Início / server / Perguntas / 890495
Accepted
Mat
Asked: 2018-01-04 02:45:53 +0800 CST

Ingressando em um servidor Ubuntu como controlador de domínio adicional

  • 772

Estou tentando ingressar em um novo servidor Ubuntu 16.04 LTS como um controlador de domínio adicional, mas estou enfrentando alguns problemas.

O controlador de domínio primário existente é outro servidor Ubuntu 16.04 LTS e a versão do Samba é a mesma em ambos os servidores:

root@server-z1:/# samba -V
Version 4.6.7-Ubuntu

root@server-z2:/# samba -V
Version 4.6.7-Ubuntu

O DNS parece estar funcionando corretamente em server-z2:

root@server-z2:/# nslookup my.domain.name
Server:     192.168.70.201
Address:    192.168.70.201#53

Name:   my.domain.name
Address: 192.168.70.202
Name:   my.domain.name
Address: 192.168.70.201

root@server-z2:/# nslookup server-z1.my.domain.name
Server:     192.168.70.201
Address:    192.168.70.201#53

Name:   server-z1.my.domain.name
Address: 192.168.70.201

O tíquete inicial do Kerberos parece ter sido adquirido corretamente:

root@server-z2:/# kinit me
[email protected]'s Password: 
root@server-z2:/# klist
Credentials cache: FILE:/tmp/krb5cc_0
        Principal: [email protected]

  Issued                Expires               Principal
Jan  3 11:37:55 2018  Jan  3 21:37:53 2018  krbtgt/[email protected]

Mas quando tento entrar no domínio, recebo o seguinte erro:

root@server-z2:/# samba-tool domain join MY.DOMAIN.NAME DC -U"DOMAIN\me" --dns-backend=BIND9_DLZ --server='192.168.70.201'
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'spnego' registered
GENSEC backend 'schannel' registered
GENSEC backend 'naclrpc_as_system' registered
GENSEC backend 'sasl-EXTERNAL' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'ntlmssp_resume_ccache' registered
GENSEC backend 'http_basic' registered
GENSEC backend 'http_ntlm' registered
GENSEC backend 'krb5' registered
GENSEC backend 'fake_gssapi_krb5' registered
Cannot do GSSAPI to an IP address
Got challenge flags:
Got NTLMSSP neg_flags=0x62898235
Password for [DOMAIN\me]:
NTLMSSP: Set final flags:
Got NTLMSSP neg_flags=0x62088235
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088235
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088235
workgroup is DOMAIN
realm is my.domain.name
Adding CN=SERVER-Z2,OU=Domain Controllers,DC=my,DC=domain,DC=name
Adding CN=SERVER-Z2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=my,DC=domain,DC=name
Adding CN=NTDS Settings,CN=SERVER-Z2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=my,DC=domain,DC=name
Using binding ncacn_ip_tcp:192.168.70.201[,seal]
Cannot do GSSAPI to an IP address
Got challenge flags:
Got NTLMSSP neg_flags=0x62898235
NTLMSSP: Set final flags:
Got NTLMSSP neg_flags=0x62088235
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088235
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088235
Adding SPNs to CN=SERVER-Z2,OU=Domain Controllers,DC=my,DC=domain,DC=name
Setting account password for SERVER-Z2$
Enabling account
Adding DNS account CN=dns-SERVER-Z2,CN=Users,DC=my,DC=domain,DC=name with dns/ SPN
Setting account password for dns-SERVER-Z2
Calling bare provision
lpcfg_load: refreshing parameters from /etc/samba/smb.conf
Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up secrets.ldb
Setting up the registry
ldb_wrap open of hklm.ldb
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
partition_metadata: Migrating partition metadata: open of metadata.tdb gave: (null)
A Kerberos configuration suitable for Samba AD has been generated at /var/lib/samba/private/krb5.conf
Provision OK for domain DN DC=my,DC=domain,DC=name
Starting replication
Using binding ncacn_ip_tcp:192.168.70.201[,seal]
Cannot do GSSAPI to an IP address
Got challenge flags:
Got NTLMSSP neg_flags=0x62898235
NTLMSSP: Set final flags:
Got NTLMSSP neg_flags=0x62088235
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088235
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088235
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain,DC=name] objects[402/1610] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain,DC=name] objects[804/1610] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain,DC=name] objects[1206/1610] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain,DC=name] objects[1608/1610] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain,DC=name] objects[1610/1610] linked_values[0/0]
Analyze and apply schema objects
Replicated 1610 objects (0 linked attributes) for CN=Schema,CN=Configuration,DC=my,DC=domain,DC=name
Partition[CN=Configuration,DC=my,DC=domain,DC=name] objects[402/1686] linked_values[0/1]
Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=my,DC=domain,DC=name
Partition[CN=Configuration,DC=my,DC=domain,DC=name] objects[804/1686] linked_values[0/1]
Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=my,DC=domain,DC=name
Partition[CN=Configuration,DC=my,DC=domain,DC=name] objects[1206/1686] linked_values[0/1]
Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=my,DC=domain,DC=name
Partition[CN=Configuration,DC=my,DC=domain,DC=name] objects[1608/1686] linked_values[0/16]
Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=my,DC=domain,DC=name
Partition[CN=Configuration,DC=my,DC=domain,DC=name] objects[1686/1686] linked_values[48/48]
Replicated 78 objects (48 linked attributes) for CN=Configuration,DC=my,DC=domain,DC=name
Replicating critical objects from the base DN of the domain
Join failed - cleaning up
ldb_wrap open of secrets.ldb
Could not find machine account in secrets database: Failed to fetch machine account password for DOMAIN from both secrets.ldb (Could not find entry to match filter: '(&(flatname=DOMAIN)(objectclass=primaryDomain))' base: 'cn=Primary Domains': No such object: dsdb_search at ../source4/dsdb/common/util.c:4576) and from /var/lib/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
Deleted CN=SERVER-Z2,OU=Domain Controllers,DC=my,DC=domain,DC=name
Deleted CN=dns-SERVER-Z2,CN=Users,DC=my,DC=domain,DC=name
Deleted CN=NTDS Settings,CN=SERVER-Z2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=my,DC=domain,DC=name
Deleted CN=SERVER-Z2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=my,DC=domain,DC=name
ERROR(runtime): uncaught exception - (8409, 'WERR_DS_DATABASE_ERROR')
  File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line 176, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python2.7/dist-packages/samba/netcmd/domain.py", line 661, in run
    machinepass=machinepass, use_ntvfs=use_ntvfs, dns_backend=dns_backend)
  File "/usr/lib/python2.7/dist-packages/samba/join.py", line 1269, in join_DC
    ctx.do_join()
  File "/usr/lib/python2.7/dist-packages/samba/join.py", line 1177, in do_join
    ctx.join_replicate()
  File "/usr/lib/python2.7/dist-packages/samba/join.py", line 903, in join_replicate
    replica_flags=ctx.domain_replica_flags)
  File "/usr/lib/python2.7/dist-packages/samba/drs_utils.py", line 254, in replicate
    (level, ctr) = self.drs.DsGetNCChanges(self.drs_handle, req_level, req)

Eu pesquisei e tentei todas as soluções que encontrei, nada ajudou.

Você poderia me ajudar por favor?

Muito obrigado!

ubuntu

1 respostas

  1. Best Answer

    O comando a seguir no controlador de domínio primário server-z1 existente resolveu meu problema:

    samba-tool dbcheck --fix

    Depois disso, consegui ingressar no controlador de domínio adicional server-z2 sem erros.

    Obrigado!

    • 1

relate perguntas