☰

adcli가 LDAPS 옵션을 사용하여 AD에 가입하지 못함

tag-icon • tag-icon active-directory ubuntu-18.04 sssd
adcli가 LDAPS 옵션을 사용하여 AD에 가입하지 못함

최근 ldaps 옵션으로 업데이트된 ubuntu 18.04의 adcli에 문제가 있습니다.

AD의 단축 이름을 찾을 수 없는 것 같으며 명령에 CA가 /etc/ldap/ldap.conf로 지정되어 있어도 LDAP에 연결하지 못하는 것 같습니다.

또한 SSSD 구성에서 ldap_uri를 구성하려고 시도했지만 운이 없었습니다.

me@lnx-node-1:~# LDAPTLS_CACERT=/usr/local/share/ca-certificates/domain-ca.pem adcli join -U me-admin --domain=ad.somewhere.com -v
     * Using domain name: AD.SOMEWHERE.COM
     * Calculated computer account name from fqdn: LNX-NODE-1
     * Calculated domain realm from name: AD.SOMEWHERE.COM
     * Discovering domain controllers: _ldap._tcp.AD.SOMEWHERE.COM
     * Sending netlogon pings to domain controller: ldap://[####:650:###:d314::dc1]
     * Sending netlogon pings to domain controller: cldap://####.###.160.19
     * Sending netlogon pings to domain controller: ldap://[####:630:###:d314::dc4]
     * Sending netlogon pings to domain controller: cldap://###.###.160.59
     * Sending netlogon pings to domain controller: ldap://[####:630:###:e010::dc2]
     * Received NetLogon info from: itsdc-1.ad.somewhere.com
     * Wrote out krb5.conf snippet to /tmp/adcli-krb5-H8CKiH/krb5.d/adcli-krb5-conf-vv3c80
    Password for [email protected]: 
     * Authenticated as user: [email protected]
     * Using GSS-SPNEGO for SASL bind
     * ! Couldn't lookup domain short name: Can't contact LDAP server
     * Using fully qualified name: lnx-node-1.ad.somewhere.com
     * Using domain name: AD.SOMEWHER.COM
     * Using computer account name: LNX-NODE-1
     * Using domain realm: AD.SOMEWHER.COM
     * Calculated computer account name from fqdn: LNX-NODE-1
     * Generated 120 character computer password
     * Using keytab: FILE:/etc/krb5.keytab
     ! Couldn't lookup computer account: LNX-NODE-1$: Can't contact LDAP server
    adcli: joining domain AD.SOMEWHERE.COM failed: Couldn't lookup computer account: LNX-NODE-1$: Can't contact LDAP server

업데이트: adcli 패키지를 다운그레이드하는 임시 해결 방법을 관리했지만 apt install adcli=0.8.2-1여전히 수정이 필요합니다.

답변1

여기에 보고된 문제가 있는 것 같습니다.

https://bugs.launchpad.net/ubuntu/bionic/+source/adcli/+bug/1906627

apt는 더 이상 이 패키지의 손상된 버전(0.8.2-1ubuntu1)을 설치하지 않습니다.

apt-cache policy adcli
adcli:
  Installed: 0.8.2-1
  Candidate: 0.8.2-1
  Version table:
 *** 0.8.2-1 500
        500 http://gb.archive.ubuntu.com/ubuntu bionic/universe amd64 Packages
        100 /var/lib/dpkg/status

관련 정보