두 개의 Samba 4 도메인 컨트롤러로 관리되는 Active Directory에 가입한 새 Openmediavault 4 서버를 설치했습니다.
명세서:
- Active Directory 도메인내.광고.도메인두 개의 Samba 4 도메인 컨트롤러(server-z1.my.ad.domain (192.168.70.201)그리고server-z2.my.ad.domain (192.168.70.202)
- 하나의 파일 서버삼바 버전 4.5.12-데비안계속 달리다오픈미디어볼트 4.1.0-1(Debian 9 기반)
- 파일 서버의 IP 주소는 다음과 같습니다.192.168.70.171
- 파일 서버의 FQDN은 server-f1.my.ad.domain입니다.
- 파일 서버에 별칭이 있습니다.서버-f10.my.ad.domainDNS에 구성
- IP 주소(\192.168.70.171), FQDN(\server-f1.my.ad.domain) 및 DNS 별칭(\server-f10.my.ad.domain).
다음 가이드에 따라 SSSD를 사용하여 Openmediavault에 가입했습니다.https://forum.openmediavault.org/index.php/Thread/18886-Guide-how-to-join-OpenMediaVault-3-x-in-an-Active-Directory-domain/getent passwd, 재부팅 후에도 사용 중인 도메인 사용자를 나열할 수 있습니다 .
제가 가진 문제는 FQDN(\서버-f1또는\server-f1.my.ad.domain), 그러나 IP 주소(\192.168.70.171) 또는 DNS 별칭(\서버-f10또는\server-f10.my.ad.domain).
IP 주소 또는 DNS 별칭을 사용하여 액세스하면 Openmediavault 시스템에서 다음 오류가 발생합니다.
Mar 15 20:14:54 server-f1 smbd[21103]: [2018/03/15 20:14:54.956409, 2] ../source3/librpc/crypto/gse_krb5.c:229(fill_mem_keytab_from_secrets)
Mar 15 20:14:54 server-f1 smbd[21103]: ../source3/librpc/crypto/gse_krb5.c:229: failed to fetch machine password
Mar 15 20:14:54 server-f1 smbd[21103]: [2018/03/15 20:14:54.957928, 2] ../source3/librpc/crypto/gse_krb5.c:229(fill_mem_keytab_from_secrets)
Mar 15 20:14:54 server-f1 smbd[21103]: ../source3/librpc/crypto/gse_krb5.c:229: failed to fetch machine password
Mar 15 20:14:54 server-f1 smbd[21103]: [2018/03/15 20:14:54.961733, 1] ../lib/param/loadparm.c:1729(lpcfg_do_global_parameter)
Mar 15 20:14:54 server-f1 smbd[21103]: WARNING: The "syslog" option is deprecated
Mar 15 20:14:54 server-f1 smbd[21103]: [2018/03/15 20:14:54.961772, 1] ../lib/param/loadparm.c:1729(lpcfg_do_global_parameter)
Mar 15 20:14:54 server-f1 smbd[21103]: WARNING: The "syslog only" option is deprecated
Mar 15 20:14:54 server-f1 smbd[21103]: [2018/03/15 20:14:54.961984, 2] ../source3/param/loadparm.c:2685(lp_do_section)
Mar 15 20:14:54 server-f1 smbd[21103]: Processing section "[homes]"
Mar 15 20:14:57 server-f1 smbd[21103]: [2018/03/15 20:14:57.049955, 1] ../auth/credentials/credentials_secrets.c:410(cli_credentials_set_machine_account_db_ctx)
Mar 15 20:14:57 server-f1 smbd[21103]: Could not find machine account in secrets database: Failed to fetch machine account password for DOMAIN from both secrets.ldb (Could not find entry to match filter: '(&(flatname=DOMAIN)(objectclass=primaryDomain))' base: 'cn=Primary Domains': No such object: dsdb_search at ../source4/dsdb/common/util.c:4575) and from /var/lib/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
Mar 15 20:14:57 server-f1 smbd[21103]: [2018/03/15 20:14:57.050031, 0] ../source3/auth/auth_domain.c:121(connect_to_domain_password_server)
Mar 15 20:14:57 server-f1 smbd[21103]: connect_to_domain_password_server: unable to open the domain client session to machine SERVER-Z1.MY.AD.DOMAIN. Error was : NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
Mar 15 20:14:57 server-f1 smbd[21103]: [2018/03/15 20:14:57.081918, 1] ../auth/credentials/credentials_secrets.c:410(cli_credentials_set_machine_account_db_ctx)
Mar 15 20:14:57 server-f1 smbd[21103]: Could not find machine account in secrets database: Failed to fetch machine account password for DOMAIN from both secrets.ldb (Could not find entry to match filter: '(&(flatname=DOMAIN)(objectclass=primaryDomain))' base: 'cn=Primary Domains': No such object: dsdb_search at ../source4/dsdb/common/util.c:4575) and from /var/lib/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
Mar 15 20:14:57 server-f1 smbd[21103]: [2018/03/15 20:14:57.081968, 0] ../source3/auth/auth_domain.c:121(connect_to_domain_password_server)
Mar 15 20:14:57 server-f1 smbd[21103]: connect_to_domain_password_server: unable to open the domain client session to machine SERVER-Z1.MY.AD.DOMAIN. Error was : NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
Mar 15 20:14:57 server-f1 smbd[21103]: [2018/03/15 20:14:57.110632, 1] ../auth/credentials/credentials_secrets.c:410(cli_credentials_set_machine_account_db_ctx)
Mar 15 20:14:57 server-f1 smbd[21103]: Could not find machine account in secrets database: Failed to fetch machine account password for DOMAIN from both secrets.ldb (Could not find entry to match filter: '(&(flatname=DOMAIN)(objectclass=primaryDomain))' base: 'cn=Primary Domains': No such object: dsdb_search at ../source4/dsdb/common/util.c:4575) and from /var/lib/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
Mar 15 20:14:57 server-f1 smbd[21103]: [2018/03/15 20:14:57.110683, 0] ../source3/auth/auth_domain.c:121(connect_to_domain_password_server)
Mar 15 20:14:57 server-f1 smbd[21103]: connect_to_domain_password_server: unable to open the domain client session to machine SERVER-Z1.MY.AD.DOMAIN. Error was : NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
Mar 15 20:14:57 server-f1 smbd[21103]: [2018/03/15 20:14:57.112016, 0] ../source3/auth/auth_domain.c:184(domain_client_validate)
Mar 15 20:14:57 server-f1 smbd[21103]: domain_client_validate: Domain password server not available.
Mar 15 20:14:57 server-f1 smbd[21103]: [2018/03/15 20:14:57.112060, 2] ../source3/auth/auth.c:315(auth_check_ntlm_password)
Mar 15 20:14:57 server-f1 smbd[21103]: check_ntlm_password: Authentication for user [my.user] -> [my.user] FAILED with error NT_STATUS_NO_LOGON_SERVERS
Mar 15 20:14:57 server-f1 smbd[21103]: [2018/03/15 20:14:57.112088, 2] ../auth/gensec/spnego.c:720(gensec_spnego_server_negTokenTarg)
Mar 15 20:14:57 server-f1 smbd[21103]: SPNEGO login failed: NT_STATUS_NO_LOGON_SERVERS
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.121674, 2] ../source3/librpc/crypto/gse_krb5.c:229(fill_mem_keytab_from_secrets)
Mar 15 20:14:57 server-f1 smbd[21104]: ../source3/librpc/crypto/gse_krb5.c:229: failed to fetch machine password
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.125426, 1] ../lib/param/loadparm.c:1729(lpcfg_do_global_parameter)
Mar 15 20:14:57 server-f1 smbd[21104]: WARNING: The "syslog" option is deprecated
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.125460, 1] ../lib/param/loadparm.c:1729(lpcfg_do_global_parameter)
Mar 15 20:14:57 server-f1 smbd[21104]: WARNING: The "syslog only" option is deprecated
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.125698, 2] ../source3/param/loadparm.c:2685(lp_do_section)
Mar 15 20:14:57 server-f1 smbd[21104]: Processing section "[homes]"
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.197432, 1] ../auth/credentials/credentials_secrets.c:410(cli_credentials_set_machine_account_db_ctx)
Mar 15 20:14:57 server-f1 smbd[21104]: Could not find machine account in secrets database: Failed to fetch machine account password for DOMAIN from both secrets.ldb (Could not find entry to match filter: '(&(flatname=DOMAIN)(objectclass=primaryDomain))' base: 'cn=Primary Domains': No such object: dsdb_search at ../source4/dsdb/common/util.c:4575) and from /var/lib/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.197476, 0] ../source3/auth/auth_domain.c:121(connect_to_domain_password_server)
Mar 15 20:14:57 server-f1 smbd[21104]: connect_to_domain_password_server: unable to open the domain client session to machine SERVER-Z1.MY.AD.DOMAIN. Error was : NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.227212, 1] ../auth/credentials/credentials_secrets.c:410(cli_credentials_set_machine_account_db_ctx)
Mar 15 20:14:57 server-f1 smbd[21104]: Could not find machine account in secrets database: Failed to fetch machine account password for DOMAIN from both secrets.ldb (Could not find entry to match filter: '(&(flatname=DOMAIN)(objectclass=primaryDomain))' base: 'cn=Primary Domains': No such object: dsdb_search at ../source4/dsdb/common/util.c:4575) and from /var/lib/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.227250, 0] ../source3/auth/auth_domain.c:121(connect_to_domain_password_server)
Mar 15 20:14:57 server-f1 smbd[21104]: connect_to_domain_password_server: unable to open the domain client session to machine SERVER-Z1.MY.AD.DOMAIN. Error was : NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.257018, 1] ../auth/credentials/credentials_secrets.c:410(cli_credentials_set_machine_account_db_ctx)
Mar 15 20:14:57 server-f1 smbd[21104]: Could not find machine account in secrets database: Failed to fetch machine account password for DOMAIN from both secrets.ldb (Could not find entry to match filter: '(&(flatname=DOMAIN)(objectclass=primaryDomain))' base: 'cn=Primary Domains': No such object: dsdb_search at ../source4/dsdb/common/util.c:4575) and from /var/lib/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.257051, 0] ../source3/auth/auth_domain.c:121(connect_to_domain_password_server)
Mar 15 20:14:57 server-f1 smbd[21104]: connect_to_domain_password_server: unable to open the domain client session to machine SERVER-Z1.MY.AD.DOMAIN. Error was : NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.466888, 0] ../source3/auth/auth_domain.c:184(domain_client_validate)
Mar 15 20:14:57 server-f1 smbd[21104]: domain_client_validate: Domain password server not available.
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.466920, 2] ../source3/auth/auth.c:315(auth_check_ntlm_password)
Mar 15 20:14:57 server-f1 smbd[21104]: check_ntlm_password: Authentication for user [my.user] -> [my.user] FAILED with error NT_STATUS_NO_LOGON_SERVERS
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.466943, 2] ../auth/gensec/spnego.c:720(gensec_spnego_server_negTokenTarg)
Mar 15 20:14:57 server-f1 smbd[21104]: SPNEGO login failed: NT_STATUS_NO_LOGON_SERVERS
Mar 15 20:15:01 server-f1 CRON[21106]: (root) CMD (/usr/sbin/omv-mkrrdgraph >/dev/null 2>&1)
이것은 내 Samba 전역 구성입니다.
[global]
workgroup = DOMAIN
server string = %h server
dns proxy = no
log level = 3
syslog = 3
log file = /var/log/samba/log.%m
max log size = 1000
syslog only = yes
panic action = /usr/share/samba/panic-action %d
encrypt passwords = true
passdb backend = tdbsam
obey pam restrictions = no
unix password sync = no
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
pam password change = yes
socket options = TCP_NODELAY IPTOS_LOWDELAY
guest account = nobody
load printers = no
disable spoolss = yes
printing = bsd
printcap name = /dev/null
unix extensions = yes
wide links = no
create mask = 0777
directory mask = 0777
use sendfile = yes
aio read size = 16384
aio write size = 16384
local master = yes
time server = no
wins support = no
client signing = yes
client use spnego = yes
kerberos method = secrets and keytab
dedicated keytab file = FILE:/etc/krb5.keytab
password server = server-z1.my.ad.domain, server-z2.my.ad.domain
realm = MY.AD.DOMAIN
security = ads
template homedir = /home/my.ad.domain/users/%U
netbios name = server-f1
netbios aliases = server-f10
도와주실 수 있나요?
감사해요!
답변1
이것은 오래된 게시물이지만 오늘 이 문제를 직접 접했기 때문에 이에 대한 해결책을 공유하고 있습니다.
컴퓨터를 Active 디렉터리에 가입시키면 생성된 컴퓨터 계정에 대해 두 개의 SPN 세트가 생성됩니다. 하나는 FQDN에, 다른 하나는 Netbios 이름(서버 이름이라고도 함)에 생성됩니다.
Netbios 이름은 15자로 제한됩니다. 그래서 제 경우에는 서버 이름이 15자를 초과했습니다. 그래서 도메인에 가입할 때 컴퓨터 계정에 대해 생성된 SPN이 15번째 문자부터 잘렸습니다. 그러나 FQDN을 사용한 SPN은 완료되었으므로 FQDN을 사용하여 액세스하는 동안 서버 이름을 사용하여 공유에 액세스하지 못했습니다.
Active Directory에서 SPN을 수정하면 나에게 도움이 되었으며 귀하에게도 도움이 될 것입니다(IP 주소에는 해당되지 않지만 NTLM이 필요함).
컴퓨터 계정에 SPN을 추가한 후 서버를 재부팅해야 할 수도 있습니다.
답변2
Kerberos는 FQDN에만 바인딩되므로 해당 IP를 사용할 수 없습니다.