I've been trying to add an Ubuntu desktop to our corporate domain with limited success. I've followed the guide at https://help.ubuntu.com/community/ActiveDirectoryWinbindHowto as best I could (including following the links to setting up Kerberos). I can use kinit to get a ticket from our DCs:
localuser@HOSTNAME: sudo kinit adminuser Password for adminuser@DOMAIN.COM.AU: Warning: Your password will expire in 5 days on Sun 18 Sep 2016 08:58:05 AEST localuser@HOSTNAME: sudo klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: adminuser@DOMAIN.COM.AU Valid starting Expires Service Principal 12/09/16 09:57:10 12/09/16 19:57:10 krbtgt/DOMAIN.COM.AU@DOMAIN.COM.AU renew until 13/09/16 09:56:57
It can even see that my password expires in 5 days. But when I try to join the domain, I get the following:
localuser@HOSTNAME: sudo net ads join -k Kinit for HOSTNAME$ to access cifs/DC01.domain.com.au@DOMAIN.COM.AU failed: Cannot contact any KDC for requested realm Using short domain name -- DOMAIN Joined 'HOSTNAME' to dns domain 'domain.com.au' kerberos_kinit_password HOSTNAME@DOMAIN.COM.AU failed: Cannot conact any KDC for requested realm DNS update failed: kinit failed: Cannot contact any KDC for requested realm
Oddly, the domain object gets created, and upon reboot, I can see lastLogonTime update to the time the desktop starts.
I've also tried using smbclient to test. Here, I found something odd; it works if I specify server name, but only partially works if I specify the FQDN:
localuser@HOSTNAME:~$ smbclient -kL //dc01 OS=[Windows Server 2012 R2 Standard 9600] Server=[Windows Server 2012 R2 Standard 6.3] Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share IPC$ IPC Remote IPC NETLOGON Disk Logon server share SYSVOL Disk Logon server share OS=[Windows Server 2012 R2 Standard 9600] Server=[Windows Server 2012 R2 Standard 6.3] Server Comment --------- ------- Workgroup Master --------- ------- localuser@HOSTNAME:~$ smbclient -kL //dc01.domain.com.au OS=[Windows Server 2012 R2 Standard 9600] Server=[Windows Server 2012 R2 Standard 6.3] Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share IPC$ IPC Remote IPC NETLOGON Disk Logon server share SYSVOL Disk Logon server share Connection to dc01.domain.com.au failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) NetBIOS over TCP disabled -- no workgroup available
I'm running Ubuntu Desktop 16.04 LTS in a Hyper-V VM, hosted on Windows 10 Professional. Our domain is at 2008 functional level, and our DCs are all 2012 R2. I've installed the following packages:
sudo apt install krb5-user libnss-winbind libpam-winbind ntp ntp-doc samba smbclient ssh-server vim vim-doc winbind
DNS and NTP are both working; ntpq -p lists my DCs. Changes I've made to config files:
/etc/krb5.conf - We have two DNS domains in use; I haven't tried anything using the second domain, but I've put it in here in preparation for that. Also, a Wireshark trace showed that the desktop was trying to connect via UDP first, and not getting any answer, then would try ~20 seconds later with TCP and get an immediate answer, so I disabled UDP.
[logging] default = FILE:/var/log/krb5.log [libdefaults] default_realm = DOMAIN.COM.AU udp_preference_limit = 0 [domain_realm] .domain.com.au = DOMAIN.COM.AU domain.com.au = DOMAIN.COM.AU .domain2.com.au = DOMAIN.COM.AU domain2.com.au = DOMAIN.COM.AU
/etc/samba/smb.conf - As testparm was complaining about the default "syslog = 0" line, I removed it. Also, as this computer won't have any printers to share, I've removed the default shares sections ([printers] and [print$]).
[global] client ntlmv2 auth = yes client signing = yes client use spnego = yes encrypt passwords = yes idmap config * : backend = autorid idmap config * : range = 1000000 - 1999999 kerberos method = secrets and keytab realm = DOMAIN.COM.AU restrict anonymous = 2 security = ads template homedir = /home/%D/%U template shell = /bin/bash winbind enum groups = yes winbind enum users = yes winbind use default domain = yes workgroup = DOMAIN
Any ideas where to look for trouble? Despite having added the logging section to my krb5.conf file, no log file is getting created, so I can't seem to get any detail about what's going on in Kerberos. I'm hoping someone wiser than I can point me in the right direction for where to check next.