☰

无法使用 realmd 将 Fedora 20 计算机加入 Active Directory RODC

tag-icon • tag-icon domain-name-system active-directory fedora
无法使用 realmd 将 Fedora 20 计算机加入 Active Directory RODC

我对 Active Directory 了解不多，但我对它的功能有一些基本了解。我一直试图将 Fedora 20 机器加入域，但遇到了一些问题。我运行了以下命令realm：

sudo realm join -v -U [admin user] [hostname of RODC]

由于某种原因，我必须使用只读域控制器的主机名。如果我使用域名，则会收到以下错误：

 * Resolving: _ldap._tcp.[domain]
 ! Discovery timed out after 15 seconds

如果我指定了 RODC 的主机名，一切都会顺利进行：它会解析、要求输入命令中指定的管理员用户的密码、进行身份验证，但在设置计算机帐户的密码时失败：

 * Resolving: _ldap._tcp.[RODC host name]
 * Resolving: [RODC host name]
 * Performing LDAP DSE lookup on: [internal IP of RODC]
 * Successfully discovered: [domain]
Password for [domain admin]: 
 * Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/sbin/adcli
 * LANG=C /usr/sbin/adcli join --verbose --domain [domain] --domain-realm [domain, in caps] --domain-controller [internal IP of RODC] --login-type user --login-user [domain admin] --stdin-password
 * Using domain name: [domain]
 * Calculated computer account name from fqdn: [machine host name, in caps/computer account]
 * Using domain realm: [domain]
 * Sending cldap pings to domain controller: [internal IP of RODC]
 * Received NetLogon info from: [host name of RODC, in caps].[domain]
 * Wrote out krb5.conf snippet to /var/cache/realmd/adcli-krb5-pMXPuH/krb5.d/adcli-krb5-conf-OcXLS5
 * Authenticated as user: [admin user]@[domain, in caps]
 * Looked up short domain name: [short name]
 * Using fully qualified name: [machine host name].[domain]
 * Using domain name: [domain name]
 * Using computer account name: [computer account]
 * Using domain realm: [domain name]
 * Enrolling computer account name calculated from fqdn: [computer account]
 * Generated 120 character computer password
 * Using keytab: FILE:/etc/krb5.keytab
 * Using fully qualified name: [machine host name].[domain]
 * Using domain name: [domain]
 * Using computer account name: [computer account]
 * Using domain realm: [domain]
 * Looked up short domain name: [short name]
 * Found computer account for [computer account]$ at: CN=[computer account],OU=[redacted] Computers,OU=[redacted],OU=[redacted],OU=[redacted],DC=[redacted],DC=[redacted],DC=[redacted]
 ! Couldn't set password for computer account: [computer account]$: Incorrect net address
adcli: joining domain [domain] failed: Couldn't set password for computer account: [computer account]$: Incorrect net address
 ! Failed to join the domain
realm: Couldn't join realm: Failed to join the domain

经过一番搜索，我发现了一个TechNet 文章提到“错误的网络地址”错误是 DNS 问题。我应该首先查找哪里来解决这个问题？

答案1

您看到此错误的原因是您无法写入 RODC 来创建密码。AD 在创建对象时会创建一个计算机密码，并在加入域时随机生成一个密码。

您必须依赖缓存服务器密码的 Kerberos，当您加入 RODC 时它不会提示您。首先在特定 Linux 服务器的可写 DC 上创建一个 keytab 文件，然后将其移动到那里，最好将/etc/krb5.keytab权限设置为 600。

答案2

您将无法在 Active Directory RODC 上创建任何内容。RO 部分代表只读。与 Active Directory 管理员合作获取可写域控制器的主机名。

相关内容