Installazione di Samba AD

[Dohakor]

In genere, per i miei test preferisco sempre avere lo stesso tipo di installazione:

- Raspbian: versione lite con solo SSH abilitato
- Debian: versione "small installation image" con il minimo indispensabile ("SSH" e "utility di sistema usuali")

Aggiungerò le righe al file e vi terrò informati

. Grazie.

[Dohakor]

Ho provato ma niente:

Codice: Seleziona tutto

root@srvads:~# kinit administrator
kinit: Cannot contact any KDC for realm 'DOHAKOR.LAN' while getting initial credentials
root@srvads:~# klist
klist: No credentials cache found (filename: /tmp/krb5cc_0)

E dopo aver aggiunto la tua modifica, ho la seguente parte:

Codice: Seleziona tutto

search dohakor.lan
nameserver 127.0.0.1

Che non viene più eliminato dal file /etc/resolv.conf

[Dohakor]

Finalmente sono riuscito a lanciare il comando Amministratore di kinit E klist !!!!!!

Ho guardato questo post ===> https://serverfault.com/questions/16676 ... getting-in

Quindi ho modificato il mio file /etc/krb5.conf per spostarsi da:

Codice: Seleziona tutto

[libdefaults]
        default_realm = DOHAKOR.LAN
        dns_lookup_realm = false
        dns_lookup_kdc = true

ha

Codice: Seleziona tutto

[libdefaults]
        default_realm = DOHAKOR.LAN
        dns_lookup_realm = false
        dns_lookup_kdc = true

[realms]
    DOHAKOR.LAN = {
        kdc = srvads.dohakor.lan
        admin_server = srvads.dohakor.lan
    }

E ora funziona!

Tuttavia, è strano perché nel tuo documento è chiaramente scritto Modifica il file /etc/krb5.conf e sostituisci l'intero contenuto con le seguenti 4 righe, specificando il dominio Active Directory della tua organizzazione .

Un'altra domanda mi tormenta: quando eseguo il comando klist, ottengo questo:

Codice: Seleziona tutto

Ticket cache: FILE:/tmp/krb5cc_0
Default principal: administrator@DOHAKOR.LAN

Valid starting       Expires              Service principal
05/15/2020 16:42:06  05/16/2020 02:42:06  krbtgt/DOHAKOR.LAN@DOHAKOR.LAN
        renew until 05/16/2020 16:41:55

È normale avere DOHAKOR.LAN@DOHAKOR.LAN???

[dcardon]

Probabilmente hai un problema DNS con il tuo Samba AD. Il comando `samba_dnsupdate --use-samba-tool` funziona correttamente?

Cordiali saluti,

Denis

[Dohakor]

Ho provato il tuo comando ed ecco il risultato:

Codice: Seleziona tutto

root@srvads:~# samba_dnsupdate --use-samba-tool
Failed to get Kerberos credentials, falling back to samba-tool: kinit for SRVADS$@DOHAKOR.LAN failed (Cannot contact any KDC for requested realm)

ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 945, in run
    raise e
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 941, in run
    0, server, zone, name, add_rec_buf, None)
ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 945, in run
    raise e
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 941, in run
    0, server, zone, name, add_rec_buf, None)
ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 945, in run
    raise e
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 941, in run
    0, server, zone, name, add_rec_buf, None)
ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 945, in run
    raise e
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 941, in run
    0, server, zone, name, add_rec_buf, None)
ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 945, in run
    raise e
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 941, in run
    0, server, zone, name, add_rec_buf, None)
ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 945, in run
    raise e
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 941, in run
    0, server, zone, name, add_rec_buf, None)
ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 945, in run
    raise e
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 941, in run
    0, server, zone, name, add_rec_buf, None)
ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 945, in run
    raise e
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 941, in run
    0, server, zone, name, add_rec_buf, None)
ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 945, in run
    raise e
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 941, in run
    0, server, zone, name, add_rec_buf, None)
ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 945, in run
    raise e
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 941, in run
    0, server, zone, name, add_rec_buf, None)
ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 945, in run
    raise e
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 941, in run
    0, server, zone, name, add_rec_buf, None)
ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 945, in run
    raise e
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 941, in run
    0, server, zone, name, add_rec_buf, None)
ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 945, in run
    raise e
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 941, in run
    0, server, zone, name, add_rec_buf, None)
ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 945, in run
    raise e
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 941, in run
    0, server, zone, name, add_rec_buf, None)
ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 945, in run
    raise e
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 941, in run
    0, server, zone, name, add_rec_buf, None)
ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 945, in run
    raise e
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 941, in run
    0, server, zone, name, add_rec_buf, None)
ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 945, in run
    raise e
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 941, in run
    0, server, zone, name, add_rec_buf, None)
ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 945, in run
    raise e
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 941, in run
    0, server, zone, name, add_rec_buf, None)
ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 945, in run
    raise e
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 941, in run
    0, server, zone, name, add_rec_buf, None)
ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 945, in run
    raise e
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 941, in run
    0, server, zone, name, add_rec_buf, None)
Failed update of 20 entries

[Dohakor]

Buongiorno,

Ho cercato questo fine settimana e non sono riuscito a trovare un modo per risolvere questo problema DNS.

Inoltre, quando ho eseguito i comandi nella sezione Verifica DNS del wiki di Samba, ho ottenuto questo:

Codice: Seleziona tutto

root@srvads:~# host -t SRV _ldap._tcp.dohakor.lan
Host _ldap._tcp.dohakor.lan not found: 3(NXDOMAIN)
root@srvads:~# host -t SRV _ldap._tcp.srvads.dohakor.lan
Host _ldap._tcp.srvads.dohakor.lan not found: 3(NXDOMAIN)
root@srvads:~# host -t SRV _ldap._tcp.dohakor.lan.
Host _ldap._tcp.dohakor.lan. not found: 3(NXDOMAIN)
root@srvads:~# host -t SRV _kerberos._udp.dohakor.lan
Host _kerberos._udp.dohakor.lan not found: 3(NXDOMAIN)
root@srvads:~# host -t A srvads.dohakor.lan.
Host srvads.dohakor.lan. not found: 3(NXDOMAIN)

Purtroppo sono completamente perso.

Modificare:

Ho appena controllato lo stato di Samba ed ecco il risultato:

Codice: Seleziona tutto

root@srvads:~# service samba-ad-dc status
● samba-ad-dc.service - Samba AD Daemon
   Loaded: loaded (/lib/systemd/system/samba-ad-dc.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Mon 2020-05-18 11:24:38 CEST; 4min 45s ago
     Docs: man:samba(8)
           man:samba(7)
           man:smb.conf(5)
  Process: 375 ExecStart=/usr/sbin/samba --foreground --no-process-group $SAMBAOPTIONS (code=exited, status=1/FAILURE)
 Main PID: 375 (code=exited, status=1/FAILURE)

May 18 11:24:37 srvads.dohakor.lan systemd[1]: samba-ad-dc.service: Main process exited, code=exited, status=1/FAILURE
May 18 11:24:37 srvads.dohakor.lan samba[397]: task[dnsupdate][397]: [2020/05/18 11:24:37.698256,  0] ../../source4/smbd/process_standard.c:84(sigterm_signal_handler)
May 18 11:24:37 srvads.dohakor.lan samba[397]: task[dnsupdate][397]:   sigterm_signal_handler: Exiting pid 397 on SIGTERM
May 18 11:24:37 srvads.dohakor.lan samba[399]: task[dns][399]: [2020/05/18 11:24:37.725713,  0] ../../source4/smbd/process_standard.c:84(sigterm_signal_handler)
May 18 11:24:37 srvads.dohakor.lan samba[399]: task[dns][399]:   sigterm_signal_handler: Exiting pid 399 on SIGTERM
May 18 11:24:38 srvads.dohakor.lan samba[389]: task[ldapsrv][389]: [2020/05/18 11:24:38.466342,  0] ../../source4/smbd/process_standard.c:84(sigterm_signal_handler)
May 18 11:24:38 srvads.dohakor.lan samba[389]: task[ldapsrv][389]:   sigterm_signal_handler: Exiting pid 389 on SIGTERM
May 18 11:24:38 srvads.dohakor.lan systemd[1]: Failed to start Samba AD Daemon.
May 18 11:24:38 srvads.dohakor.lan systemd[1]: samba-ad-dc.service: Unit entered failed state.
May 18 11:24:38 srvads.dohakor.lan systemd[1]: samba-ad-dc.service: Failed with result 'exit-code'.

MODIFICA 2:

Ho riavviato il servizio manualmente:

Codice: Seleziona tutto

root@srvads:~# service samba-ad-dc stop
root@srvads:~# service samba-ad-dc start
root@srvads:~# service samba-ad-dc status

Quindi, dopo ho:

Codice: Seleziona tutto

root@srvads:~# service samba-ad-dc status
● samba-ad-dc.service - Samba AD Daemon
   Loaded: loaded (/lib/systemd/system/samba-ad-dc.service; enabled; vendor preset: enabled)
   Active: active (running) since Mon 2020-05-18 11:35:32 CEST; 5s ago
     Docs: man:samba(8)
           man:samba(7)
           man:smb.conf(5)
 Main PID: 755 (samba)
   Status: "smbd: ready to serve connections..."
    Tasks: 23 (limit: 4915)
   CGroup: /system.slice/samba-ad-dc.service
           ├─755 samba: root process
           ├─756 samba: task[s3fs_parent]
           ├─757 samba: task[dcesrv]
           ├─758 samba: task[nbtd]
           ├─759 samba: task[wrepl]
           ├─760 samba: task[ldapsrv]
           ├─761 samba: task[cldapd]
           ├─762 samba: task[kdc]
           ├─763 samba: task[dreplsrv]
           ├─764 samba: tfork waiter process
           ├─765 /usr/sbin/smbd -D --option=server role check:inhibit=yes --foreground
           ├─766 samba: task[winbindd_parent]
           ├─767 samba: task[ntp_signd]
           ├─768 samba: task[kccsrv]
           ├─769 samba: tfork waiter process
           ├─770 /usr/sbin/winbindd -D --option=server role check:inhibit=yes --foreground
           ├─771 samba: task[dnsupdate]
           ├─772 samba: task[dns]
           ├─773 samba: tfork waiter process
           ├─774 /usr/bin/python3 /usr/sbin/samba_dnsupdate
           ├─780 /usr/sbin/smbd -D --option=server role check:inhibit=yes --foreground
           ├─781 /usr/sbin/smbd -D --option=server role check:inhibit=yes --foreground
           └─782 /usr/sbin/smbd -D --option=server role check:inhibit=yes --foreground

May 18 11:35:28 srvads.dohakor.lan samba[755]: root process[755]:   Copyright Andrew Tridgell and the Samba Team 1992-2019
May 18 11:35:29 srvads.dohakor.lan samba[755]: root process[755]: [2020/05/18 11:35:29.544625,  0] ../../source4/smbd/server.c:773(binary_smbd_main)
May 18 11:35:29 srvads.dohakor.lan samba[755]: root process[755]:   binary_smbd_main: samba: using 'standard' process model
May 18 11:35:32 srvads.dohakor.lan winbindd[770]: [2020/05/18 11:35:32.467112,  0] ../../source3/winbindd/winbindd_cache.c:3166(initialize_winbindd_cache)
May 18 11:35:32 srvads.dohakor.lan winbindd[770]:   initialize_winbindd_cache: clearing cache and re-creating with version number 2
May 18 11:35:32 srvads.dohakor.lan systemd[1]: Started Samba AD Daemon.
May 18 11:35:32 srvads.dohakor.lan winbindd[770]: [2020/05/18 11:35:32.486989,  0] ../../lib/util/become_daemon.c:136(daemon_ready)
May 18 11:35:32 srvads.dohakor.lan winbindd[770]:   daemon_ready: daemon 'winbindd' finished starting up and ready to serve connections
May 18 11:35:32 srvads.dohakor.lan smbd[765]: [2020/05/18 11:35:32.569315,  0] ../../lib/util/become_daemon.c:136(daemon_ready)
May 18 11:35:32 srvads.dohakor.lan smbd[765]:   daemon_ready: daemon 'smbd' finished starting up and ready to serve connections

Ma continuo a ricevere l'errore dopo il comando samba_dnsupdate --use-samba-tool:

Codice: Seleziona tutto

root@srvads:~# samba_dnsupdate --use-samba-tool
Failed to get Kerberos credentials, falling back to samba-tool: kinit for SRVADS$@DOHAKOR.LAN failed (Cannot contact any KDC for requested realm)

ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 185, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 945, in run
    raise e
  File "/usr/lib/python3/dist-packages/samba/netcmd/dns.py", line 941, in run
    0, server, zone, name, add_rec_buf, None)

[dcardon]

La verifica del campo DNS è contenuta nella documentazione di Samba Tranquil.

C'è per caso qualcos'altro in ascolto sulla porta 53?

Codice: Seleziona tutto

netstat -tapn | grep 53

[Dohakor]

Sì, certo, con il comando dig. Non ho problemi con questo comando.

Ecco cosa ottengo:

Codice: Seleziona tutto

root@srvads:~# netstat -tapn | grep 53
tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN      772/samba: task[dns
tcp        0      0 0.0.0.0:49153           0.0.0.0:*               LISTEN      757/samba: task[dce
tcp6       0      0 :::53                   :::*                    LISTEN      772/samba: task[dns
tcp6       0      0 :::49153                :::*                    LISTEN      757/samba: task[dce

[dcardon]

Nel file /etc/samba/smb.conf hai configurato il tuo server come server di inoltro DNS... questo crea un loop, e probabilmente il processo Samba non lo gradisce.

Cordiali saluti,

Denis

[Dohakor]

In effetti, questa è la configurazione che avevo quando l'ho installato sul mio Raspberry Pi.

Sulla mia VM Debien 9, ecco i diversi file:

/etc/samba/smb.conf:

Codice: Seleziona tutto

# Global parameters
[global]
        dns forwarder = 192.168.1.1
        netbios name = SRVADS
        realm = DOHAKOR.LAN
        server role = active directory domain controller
        workgroup = DOHAKOR

[sysvol]
        path = /var/lib/samba/sysvol
        read only = No

[netlogon]
        path = /var/lib/samba/sysvol/dohakor.lan/scripts
        read only = No

/etc/krb5.conf:

Codice: Seleziona tutto

[libdefaults]
        default_realm = DOHAKOR.LAN
        dns_lookup_realm = false
        dns_lookup_kdc = true

[realms]
    DOHAKOR.LAN = {
        kdc = srvads.dohakor.lan
        admin_server = srvads.dohakor.lan
    }

/etc/nomehost:

Codice: Seleziona tutto

srvads.dohakor.lan

/etc/hosts:

Codice: Seleziona tutto

127.0.0.1       localhost
127.0.1.1       pc-47.home      pc-47

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

192.168.1.150   srvads.dohakor.lan      srvads
srvads.dohakor.lan

/etc/network/interfaces:

Codice: Seleziona tutto

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto enp0s3
iface enp0s3 inet static
  address 192.168.1.150/24
  gateway 192.168.1.1

# This is an autoconfigured IPv6 interface
iface enp0s3 inet6 auto