Не удается присоединиться к контроллеру домена Samba из Windows Server 2012
Я пытаюсь присоединиться к контроллеру домена Samba из новой установки Windows Server 2012. В этот домен много компьютеров, которые были присоединены много лет назад, но недавно у нас возникли проблемы с контроллером домена. По какой-то причине, которую мы не могли исправить, он перестал регистрировать людей в своих аккаунтах. Затем проблема каким-то образом решилась сама собой. Я считаю, что в сети ничего не изменилось, за исключением того, что есть вероятность, что серверы WINS будут остановлены / отключены, и они сказали нам больше не использовать их. Те люди, которые нам сказали, каким-то образом сумели присоединить другую машину к тому же домену с теми же настройками, которые я предоставлю ниже. Я не знаю, что происходит.
Я могу пинговать домен:
Pinging iits.*** [172.16.250.10] with 32 bytes of data:
Reply from 172.16.250.10: bytes=32 time<1ms TTL=64
Reply from 172.16.250.10: bytes=32 time<1ms TTL=64
Reply from 172.16.250.10: bytes=32 time<1ms TTL=64
nslookup тоже работает, но не хочет присоединяться к домену.
dcdiag /test:dns /s:iits /DnsBasic
Directory Server Diagnosis
Performing initial setup:
Ldap search capability attribute search failed on server iits.uni-ruse.bg,
return value = 81
Наша Samba регистрирует попытки, вот они (только для этой конкретной машины, к которой я пытался присоединиться):
[2020/02/01 20:07:26.676712, 3] lib/access.c:338(allow_access)
Allowed connection from 172.16.82.221 (172.16.82.221)
[2020/02/01 20:07:26.676871, 3] smbd/oplock.c:922(init_oplocks)
init_oplocks: initializing messages.
[2020/02/01 20:07:26.677002, 3] smbd/oplock_linux.c:239(linux_init_kernel_oplocks)
Linux kernel oplocks enabled
[2020/02/01 20:07:26.677128, 3] smbd/process.c:1662(process_smb)
Transaction 0 of length 72 (0 toread)
[2020/02/01 20:07:26.677193, 2] smbd/reply.c:553(reply_special)
netbios connect: name1=SRV 0x20 name2=VELIKOV 0x0
[2020/02/01 20:07:26.677262, 2] smbd/reply.c:573(reply_special)
netbios connect: local=srv remote=velikov, name type = 0
Это конфигурация машины, которую я хочу присоединить к домену:
IPv4 Address. . . . . . . . . . . : 172.16.82.221
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : 172.16.0.1
Это часть smb.conf. Я специально пометил некоторые поля знаком ***:
...
#======================= Global Settings =====================================
[global]
# ----------------------- Network Related Options -------------------------
#
# workgroup = NT-Domain-Name or Workgroup-Name, eg: MIDEARTH
#
# server string is the equivalent of the NT Description field
#
# netbios name can be used to specify a server name not tied to the hostname
#
# Interfaces lets you configure Samba to use multiple interfaces
# If you have multiple network interfaces then you can list the ones
# you want to listen on (never omit localhost)
#
# Hosts Allow/Hosts Deny lets you restrict who can connect, and you can
# specifiy it as a per share option as well
#
workgroup = IITS
server string =
# netbios name = SRV
interfaces = lo eth0 eth1
# hosts allow = 127. 172.16. 172.16.250.0/23
hosts allow = 127. 172.16.0.0/12 91.210.88.75
# --------------------------- Logging Options -----------------------------
#
# Log File let you specify where to put logs and how to split them up.
#
# Max Log Size let you specify the max size log files should reach
# logs split per machine
log file = /var/log/samba/%m.log
# max 50KB per log file, then rotate
; max log size = 50
log level = 3
# ----------------------- Standalone Server Options ------------------------
#
# Security can be set to user, share(deprecated) or server(deprecated)
#
# Backend to store user information in. New installations should
# use either tdbsam or ldapsam. smbpasswd is available for backwards
# compatibility. tdbsam requires no further configuration.
#security = user
#passdb backend = ***
# ----------------------- Domain Members Options ------------------------
#
# Security must be set to domain or ads
#
# Use the realm option only with security = ads
# Specifies the Active Directory realm the host is part of
#
# Backend to store user information in. New installations should
# use either tdbsam or ldapsam. smbpasswd is available for backwards
# compatibility. tdbsam requires no further configuration.
#
# Use password server option only with security = server or if you can't
# use the DNS to locate Domain Controllers
# The argument list may include:
# password server = My_PDC_Name [My_BDC_Name] [My_Next_BDC_Name]
# or to auto-locate the domain controller/s
# password server = *
; security = domain
; passdb backend = ***
; realm = srv.iits.***
; password server = <NT-Server-Name>
# ----------------------- Domain Controller Options ------------------------
#
# Security must be set to user for domain controllers
#
# Backend to store user information in. New installations should
# use either tdbsam or ldapsam. smbpasswd is available for backwards
# compatibility. tdbsam requires no further configuration.
#
# Domain Master specifies Samba to be the Domain Master Browser. This
# allows Samba to collate browse lists between subnets. Don't use this
# if you already have a Windows NT domain controller doing this job
#
# Domain Logons let Samba be a domain logon server for Windows workstations.
#
# Logon Scrpit let yuou specify a script to be run at login time on the client
# You need to provide it in a share called NETLOGON
#
# Logon Path let you specify where user profiles are stored (UNC path)
#
# Various scripts can be used on a domain controller or stand-alone
# machine to add or delete corresponding unix accounts
#
security = user
passdb backend = ***
domain master = yes
domain logons = yes
logon drive = H:
# the login script name depends on the machine name
# logon script = %m.bat
# the login script name depends on the unix user used
logon script = %U.bat
# logon path = \\%L\Profiles\%u
logon path = \\%L\%U\Profile
add user script = /usr/sbin/useradd "%u" -n -g users
add group script = /usr/sbin/groupadd "%g"
add machine script = /usr/sbin/useradd -n -c "IITS Workstation (%u)" -M -d /dev/null -s /sbin/nologin "%u"
delete user script = /usr/sbin/userdel "%u"
delete user from group script = /usr/sbin/userdel "%u" "%g"
delete group script = /usr/sbin/groupdel "%g"
# ----------------------- Browser Control Options ----------------------------
#
# set local master to no if you don't want Samba to become a master
# browser on your network. Otherwise the normal election rules apply
#
# OS Level determines the precedence of this server in master browser
# elections. The default value should be reasonable
#
# Preferred Master causes Samba to force a local browser election on startup
# and gives it a slightly higher chance of winning the election
local master = yes
; os level = 33
; preferred master = yes
#----------------------------- Name Resolution -------------------------------
# Windows Internet Name Serving Support Section:
# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
#
# - WINS Support: Tells the NMBD component of Samba to enable it's WINS Server
#
# - WINS Server: Tells the NMBD components of Samba to be a WINS Client
#
# - WINS Proxy: Tells Samba to answer name resolution queries on
# behalf of a non WINS capable client, for this to work there must be
# at least one WINS Server on the network. The default is NO.
#
# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
# via DNS nslookups.
wins support = no
; wins server = 172.16.0.6 172.16.0.10
; wins proxy = yes
; dns proxy = yes
...
Любые идеи?