dar*_*urf 5 active-directory samba mount cifs sssd
设置
服务器
这台机器作为成员服务器连接到公司活动目录，但不是域控制器（我按照 RadHat 文档将机器加入域并配置 smb）
也补充说
net ads keytab add cifs
net ads testjoin 和 status 给了我积极的结果
用于此测试的客户端是
有些客户端是 ActiveDirectory 的一部分，有些则不是。反正结果是一样的，只有 windows 和 OSX 可以挂载共享。
我还玩了 sec= 和 vers= 使用更多-更少的所有可能性，files_mode 和 dir_mode 设置为 777 或 644/755 都没有成功。还尝试了凭据文件和 fstab 中的一行。
我总是收到一个：挂载错误（13）：权限被拒绝
时髦的一点是，我可以使用 smbpasswd 在服务器上设置的本地帐户安装共享......但这显然不是我想要的
然后是其他时髦的点，我可以使用 smb://user@ 在 XFCE 下从 Thunar 连接服务器...这也适用于 smbclient
这是我的 conf 文件
配置文件
[global]
workgroup = DOMAIN
security = ads
client signing = yes
client use spnego = yes
realm = DOMAIN.DOM.CH
server role = MEMBER SERVER
passdb backend = tdbsam
kerberos method = secrets and keytab
idmap config * : range = 10000-99999999
idmap config * : backend = tdb
wins server = xx.xx.xx.xx
winbind use default domain = yes
load printers = no
disable spoolss = yes
show add printer wizard = No
local master = No
dns proxy = No
logging = file
log file = /var/log/samba/smb-%I.log
log level = 4
max log size = 10000
follow symlinks = yes
min protocol = SMB2
client min protocol = SMB2
debug hires timestamp = No
acl group control = yes
delete readonly = yes
acl allow execute always = yes
dos filemode = Yes
inherit permissions = Yes
store dos attributes = Yes
vfs objects = acl_xattr
[MyShare]
inherit acls = Yes
path = /srv/samba/partage
read only = no
admin users = @"DOMAIN\GROUP-AdminsU" "DOMAIN\user"
vfs objects = acl_xattr
krb5.conf文件
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
default_ccache_name = KEYRING:persistent:%{uid}
default_realm = DOMAIN.DOM.CH
[realms]
DOMAIN.DOM.CH = {
kdc = domain.dom.ch
admin_server = domain.dom.ch
}
[domain_realm]
domain.dom.ch = DOMAIN.DOM.CH
.domain.dom.ch = DOMAIN.DOM.CH
配置文件
[sssd]
domains = domain.dom.ch
config_file_version = 2
services = nss, pam
default_domain_suffix = DOMAIN.DOM.CH
[domain/domain.dom.ch]
ad_domain = domain.dom.ch
krb5_realm = DOMAIN.DOM.CH
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
我查看了 samba 日志级别 10，这是可能的可利用错误。为了让事情更清楚一点，我确实按模块拆分了日志。
授权：
Got user=[user] domain=[DOMAIN] workstation=[] len1=0 len2=166
Mapping user [DOMAIN]\[user] from workstation []
...
check_ntlm_password: Checking password for unmapped user [DOMAIN]\[user]@[] with the new password interface
check_ntlm_password: mapped user is: [DOMAIN]\[user]@[]
check_ntlm_password: auth_context challenge created by random
challenge is:
Check auth for: [user]
auth_check_ntlm_password: guest had nothing to say
Check auth for: [user]
check_samstrict_security: DOMAIN is not one of my local names (ROLE_DOMAIN_MEMBER)
auth_check_ntlm_password: sam had nothing to say
Check auth for: [user]
check_winbind_security: wbcAuthenticateUserEx failed: WBC_ERR_WINBIND_NOT_AVAILABLE
auth_check_ntlm_password: winbind authentication for user [user] FAILED with error NT_STATUS_LOGON_FAILURE, authoritative=1
check_ntlm_password: Authentication for user [user] -> [user] FAILED with error NT_STATUS_LOGON_FAILURE, authoritative=1
ntlmssp_server_auth_send: Checking NTLMSSP password for DOMAIN\user failed: NT_STATUS_LOGON_FAILURE
gensec_update_done: ntlmssp[0x55ad6e4aba70]: NT_STATUS_LOGON_FAILURE tevent_req[0x55ad6e4ab680/../auth/ntlmssp/ntlmssp.c:181]: state[3] error[-7963671676338569107 (0x917B5ACDC000006D)] state[struct gensec_ntlmssp_update_state (0x55ad6e4ab810)] timer[(nil)] finish[../auth/ntlmssp/ntlmssp.c:239]
gensec_update_done: spnego[0x55ad6e4aaf00]: NT_STATUS_LOGON_FAILURE tevent_req[0x55ad6e4ac860/../auth/gensec/spnego.c:1601]: state[3] error[-7963671676338569107 (0x917B5ACDC000006D)] state[struct gensec_spnego_update_state (0x55ad6e4ac9f0)] timer[(nil)] finish[../auth/gensec/spnego.c:2065]
这里奇怪的一点是这个“workstation=[]”。对于 windows 和 mac 客户端，我总是在括号中包含一个工作站名称，但当它是 linux 客户端时没有。
auth_audit:
Auth: [SMB2,(null)] user [DOMAIN]\[user] at [Wed, 17 Apr 2019 07:54:56.191467 CEST] with [NTLMv2] status [NT_STATUS_LOGON_FAILURE] workstation [] remote host [ipv4:xxx.xxx.xxx.xxx:57124] mapped to [DOMAIN]\[user]. local host [ipv4:xxx.xxx.xxx.xxx:445]
smb2：
Selected protocol SMB3_11
smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[64] dyn[yes:156] at ../source3/smbd/smb2_negprot.c:662
smbd_smb2_request idx[1] of 5 vectors
smbd_smb2_request_dispatch: opcode[SMB2_OP_SESSSETUP] mid = 1
smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_MORE_PROCESSING_REQUIRED] body[8] dyn[yes:194] at ../source3/smbd/smb2_sesssetup.c:174
smbd_smb2_request idx[1] of 5 vectors
smbd_smb2_request_dispatch: opcode[SMB2_OP_SESSSETUP] mid = 2
smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[1] status[NT_STATUS_LOGON_FAILURE] || at ../source3/smbd/smb2_sesssetup.c:137
smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_LOGON_FAILURE] body[8] dyn[yes:1] at ../source3/smbd/smb2_server.c:3219
smbd_server_connection_terminate_ex: conn[ipv4:xxx.xxx.xxx.xxx:57054] reason[NT_STATUS_END_OF_FILE] at ../source3/smbd/smb2_server.c:3986
从我的 linux 客户端，我可以使用我的 ActiveDirectory 凭据通过 SSH 连接服务器。
我真的不知道还能做什么。
更新 1
连接此共享时，域控制器收到我的登录请求并接受密码。所以，问题不在这一边。我还尝试在挂载选项中添加 uid=(id from my account,0,root) 但没有成功
更新 2
我可以在使用 kinit 创建 kerberos 票证并添加sec=krb5挂载选项后挂载此共享。总比没有好，但为什么会这样？！
更新 3
好的，在我阅读了所有文档之后，似乎针对活动目录和 kerberos 进行身份验证的唯一解决方案是首先使用 kinit 创建 krb 票证，然后使用-o sec=krb5选项挂载共享。老实说，我不明白为什么当 OSX 不这样做时 linux 会这样做，但无论如何......现在，我没有任何其他解决方案......
我发现这篇文章可以帮助您挂载 SMB 共享。
我相信这个问题与 Kerberos 有关，Sebastian Stark 很好地解释了我想说的内容。
| 归档时间： |
|
| 查看次数： |
2339 次 |
| 最近记录： |