Cannot find KDC for requested realm

[Viktor]

altlinux master 2.4 и win2003(настроен dns с именем domain.local)
smb.conf
  realm = DC.DOMAIN
  workgroup = DOMAIN
  netbios name = alt
  server string = alt
  log file = /var/log/samba/log.%m
  max log size = 50
  hosts allow = 192.168.0. 127.
  security = domain
  password server = *
  encrypt passwords = yes
  winbind uid = 10000-20000
  winbind gid = 10000-20000
  winbind use default domain = yes
  winbind separator = +
  winbind enum users = yes
  winbind enum groups = yes  
  template homedir = /home/%D/%U
  template shell = /bin/bash
  dos charset = CP866
  unix charset = KOI8-R
  display charset = KOI8-R

krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
ticket_lifetime = 24000
default_realm = DOMAIN
dns_lookup_realm = true
dns_lookup_kdc = true

[realms]
DOMAIN = {
 kdc = DC.DOMAIN:88
 admin_server = DC.DOMAIN:749
 default_domain = DOMAIN
}

[domain_realm]
.DOMAIN = DOMAIN
DOMAIN = DOMAIN

[kdc]
profile = /var/lib/kerberos/krb5kdc/kdc.conf

[pam]
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false

Останавливаю самбу
net ads join -U admin%passwd
kerberos_kinit_password admin@DOMAIN.LOCAL failed: Cannot find KDC for requested realm

kinit -p admin@domain
Cannot find KDC for requested realm while getting initial credentials

Помогите разобраться.

[corvax]

kinit -p admin@domain
Cannot find KDC for requested realm while getting initial credentials

Помогите разобраться.

а что возвращает

Код: Выделить всё

kinit -p admin@DC.DOMAIN

?

[Viktor]

Прошу прощения, но проверить смогу только завтра(пришлось уйти).
Но, по-моему, я пробовал и результат тот же.

[corvax]

[realms]
DOMAIN = {
 kdc = DC.DOMAIN:88
 admin_server = DC.DOMAIN:749
 default_domain = DOMAIN
}

я бы написал:

Код: Выделить всё

 DC.DOMAIN = {
  kdc = DC.DOMAIN:88
  admin_server = DC.DOMAIN:749
  kpasswd_server = DC.DOMAIN
  default_domain = DOMAIN
 }

конечно при условии, что DC.DOMAIN отрезолвится в IP адрес Domain Controller'а. если нет, то в значениях для kdc, admin_server и kpasswd_server нужно прописать имя хоста с DC

хотя... можно оставить и оба варианта

[domain_realm]
.DOMAIN = DOMAIN
DOMAIN = DOMAIN

я бы написал:

Код: Выделить всё

[domain_realm]
 .DC.DOMAIN = DOMAIN
DC.DOMAIN = DOMAIN

[Viktor]

Добавил строчку в krb5.conf
kpasswd_server = DC.DOMAIN
И в /etc/hosts
192.168.0.10  dc.domain dc

Теперь выдаёт:
# kinit -p admin
Password for admin@DOMAIN:
kinit(v5): KDC reply did not match expectations while getting initial credentials
# net ads join -U admin@DOMAIN%password
[2005/10/05 11:13:43, 0] libads/kerberos.c:ads_kinit_password(136)
 kerberos_kinit_password admin@DOMAIN failed: KDC reply did not match expectations

[corvax]

Добавил строчку в krb5.conf
kpasswd_server = DC.DOMAIN

а остальные изменения, о которых я писал?

И в /etc/hosts
192.168.0.10  dc.domain dc

Теперь выдаёт:
# kinit -p admin
Password for admin@DOMAIN:
kinit(v5): KDC reply did not match expectations while getting initial credentials

я не тестировал kerberos в связке именно с самбой, в остальных случаях было критично после имени пользователя указывать именно realm, а не domain

т. е. надо тестить было так:

Код: Выделить всё

kinit admin@DC.DOMAIN

[Viktor]

krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
ticket_lifetime = 24000
default_realm = DOMAIN
dns_lookup_realm = true
dns_lookup_kdc = true

[realms]
DOMAIN = {
 kdc = DC.DOMAIN:88
 admin_server = DC.DOMAIN:749
 kpasswd_server = DC.DOMAIN
 default_domain = DOMAIN
}

[domain_realm]
.DC.DOMAIN = DOMAIN
DC.DOMAIN = DOMAIN

[kdc]
profile = /var/lib/kerberos/krb5kdc/kdc.conf

[pam]
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false

Самбы нет.

# kinit -p admin
Password for admin@DOMAIN: "Ввожу правильный пароль"
kinit(v5): KDC reply did not match expectations while getting initial credentials

# kinit -p admin
Password for admin@DOMAIN: "Ввожу неправильный пароль"
kinit(v5): Preauthentication failed while getting initial credentials

# kinit -p admin@DC.DOMAIN
kinit(v5): Cannot find KDC for requested realm while getting initial credentials

# kinit -p admin@DOMAIN
Password for admin@DOMAIN:
kinit(v5): KDC reply did not match expectations while getting initial credentials

[Viktor]

Если сделать

DC.DOMAIN = {
 kdc = DC.DOMAIN:88
 admin_server = DC.DOMAIN:749
 kpasswd_server = DC.DOMAIN
 default_domain = DOMAIN
}

# kinit -p admin@DC.DOMAIN
kinit(v5): KRB5 error code 68 while getting initial credentials

kinit -p admin@DOMAIN
kinit(v5): Cannot find KDC for requested realm while getting initial credentials

kinit -p admin
kinit(v5): Cannot find KDC for requested realm while getting initial credentials

[Viktor]

Проблема решилась !
После изменения krb5.conf

[libdefaults]
default_realm = DOMAIN.LOCAL
[realms]
DOMAIN.LOCAL = {
kdc = dc.domain.local
admin_server = dc.domain.local
}
[domain_realms]
.domain.local = DOMAIN.LOCAL

и smb.conf

[global]
  workgroup = DOMAIN
  netbios name = prox
  server string = prox
  log file = /var/log/samba/log.%m
  max log size = 50
  hosts allow = 192.168.0. 127.
  security = ads
  password server = dc.domain.local
  encrypt passwords = yes
  realm = DOMAIN.LOCAL
  winbind uid = 10000-20000
  winbind gid = 10000-20000
  winbind use default domain = yes
  winbind separator = +
  winbind enum users = yes
  winbind enum groups = yes    
  template homedir = /home/%D/%U
  template shell = /bin/bash
  dos charset = CP866
  unix charset = KOI8-R
  display charset = KOI8-R

[var]
  path = /var
  writable = yes
  guest ok = no
  browseable = yes
  create mask = 744    
  valid users = DOMAIN\Admin

Теперь kinit и wbinfo проходят без проблем и
net ads join -U admin%password не ругается.
Но теперь другая проблема: при попытке заити на самбу она просит ввести логин и пароль.

В /var/log/samba/log.192.168.0.10

[2005/10/06 14:15:36, 1] smbd/sesssetup.c:reply_spnego_kerberos(248)
 Username DOMAIN+admin is invalid on this system
[2005/10/06 14:15:37, 1] smbd/sesssetup.c:reply_spnego_kerberos(248)
 Username DOMAIN+admin is invalid on this system

В /var/log/samba/log.winbindd

[2005/10/06 14:20:53, 1] nsswitch/winbindd_user.c:winbindd_getpwnam(159)
 user 'ADMIN' does not exist
[2005/10/06 14:20:53, 3] nsswitch/winbindd_acct.c:winbindd_create_user(880)
 [ 2277]: create_user: user=>(admin), group=>()
[2005/10/06 14:20:53, 5] nsswitch/winbindd_acct.c:wb_getpwnam(393)
 wb_getpwnam: Found user (admin)
[2005/10/06 14:20:53, 0] nsswitch/winbindd_acct.c:winbindd_create_user(884)
 winbindd_create_user: Refusing to create user that already exists (admin)
[2005/10/06 14:20:53, 3] nsswitch/winbindd_user.c:winbindd_getpwnam(124)
 [ 2277]: getpwnam admin
[2005/10/06 14:20:53, 1] nsswitch/winbindd_user.c:winbindd_getpwnam(159)
 user 'admin' does not exist
[2005/10/06 14:20:53, 3] nsswitch/winbindd_user.c:winbindd_getpwnam(124)
 [ 2277]: getpwnam ADMIN
[2005/10/06 14:20:53, 1] nsswitch/winbindd_user.c:winbindd_getpwnam(159)
 user 'ADMIN' does not exist
[2005/10/06 14:20:53, 5] nsswitch/winbindd.c:winbind_client_read(465)
 read failed on sock 20, pid 2277: EOF

[olegus]

Я с realm = DOMAIN боролся долго. Сдался. Оставил domain = DOMAIN.LOCAL.