Ubuntu

加入 Ubuntu 伺服器作為附加域控制器

  • January 3, 2018

我正在嘗試加入新的 Ubuntu 16.04 LTS 伺服器作為附加域控制器，但我遇到了一些問題。

現有的主域控制器是另一個 Ubuntu 16.04 LTS 伺服器，兩個伺服器上的 Samba 版本相同：

root@server-z1:/# samba -V
Version 4.6.7-Ubuntu

root@server-z2:/# samba -V
Version 4.6.7-Ubuntu

DNS 似乎可以正常工作server-z2：

root@server-z2:/# nslookup my.domain.name
Server:     192.168.70.201
Address:    192.168.70.201#53

Name:   my.domain.name
Address: 192.168.70.202
Name:   my.domain.name
Address: 192.168.70.201

root@server-z2:/# nslookup server-z1.my.domain.name
Server:     192.168.70.201
Address:    192.168.70.201#53

Name:   server-z1.my.domain.name
Address: 192.168.70.201

Kerberos 初始票證似乎已正確獲取：

root@server-z2:/# kinit me
ne@MY.DOMAIN.NAME's Password: 
root@server-z2:/# klist
Credentials cache: FILE:/tmp/krb5cc_0
       Principal: me@MY.DOMAIN.NAME

 Issued                Expires               Principal
Jan  3 11:37:55 2018  Jan  3 21:37:53 2018  krbtgt/MY.DOMAIN.NAME@MY.DOMAIN.NAME

但是當我嘗試加入域時，出現以下錯誤：

root@server-z2:/# samba-tool domain join MY.DOMAIN.NAME DC -U"DOMAIN\me" --dns-backend=BIND9_DLZ --server='192.168.70.201'
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'spnego' registered
GENSEC backend 'schannel' registered
GENSEC backend 'naclrpc_as_system' registered
GENSEC backend 'sasl-EXTERNAL' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'ntlmssp_resume_ccache' registered
GENSEC backend 'http_basic' registered
GENSEC backend 'http_ntlm' registered
GENSEC backend 'krb5' registered
GENSEC backend 'fake_gssapi_krb5' registered
Cannot do GSSAPI to an IP address
Got challenge flags:
Got NTLMSSP neg_flags=0x62898235
Password for [DOMAIN\me]:
NTLMSSP: Set final flags:
Got NTLMSSP neg_flags=0x62088235
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088235
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088235
workgroup is DOMAIN
realm is my.domain.name
Adding CN=SERVER-Z2,OU=Domain Controllers,DC=my,DC=domain,DC=name
Adding CN=SERVER-Z2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=my,DC=domain,DC=name
Adding CN=NTDS Settings,CN=SERVER-Z2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=my,DC=domain,DC=name
Using binding ncacn_ip_tcp:192.168.70.201[,seal]
Cannot do GSSAPI to an IP address
Got challenge flags:
Got NTLMSSP neg_flags=0x62898235
NTLMSSP: Set final flags:
Got NTLMSSP neg_flags=0x62088235
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088235
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088235
Adding SPNs to CN=SERVER-Z2,OU=Domain Controllers,DC=my,DC=domain,DC=name
Setting account password for SERVER-Z2$
Enabling account
Adding DNS account CN=dns-SERVER-Z2,CN=Users,DC=my,DC=domain,DC=name with dns/ SPN
Setting account password for dns-SERVER-Z2
Calling bare provision
lpcfg_load: refreshing parameters from /etc/samba/smb.conf
Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up secrets.ldb
Setting up the registry
ldb_wrap open of hklm.ldb
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
partition_metadata: Migrating partition metadata: open of metadata.tdb gave: (null)
A Kerberos configuration suitable for Samba AD has been generated at /var/lib/samba/private/krb5.conf
Provision OK for domain DN DC=my,DC=domain,DC=name
Starting replication
Using binding ncacn_ip_tcp:192.168.70.201[,seal]
Cannot do GSSAPI to an IP address
Got challenge flags:
Got NTLMSSP neg_flags=0x62898235
NTLMSSP: Set final flags:
Got NTLMSSP neg_flags=0x62088235
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088235
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088235
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain,DC=name] objects[402/1610] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain,DC=name] objects[804/1610] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain,DC=name] objects[1206/1610] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain,DC=name] objects[1608/1610] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain,DC=name] objects[1610/1610] linked_values[0/0]
Analyze and apply schema objects
Replicated 1610 objects (0 linked attributes) for CN=Schema,CN=Configuration,DC=my,DC=domain,DC=name
Partition[CN=Configuration,DC=my,DC=domain,DC=name] objects[402/1686] linked_values[0/1]
Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=my,DC=domain,DC=name
Partition[CN=Configuration,DC=my,DC=domain,DC=name] objects[804/1686] linked_values[0/1]
Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=my,DC=domain,DC=name
Partition[CN=Configuration,DC=my,DC=domain,DC=name] objects[1206/1686] linked_values[0/1]
Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=my,DC=domain,DC=name
Partition[CN=Configuration,DC=my,DC=domain,DC=name] objects[1608/1686] linked_values[0/16]
Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=my,DC=domain,DC=name
Partition[CN=Configuration,DC=my,DC=domain,DC=name] objects[1686/1686] linked_values[48/48]
Replicated 78 objects (48 linked attributes) for CN=Configuration,DC=my,DC=domain,DC=name
Replicating critical objects from the base DN of the domain
Join failed - cleaning up
ldb_wrap open of secrets.ldb
Could not find machine account in secrets database: Failed to fetch machine account password for DOMAIN from both secrets.ldb (Could not find entry to match filter: '(&(flatname=DOMAIN)(objectclass=primaryDomain))' base: 'cn=Primary Domains': No such object: dsdb_search at ../source4/dsdb/common/util.c:4576) and from /var/lib/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
Deleted CN=SERVER-Z2,OU=Domain Controllers,DC=my,DC=domain,DC=name
Deleted CN=dns-SERVER-Z2,CN=Users,DC=my,DC=domain,DC=name
Deleted CN=NTDS Settings,CN=SERVER-Z2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=my,DC=domain,DC=name
Deleted CN=SERVER-Z2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=my,DC=domain,DC=name
ERROR(runtime): uncaught exception - (8409, 'WERR_DS_DATABASE_ERROR')
 File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line 176, in _run
   return self.run(*args, **kwargs)
 File "/usr/lib/python2.7/dist-packages/samba/netcmd/domain.py", line 661, in run
   machinepass=machinepass, use_ntvfs=use_ntvfs, dns_backend=dns_backend)
 File "/usr/lib/python2.7/dist-packages/samba/join.py", line 1269, in join_DC
   ctx.do_join()
 File "/usr/lib/python2.7/dist-packages/samba/join.py", line 1177, in do_join
   ctx.join_replicate()
 File "/usr/lib/python2.7/dist-packages/samba/join.py", line 903, in join_replicate
   replica_flags=ctx.domain_replica_flags)
 File "/usr/lib/python2.7/dist-packages/samba/drs_utils.py", line 254, in replicate
   (level, ctr) = self.drs.DsGetNCChanges(self.drs_handle, req_level, req)

我用Google搜尋並嘗試了所有找到的解決方案，但沒有任何幫助。

請問你能幫幫我嗎？

非常感謝！

現有主域控制器 server-z1 上的以下命令解決了我的問題：

samba-tool dbcheck --fix

之後，我能夠毫無錯誤地加入額外的域控制器 server-z2。

謝謝！

引用自：https://serverfault.com/questions/890495

相關問答

Ubuntu

針對 samba 4 DC 的密鑰表身份驗證：獲取初始憑據時在 Kerberos 數據庫中找不到客戶端

  • September 2, 2015
檢視問答
Ubuntu

如何更改 Samba4 AD 領域

  • August 9, 2014
檢視問答
Ubuntu

Samba 域控制器- 是否需要DNS？

  • August 8, 2010
檢視問答
Ubuntu

Ubuntu 22.04 ActiveDirectory 密碼同步

  • November 8, 2022
檢視問答
Windows

如何正確徹底地刪除 Windows 域控制器？

  • December 23, 2021
檢視問答
Ubuntu

子/子 AD 域的 Ubuntu SSSD 身份驗證錯誤

  • October 26, 2021
檢視問答