![无法使用 realmd 将 Fedora 20 计算机加入 Active Directory RODC](https://linux22.com/image/626768/%E6%97%A0%E6%B3%95%E4%BD%BF%E7%94%A8%20realmd%20%E5%B0%86%20Fedora%2020%20%E8%AE%A1%E7%AE%97%E6%9C%BA%E5%8A%A0%E5%85%A5%20Active%20Directory%20RODC.png)
我对 Active Directory 了解不多,但我对它的功能有一些基本了解。我一直试图将 Fedora 20 机器加入域,但遇到了一些问题。我运行了以下命令realm
:
sudo realm join -v -U [admin user] [hostname of RODC]
由于某种原因,我必须使用只读域控制器的主机名。如果我使用域名,则会收到以下错误:
* Resolving: _ldap._tcp.[domain]
! Discovery timed out after 15 seconds
如果我指定了 RODC 的主机名,一切都会顺利进行:它会解析、要求输入命令中指定的管理员用户的密码、进行身份验证,但在设置计算机帐户的密码时失败:
* Resolving: _ldap._tcp.[RODC host name]
* Resolving: [RODC host name]
* Performing LDAP DSE lookup on: [internal IP of RODC]
* Successfully discovered: [domain]
Password for [domain admin]:
* Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/sbin/adcli
* LANG=C /usr/sbin/adcli join --verbose --domain [domain] --domain-realm [domain, in caps] --domain-controller [internal IP of RODC] --login-type user --login-user [domain admin] --stdin-password
* Using domain name: [domain]
* Calculated computer account name from fqdn: [machine host name, in caps/computer account]
* Using domain realm: [domain]
* Sending cldap pings to domain controller: [internal IP of RODC]
* Received NetLogon info from: [host name of RODC, in caps].[domain]
* Wrote out krb5.conf snippet to /var/cache/realmd/adcli-krb5-pMXPuH/krb5.d/adcli-krb5-conf-OcXLS5
* Authenticated as user: [admin user]@[domain, in caps]
* Looked up short domain name: [short name]
* Using fully qualified name: [machine host name].[domain]
* Using domain name: [domain name]
* Using computer account name: [computer account]
* Using domain realm: [domain name]
* Enrolling computer account name calculated from fqdn: [computer account]
* Generated 120 character computer password
* Using keytab: FILE:/etc/krb5.keytab
* Using fully qualified name: [machine host name].[domain]
* Using domain name: [domain]
* Using computer account name: [computer account]
* Using domain realm: [domain]
* Looked up short domain name: [short name]
* Found computer account for [computer account]$ at: CN=[computer account],OU=[redacted] Computers,OU=[redacted],OU=[redacted],OU=[redacted],DC=[redacted],DC=[redacted],DC=[redacted]
! Couldn't set password for computer account: [computer account]$: Incorrect net address
adcli: joining domain [domain] failed: Couldn't set password for computer account: [computer account]$: Incorrect net address
! Failed to join the domain
realm: Couldn't join realm: Failed to join the domain
经过一番搜索,我发现了一个TechNet 文章提到“错误的网络地址”错误是 DNS 问题。我应该首先查找哪里来解决这个问题?
答案1
您看到此错误的原因是您无法写入 RODC 来创建密码。AD 在创建对象时会创建一个计算机密码,并在加入域时随机生成一个密码。
您必须依赖缓存服务器密码的 Kerberos,当您加入 RODC 时它不会提示您。首先在特定 Linux 服务器的可写 DC 上创建一个 keytab 文件,然后将其移动到那里,最好将/etc/krb5.keytab
权限设置为 600。
答案2
您将无法在 Active Directory RODC 上创建任何内容。RO 部分代表只读。与 Active Directory 管理员合作获取可写域控制器的主机名。