文章/答案/技术大牛

发布

社区首页 >问答首页 >统一UCS 4.2 -失败的“Active接管”过程-故障排除

问统一UCS 4.2 -失败的“Active接管”过程-故障排除
EN

Stack Overflow用户

提问于 2017-09-12 22:16:19

回答 1查看 810关注 0票数 1

我成功地安装了Univention UCS 4.2。

在这个UCS 4.2服务器上，我安装了以下应用程序/插件：

Active连接
接管
Active兼容域控制器
DHCP服务器
打印服务器(CUPS)

我有以下Linux发行版：

root@ucs:~# cat /etc/*-release
DISTRIB_ID=Univention
DISTRIB_RELEASE="4.2-2 errata159"
DISTRIB_CODENAME=Lesum

DISTRIB_DESCRIPTION="Univention Corporate Server 4.2-2 errata159 (Lesum)"
PRETTY_NAME="Debian GNU/Linux 8 (jessie)"
NAME="Debian GNU/Linux"
VERSION_ID="8"
VERSION="8 (jessie)"
ID=debian
HOME_URL="http://www.debian.org/"
SUPPORT_URL="http://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

以及以下Samba版本：

root@ucs:~# samba -V
Version 4.6.1-Debian

这个UCS 4.2服务器运行在IP：10.16.100.115上。

在另一个IP上：10.16.100.20，我有Microsoft Windows Server 2008 R2 (64-bit)，让我们称之为：Win 2008，它的作用是：Active Directory Domain Controller。

UCS 4.2服务器作为DNS服务器正常工作。此外，如果在本地网络上的任何Windows PC上，我将其指向DNS服务器，如下所示：

我可以使用以下凭据将Windows PC添加到域：

Domain: mydomain.intranet
User name: Administrator
Password: <thepassword>

然后，我的下一步是尝试将我在Win 2008上拥有的Active Directory迁移到UCS 4.2。为此，我通过web接口使用了应用程序：Active Directory Takeover：

当单击Next时，我得到：

当单击Next时，我得到：

然后，我检查上面图像上引用的文件：

/var/log/univention/ad-takeover.log

我发现以下内容：

2017-09-12 16:35:25,671 INFO: Time difference is less than 180 seconds, skipping reset of local time
2017-09-12 16:35:25,688 Starting phase I of the takeover process.
2017-09-12 16:35:25,688 Calling: univention-config-registry set hosts/static/10.16.100.20=DLDC.MYDOMAIN.intranet DLDC
2017-09-12 16:35:25,791 Create hosts/static/10.16.100.20
2017-09-12 16:35:25,791 Multifile: /etc/hosts
2017-09-12 16:35:25,798 Calling: /etc/init.d/univention-s4-connector stop
2017-09-12 16:35:25,818 Stopping univention-s4-connector (via systemctl): univention-s4-connector.service.
2017-09-12 16:35:25,818 Calling: /etc/init.d/samba-ad-dc stop
2017-09-12 16:35:25,993 Stopping samba-ad-dc (via systemctl): samba-ad-dc.service.
2017-09-12 16:35:25,994 Calling: univention-config-registry set nameserver1/local=10.16.100.115 nameserver1=10.16.100.20 directory/manager/web/modules/users/user/properties/username/syntax=string directory/manager/web/modules/groups/group/properties/name/syntax=string dns/backend=ldap
2017-09-12 16:35:26,082 Create nameserver1/local
2017-09-12 16:35:26,082 Setting nameserver1
2017-09-12 16:35:26,082 Setting directory/manager/web/modules/users/user/properties/username/syntax
2017-09-12 16:35:26,082 Setting directory/manager/web/modules/groups/group/properties/name/syntax
2017-09-12 16:35:26,082 Setting dns/backend
2017-09-12 16:35:26,082 File: /etc/resolv.conf
2017-09-12 16:35:26,090 Calling: /etc/init.d/nscd stop
2017-09-12 16:35:26,113 Stopping nscd (via systemctl): nscd.service.
2017-09-12 16:35:26,114 Calling: /etc/init.d/bind9 restart
2017-09-12 16:35:31,603 Restarting bind9 (via systemctl): bind9.service.
2017-09-12 16:35:31,603 Starting Samba domain join.
2017-09-12 16:35:31,885 GENSEC backend 'gssapi_spnego' registered
2017-09-12 16:35:31,885 GENSEC backend 'gssapi_krb5' registered
2017-09-12 16:35:31,885 GENSEC backend 'gssapi_krb5_sasl' registered
2017-09-12 16:35:31,885 GENSEC backend 'spnego' registered
2017-09-12 16:35:31,885 GENSEC backend 'schannel' registered
2017-09-12 16:35:31,885 GENSEC backend 'naclrpc_as_system' registered
2017-09-12 16:35:31,885 GENSEC backend 'sasl-EXTERNAL' registered
2017-09-12 16:35:31,885 GENSEC backend 'ntlmssp' registered
2017-09-12 16:35:31,885 GENSEC backend 'ntlmssp_resume_ccache' registered
2017-09-12 16:35:31,886 GENSEC backend 'http_basic' registered
2017-09-12 16:35:31,886 GENSEC backend 'http_ntlm' registered
2017-09-12 16:35:31,886 GENSEC backend 'krb5' registered
2017-09-12 16:35:31,886 GENSEC backend 'fake_gssapi_krb5' registered
2017-09-12 16:35:31,908 resolve_lmhosts: Attempting lmhosts lookup for name DLDC.MYDOMAIN.intranet<0x20>
2017-09-12 16:35:31,914 Error reading smb_krb5 reply packet: NT_STATUS_CONNECTION_REFUSED from 127.0.0.1
2017-09-12 16:35:31,914 Error reading smb_krb5 reply packet: NT_STATUS_CONNECTION_REFUSED from 127.0.0.1
2017-09-12 16:35:31,914 Error reading smb_krb5 reply packet: NT_STATUS_CONNECTION_REFUSED from 127.0.0.1
2017-09-12 16:35:31,914 Cannot reach a KDC we require to contact ldap/DLDC.MYDOMAIN.intranet@MYDOMAIN.INTRANET : kinit for myuser@MYDOMAIN.INTRANET failed (Cannot contact any KDC for requested realm)
2017-09-12 16:35:31,915 SPNEGO(gssapi_krb5) creating NEG_TOKEN_INIT for ldap/DLDC.MYDOMAIN.intranet failed (next[ntlmssp]): NT_STATUS_NO_LOGON_SERVERS
2017-09-12 16:35:31,915 Got challenge flags:
2017-09-12 16:35:31,915 Got NTLMSSP neg_flags=0x62898235
2017-09-12 16:35:31,915 NTLMSSP: Set final flags:
2017-09-12 16:35:31,915 Got NTLMSSP neg_flags=0x62088235
2017-09-12 16:35:31,915 NTLMSSP Sign/Seal - Initialising with flags:
2017-09-12 16:35:31,915 Got NTLMSSP neg_flags=0x62088235
2017-09-12 16:35:31,916 NTLMSSP Sign/Seal - Initialising with flags:
2017-09-12 16:35:31,916 Got NTLMSSP neg_flags=0x62088235
2017-09-12 16:35:31,926 workgroup is MYDOMAIN
2017-09-12 16:35:31,926 realm is MYDOMAIN.intranet
2017-09-12 16:35:31,940 tdb(/var/lib/samba/private/secrets.tdb): tdb_open_ex: could not open file /var/lib/samba/private/secrets.tdb: No such file or directory
2017-09-12 16:35:31,940 Could not open tdb: No such file or directory
2017-09-12 16:35:31,944 ldb_wrap open of secrets.ldb
2017-09-12 16:35:31,944 Could not find machine account in secrets database: Failed to fetch machine account password from secrets.ldb: Could not find entry to match filter: '(&(flatname=MYDOMAIN)(objectclass=primaryDomain))' base: 'cn=Primary Domains': No such object: dsdb_search at ../source4/dsdb/common/util.c:4576 and failed to open /var/lib/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
2017-09-12 16:35:31,994 ERROR(ldb): uncaught exception - LDAP error 68 LDAP_ENTRY_ALREADY_EXISTS -  <00002071: UpdErr: DSID-03050328, problem 6005 (ENTRY_EXISTS), data 0
2017-09-12 16:35:31,994 > <>
2017-09-12 16:35:31,995   File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line 176, in _run
2017-09-12 16:35:31,995     return self.run(*args, **kwargs)
2017-09-12 16:35:31,995   File "/usr/lib/python2.7/dist-packages/samba/netcmd/domain.py", line 668, in run
2017-09-12 16:35:31,995     keep_existing=keep_existing)
2017-09-12 16:35:31,995   File "/usr/lib/python2.7/dist-packages/samba/join.py", line 1276, in join_DC
2017-09-12 16:35:31,996     ctx.do_join()
2017-09-12 16:35:31,996   File "/usr/lib/python2.7/dist-packages/samba/join.py", line 1182, in do_join
2017-09-12 16:35:31,996     ctx.join_add_objects()
2017-09-12 16:35:31,996   File "/usr/lib/python2.7/dist-packages/samba/join.py", line 613, in join_add_objects
2017-09-12 16:35:31,996     ctx.samdb.add(rec)
2017-09-12 16:35:31,996 Adding CN=CONTROLLER,OU=Domain Controllers,DC=MYDOMAIN,DC=intranet
2017-09-12 16:35:31,996 Adding CN=CONTROLLER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=MYDOMAIN,DC=intranet
2017-09-12 16:35:31,996 Join failed - cleaning up
2017-09-12 16:35:31,996 removing samaccount: CN=CONTROLLER,OU=Domain Controllers,DC=MYDOMAIN,DC=intranet
2017-09-12 16:35:31,996 Deleted CN=CONTROLLER,OU=Domain Controllers,DC=MYDOMAIN,DC=intranet
2017-09-12 16:35:32,017 Calling: univention-config-registry unset hosts/static/10.16.100.20
2017-09-12 16:35:32,126 Unsetting hosts/static/10.16.100.20
2017-09-12 16:35:32,126 Multifile: /etc/hosts
2017-09-12 16:35:32,131 Calling: /etc/init.d/samba-ad-dc start
2017-09-12 16:35:32,452 Starting samba-ad-dc (via systemctl): samba-ad-dc.service.
2017-09-12 16:35:32,452 Calling: /etc/init.d/univention-s4-connector start
2017-09-12 16:35:37,699 Starting univention-s4-connector (via systemctl): univention-s4-connector.service.
2017-09-12 16:35:37,699 Calling: univention-config-registry set nameserver1=10.16.100.115
2017-09-12 16:35:37,895 Setting nameserver1
2017-09-12 16:35:37,895 File: /etc/resolv.conf
2017-09-12 16:35:37,902 Calling: univention-config-registry unset nameserver1/local
2017-09-12 16:35:38,029 Unsetting nameserver1/local
2017-09-12 16:35:38,029 File: /etc/resolv.conf
2017-09-12 16:35:38,034 Calling: univention-config-registry set dns/backend=samba4
2017-09-12 16:35:38,098 Setting dns/backend
2017-09-12 16:35:38,102 Calling: /etc/init.d/bind9 restart
2017-09-12 16:35:48,642 Restarting bind9 (via systemctl): bind9.service.
2017-09-12 16:35:48,642 Calling: /etc/init.d/nscd restart
2017-09-12 16:35:48,736 Restarting nscd (via systemctl): nscd.service.
2017-09-12 16:35:48,736 The domain join failed. See /var/log/univention/ad-takeover.log for details.

有些台词吸引了我的注意力：

2017-09-12 16:35:31,914 Error reading smb_krb5 reply packet: NT_STATUS_CONNECTION_REFUSED from 127.0.0.1
2017-09-12 16:35:31,914 Error reading smb_krb5 reply packet: NT_STATUS_CONNECTION_REFUSED from 127.0.0.1
2017-09-12 16:35:31,914 Error reading smb_krb5 reply packet: NT_STATUS_CONNECTION_REFUSED from 127.0.0.1
2017-09-12 16:35:31,914 Cannot reach a KDC we require to contact ldap/DLDC.MYDOMAIN.intranet@MYDOMAIN.INTRANET : kinit for myuser@MYDOMAIN.INTRANET failed (Cannot contact any KDC for requested realm)

然后，检查samba配置文件：/etc/samba/smb.conf --我看到以下片段：

[global]
    debug level     = 1
    logging         = file
    log file        = /var/log/samba/log.%m
    log level       = 3
    max log size    = 0

    netbios name    = controller
    server role = active directory domain controller
    server string   = Univention Corporate Server
    server services = -dns -smb +s3fs -nbt
    server role check:inhibit = yes
    # use nmbd; to disable set samba4/service/nmb to s4
    nmbd_proxy_logon:cldap_server=127.0.0.1
    workgroup   = LAGOON
    realm       = LAGOON.LOCAL

    tls enabled = yes
    tls keyfile = /etc/univention/ssl/controller.lagoon.local/private.key
    tls certfile    = /etc/univention/ssl/controller.lagoon.local/cert.pem
    tls cafile  = /etc/univention/ssl/ucsCA/CAcert.pem
    tls verify peer = ca_and_name
    ldap server require strong auth = allow_sasl_over_tls
    dsdb:schema update allowed = no
    max open files = 32808
    ntlm auth   = yes
    machine password timeout    = 0
    acl allow execute always = True

    # ignore interfaces in samba/register/exclude/interfaces
    bind interfaces only = yes
    interfaces = lo eth0
    kccsrv:samba_kcc = False

还有一句台词吸引了我的注意：

nmbd_proxy_logon:cldap_server=127.0.0.1

注意，与错误日志上的127.0.0.1相同。

其他详情：

在Win 2008服务器上，我使用的是域：MYDOMAIN.intranet
在UCS 4.2服务器上，我使用的是域：mydomain.intranet

在失败的接管过程之后，我检查了UCS 4.2服务器上的用户列表，没有从Win 2008服务器导入用户(和以前一样)。

作为备忘，我不得不说，由于某种原因，在执行上述操作后，当尝试使用前一个服务器：Win 2008作为本地域，然后尝试登录时，我得到了以下错误：

The security database on the server does not have a computer account for this workstation trust relationship.

但我通过以下链接的步骤解决了这一问题：

https://virtualcurtis.wordpress.com/2011/03/02/fix-the-security-database-on-the-server-does-not-have-a-computer-account-for-this-workstation-trust-relationship/

检查

root@controller:~# ls -la /var/lib/samba/private/secrets.tdb
-rw------- 1 root root 430080 Sep 11 16:08 /var/lib/samba/private/secrets.tdb

对如何让收购过程顺利进行有什么想法吗？

windows-server

domaincontroller

linux

active-directory

samba

回答 1

Stack Overflow用户

发布于 2017-09-14 13:14:21

你看过文档了吗？我在你的帖子里看到了两个问题。

首先，您声称两个系统都有相同的域名，这是必要的。但是，您的屏幕截图显示，您的AD域名是LAGOON.local，而不是MYDOMAIN.intranet，因为它是为您的统一服务器。

其次，日志文件显示，您再次尝试使用您的简单域用户myuser，而不是AD域管理Admin。这个用户根本没有访问整个AD域数据所需的权限。

对于我们来说，在我们的论坛上帮助您解决这些特定的问题是非常容易的。我们不能保证在外部论坛上支持我们的产品。

票数 1

页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持

原文链接：

https://stackoverflow.com/questions/46186113

复制

相似问题

问统一UCS 4.2 -失败的“Active接管”过程-故障排除
EN

回答 1

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问统一UCS 4.2 -失败的“Active接管”过程-故障排除EN

回答 1

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问统一UCS 4.2 -失败的“Active接管”过程-故障排除
EN