 0 test123
               1 File(s)              0 bytes
               0 Dir(s)  10,872,836,096 bytes free

p:\devel\thermostat>dir .test123
 Volume in drive P is pi
 Volume Serial Number is DB2B-A983

 Directory of p:\devel\thermostat

File Not Found

我的 smb.conf 文件包含以下内容：

[pihome]
  comment = Pi Home
  path=/home/pi
  browseable=Yes
  writeable=Yes
  only guest=no
  create mask=0777
  directory mask=0777
  read only=no
  public=no

有什么方法可以让我的 Windows 10 机器看到点文件？

在我的 Windows 上，我有我的 y: 映射到一个 samba 共享。在这个共享上，我可以读/写文件，即使我不被允许查看文件权限。

在我的 WSL Ubuntu-20.04 上，我尝试映射此驱动器：

$ sudo mount -t drvfs y: /mnt/test/ -o metadata,rw,noatime,uid=1000,gid=1000,umask=22,fmask=11

我可以访问此共享，甚至可以在其中写入新文件，但我无法对已存在的文件执行任何操作，因为权限未知

$ touch /mnt/test/outbox/test.txt
$ ls -la /mnt/test/outbox/
ls: cannot access '/mnt/test/outbox/foo.txt': Permission denied
drwxr-xr-x 1 myuser myuser 512 Jan 26 16:39 .
drwxr-xr-x 1 myuser myuser 512 Oct  7  2019 ..
-????????? ? ?       ?         ?            ? foo.txt
-rwxr--r-- 1 myuser myuser   0 Jan 26 17:05 test.txt

我该怎么做才能直接从我的 Ubuntu WSL 修改/删除我的 foo.txt？（就像我可以从我的 Windows 做的那样）

谢谢

我正在为我的 ubuntu 服务器 ( 20.04 LTS) 上已安装的 NAS 上的文件权限而苦苦挣扎。

NAS 驱动器是使用 cifs 安装的，并且/etc/fstab：

sudo nano /etc/fstab:

//PiNAS/PiNASdrive /media/PiNAS cifs vers=3.0,credentials=/home/USERNAME/.secrets/.smbdPiNAScredentials,nodev,nosuid,uid=1000,gid=1000 0 0

权限是：

stat /media/PiNAS/:

File: /media/PiNAS/
  Size: 0               Blocks: 0          IO Block: 1048576 directory
Device: 33h/51d Inode: 2           Links: 2
Access: (0755/drwxr-xr-x)  Uid: ( 1000/    xxxx)   Gid: ( 1000/    xxxx)

当我尝试更改权限时sudo chmod -R 0770 /media/PiNAS，文件权限未更改。

当我尝试设置 NextCloud docker 容器时，这是一个问题，因为 NextCloud webapp 在安装过程中告诉我：

'请将权限更改为0770，以使该目录不能被其他用户列出。'

我可以一致地更改文件权限吗？ 或者这是一个 docker 问题，我是否必须对 docker 容器内的文件权限做一些事情（NAS 驱动器上有一个文件夹，该文件夹映射为 docker 容器中的一个卷）

在树莓派 4 上设置；NAS 设备

为了完整起见，以下是 NAS 设备的设置方式：

我有一个带有两个 USB 驱动器的树莓派 4。我曾经mdadm创建一个简单的“RAID1”阵列：

sudo mdadm --detail /dev/md0
/dev/md0:
           Version : 1.2
     Creation Time : Thu Feb 18 20:37:27 2021
        Raid Level : raid1
        Array Size : 1953381440 (1862.89 GiB 2000.26 GB)
     Used Dev Size : 1953381440 (1862.89 GiB 2000.26 GB)
      Raid Devices : 2
     Total Devices : 2
       Persistence : Superblock is persistent

     Intent Bitmap : Internal

       Update Time : Mon Jul 19 21:38:53 2021
             State : clean
    Active Devices : 2
   Working Devices : 2
    Failed Devices : 0
     Spare Devices : 0

Consistency Policy : bitmap

              Name : PiNAS:0  (local to host PiNAS)
              UUID : d0b5192e:3b2b1fd7:f43639bb:e041cac6
            Events : 51229

    Number   Major   Minor   RaidDevice State
       0       8        1        0      active sync   /dev/sda1
       1       8       17        1      active sync   /dev/sdb1

该驱动器使用以下方式安装/etc/fstab：

UUID="1655887b-96c2-40dd-80e2-87e2fdce83c6" /media/USB12 ext4 defaults 0 0

然后通过 samba 共享

nano /etc/samba/smb.conf:

<snip>
[PiNASdrive]
path = /media/USB12
writeable=Yes
create mask=0770
directory mask=0770
public=no

我在我的服务器 (Pi4) 上设置 docker samba 服务器 (dperspon/samba) 时遇到问题。可写的 samba 共享似乎是只读的。但是行为很奇怪。当我使用 MacOS Finder 将文件放入共享时，会创建一个文件，但它保持为空。操作失败，并显示以下注释The operation could not be completed because an unknown error occurred (error -50)。使用 CLI 一切都很好。存储（/媒体/数据）是 ExFat 格式的。以下撰写文件有什么问题？

  samba:
    image: dperson/samba
    container_name: samba
    command: -g "log level = 2" -u "root;PASSWORD" -s "all;/smb/all;yes;no;no;root"
    volumes:
      - /media/data:/smb/all
    environment:
      - TZ=Europe/Berlin
      - WORKGROUP=media
      #- USERID=0
      #- GROUPID=0
    ports:
      - 139:139
      - 445:445
    restart: unless-stopped

这是容器中生成的 conf。

   pam password change = yes
   map to guest = bad user
   usershare allow guests = yes
   create mask = 0664
   force create mode = 0664
   directory mask = 0775
   force directory mode = 0775
   force user = smbuser
   force group = smb
   follow symlinks = yes
   load printers = no
   printing = bsd
   printcap name = /dev/null
   disable spoolss = yes
   strict locking = no
   aio read size = 0
   aio write size = 0
   vfs objects = catia fruit recycle streams_xattr
   recycle:keeptree = yes
   recycle:maxsize = 0
   recycle:repository = .deleted
   recycle:versions = yes

   # Security
   client ipc max protocol = SMB3
   client ipc min protocol = SMB2_10
   client max protocol = SMB3
   client min protocol = SMB2_10
   server max protocol = SMB3
   server min protocol = SMB2_10

   # Time Machine
   fruit:delete_empty_adfiles = yes
   fruit:time machine = yes
   fruit:veto_appledouble = no
   fruit:wipe_intentionally_left_blank_rfork = yes


[all]
   path = /smb/all
   browsable = yes
   read only = no
   guest ok = no
   veto files = /.apdisk/.DS_Store/.TemporaryItems/.Trashes/desktop.ini/ehthumbs.db/Network Trash Fold
   delete veto files = yes
   valid users = root

我正在将一个大型目录结构从 Web 服务器复制到 Windows。

这不是我需要像这样安装 SMB 1.0/CIFS 的常见原因：

看来这是一个常见的错误消息，有许多不同的原因。