I've been trying to add an Ubuntu desktop to our corporate domain with limited success. I've followed the guide at https://help.ubuntu.com/community/ActiveDirectoryWinbindHowto as best I could (including following the links to setting up Kerberos). I can use kinit to get a ticket from our DCs:

localuser@HOSTNAME: sudo kinit adminuser
Password for adminuser@DOMAIN.COM.AU:
Warning: Your password will expire in 5 days on Sun 18 Sep 2016 08:58:05 AEST
localuser@HOSTNAME: sudo klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: adminuser@DOMAIN.COM.AU

Valid starting     Expires            Service Principal
12/09/16 09:57:10  12/09/16 19:57:10  krbtgt/DOMAIN.COM.AU@DOMAIN.COM.AU
        renew until 13/09/16 09:56:57

It can even see that my password expires in 5 days. But when I try to join the domain, I get the following:

localuser@HOSTNAME: sudo net ads join -k
Kinit for HOSTNAME$ to access cifs/DC01.domain.com.au@DOMAIN.COM.AU failed: Cannot contact any KDC for requested realm
Using short domain name -- DOMAIN
Joined 'HOSTNAME' to dns domain 'domain.com.au'
kerberos_kinit_password HOSTNAME@DOMAIN.COM.AU failed: Cannot conact any KDC for requested realm
DNS update failed: kinit failed: Cannot contact any KDC for requested realm

Oddly, the domain object gets created, and upon reboot, I can see lastLogonTime update to the time the desktop starts.

I've also tried using smbclient to test. Here, I found something odd; it works if I specify server name, but only partially works if I specify the FQDN:

localuser@HOSTNAME:~$ smbclient -kL //dc01
OS=[Windows Server 2012 R2 Standard 9600] Server=[Windows Server 2012 R2 Standard 6.3]

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        IPC$            IPC       Remote IPC
        NETLOGON        Disk      Logon server share
        SYSVOL          Disk      Logon server share
OS=[Windows Server 2012 R2 Standard 9600] Server=[Windows Server 2012 R2 Standard 6.3]

        Server               Comment
        ---------            -------

        Workgroup            Master
        ---------            -------
localuser@HOSTNAME:~$ smbclient -kL //dc01.domain.com.au
OS=[Windows Server 2012 R2 Standard 9600] Server=[Windows Server 2012 R2 Standard 6.3]

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        IPC$            IPC       Remote IPC
        NETLOGON        Disk      Logon server share
        SYSVOL          Disk      Logon server share
Connection to dc01.domain.com.au failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
NetBIOS over TCP disabled -- no workgroup available

I'm running Ubuntu Desktop 16.04 LTS in a Hyper-V VM, hosted on Windows 10 Professional. Our domain is at 2008 functional level, and our DCs are all 2012 R2. I've installed the following packages:

sudo apt install krb5-user libnss-winbind libpam-winbind ntp ntp-doc samba smbclient ssh-server vim vim-doc winbind

DNS and NTP are both working; ntpq -p lists my DCs. Changes I've made to config files:

/etc/krb5.conf - We have two DNS domains in use; I haven't tried anything using the second domain, but I've put it in here in preparation for that. Also, a Wireshark trace showed that the desktop was trying to connect via UDP first, and not getting any answer, then would try ~20 seconds later with TCP and get an immediate answer, so I disabled UDP.

        default = FILE:/var/log/krb5.log
        default_realm = DOMAIN.COM.AU
        udp_preference_limit = 0
        .domain.com.au = DOMAIN.COM.AU
        domain.com.au = DOMAIN.COM.AU
        .domain2.com.au = DOMAIN.COM.AU
        domain2.com.au = DOMAIN.COM.AU

/etc/samba/smb.conf - As testparm was complaining about the default "syslog = 0" line, I removed it. Also, as this computer won't have any printers to share, I've removed the default shares sections ([printers] and [print$]).

        client ntlmv2 auth = yes
        client signing = yes
        client use spnego = yes
        encrypt passwords = yes
        idmap config * : backend = autorid
        idmap config * : range = 1000000 - 1999999
        kerberos method = secrets and keytab
        realm = DOMAIN.COM.AU
        restrict anonymous = 2
        security = ads
        template homedir = /home/%D/%U
        template shell = /bin/bash
        winbind enum groups = yes
        winbind enum users = yes
        winbind use default domain = yes
        workgroup = DOMAIN

Any ideas where to look for trouble? Despite having added the logging section to my krb5.conf file, no log file is getting created, so I can't seem to get any detail about what's going on in Kerberos. I'm hoping someone wiser than I can point me in the right direction for where to check next.

  • [logging] section is about server activities. On a client is of little use. You should see more details on the krbtgt server, but it depends on your AD server (samba? windows?) – 473183469 Sep 12 '16 at 7:15
  • Sorry, missed this comment before. As I said above, it's a 2008 functional level domain, with Windows 2012 R2 domain controllers. No Samba DCs involved. I'll have a look in the event log on the DC it's talking to. – DarkMoon Sep 13 '16 at 0:43

It may be a DNS issue. Check DNS for the DC01.domain.com.au server:

$ nslookup DC01 # or dig if you prefer
$ nslookup DC01.domain.com.au
$ nslookup w.x.y.z # IP address

Similarly, ensure your client resolves correctly in DNS forwards and backwards, with the correct DNS search path:

$ nslookup HOSTNAME
$ nslookup HOSTNAME.domain.com.au
$ nslookup w.x.y.z # IP address

Try forcing the use of a particular KDC, at least for the join. It's not ideal to do this but it may help in the event of DNS issues.

In /etc/krb5.conf:

        DOMAIN.COM.AU = {
                kdc = dc01.domain.com.au

In /etc/smb.conf:

        password server = dc01.domain.com.au

Also try net ads join -U adminuser instead of the -k option.

The examples I've seen have udp_preference_limit = 1 instead of udp_preference_limit = 0 but this is probably doesn't matter.

Logging in /etc/krb5.conf is only for the server side I believe.

  • Thanks for the reply. Sorry for leaving this out; it was a lot to try and put together a coherent picture. When I said DNS was working, I have tried the nslookups (host, FQDN, and IP) for both DC and client. I've tried a manually entered [realms] section, with all our DCs as 'kdc =' entries, and the default_domain set; no change. I've tried with the 'password server' option set; the only change there was that Samba would complain I was using 'password server' with 'security = ads'. And I had initially tried 'net ads join -U adminuser', as per the Ubuntu guide, but it had the same result. – DarkMoon Sep 12 '16 at 6:20
  • For the SPNs, though; what SPNs am I looking for? SetSPN -L dc01 is giving me quite a few SPNs: GC? HOST? ldap? Something else? – DarkMoon Sep 12 '16 at 6:23
  • Just looking for any SPNs where the FQDN is wrong or missing. Anyway, you could try adding -d10 to net ads join to see more info. – Tom Shaw Sep 12 '16 at 7:06
  • The only SPN that doesn't look to be duplicated is GC, which near as I can work out through some Google searches, seems to be normal. Adding -d10 made a difference alright; I'm gonna be a while trawling through all this output. :-P Thanks for letting me know about that one. – DarkMoon Sep 12 '16 at 23:15
  • You could always try a lower debug level to start with :) Anyway I'll to edit my answer to remove the SPN stuff since it hasn't helped. – Tom Shaw Sep 13 '16 at 0:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.