我正在尝试将新的 Ubuntu 16.04 LTS 服务器作为附加域控制器加入，但遇到了一些问题。
现有的主域控制器是另一个 Ubuntu 16.04 LTS 服务器，并且两台服务器上的 Samba 版本相同：
root@server-z1:/# samba -V
Version 4.6.7-Ubuntu
root@server-z2:/# samba -V
Version 4.6.7-Ubuntu
DNS 似乎正常运行server-z2：
root@server-z2:/# nslookup my.domain.name
Server: 192.168.70.201
Address: 192.168.70.201#53
Name: my.domain.name
Address: 192.168.70.202
Name: my.domain.name
Address: 192.168.70.201
root@server-z2:/# nslookup server-z1.my.domain.name
Server: 192.168.70.201
Address: 192.168.70.201#53
Name: server-z1.my.domain.name
Address: 192.168.70.201
Kerberos 初始票证似乎已正确获取：
root@server-z2:/# kinit me
[email protected]'s Password:
root@server-z2:/# klist
Credentials cache: FILE:/tmp/krb5cc_0
Principal: [email protected]
Issued Expires Principal
Jan 3 11:37:55 2018 Jan 3 21:37:53 2018 krbtgt/[email protected]
但是当我尝试加入域时出现以下错误：
root@server-z2:/# samba-tool domain join MY.DOMAIN.NAME DC -U"DOMAIN\me" --dns-backend=BIND9_DLZ --server='192.168.70.201'
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'spnego' registered
GENSEC backend 'schannel' registered
GENSEC backend 'naclrpc_as_system' registered
GENSEC backend 'sasl-EXTERNAL' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'ntlmssp_resume_ccache' registered
GENSEC backend 'http_basic' registered
GENSEC backend 'http_ntlm' registered
GENSEC backend 'krb5' registered
GENSEC backend 'fake_gssapi_krb5' registered
Cannot do GSSAPI to an IP address
Got challenge flags:
Got NTLMSSP neg_flags=0x62898235
Password for [DOMAIN\me]:
NTLMSSP: Set final flags:
Got NTLMSSP neg_flags=0x62088235
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088235
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088235
workgroup is DOMAIN
realm is my.domain.name
Adding CN=SERVER-Z2,OU=Domain Controllers,DC=my,DC=domain,DC=name
Adding CN=SERVER-Z2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=my,DC=domain,DC=name
Adding CN=NTDS Settings,CN=SERVER-Z2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=my,DC=domain,DC=name
Using binding ncacn_ip_tcp:192.168.70.201[,seal]
Cannot do GSSAPI to an IP address
Got challenge flags:
Got NTLMSSP neg_flags=0x62898235
NTLMSSP: Set final flags:
Got NTLMSSP neg_flags=0x62088235
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088235
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088235
Adding SPNs to CN=SERVER-Z2,OU=Domain Controllers,DC=my,DC=domain,DC=name
Setting account password for SERVER-Z2$
Enabling account
Adding DNS account CN=dns-SERVER-Z2,CN=Users,DC=my,DC=domain,DC=name with dns/ SPN
Setting account password for dns-SERVER-Z2
Calling bare provision
lpcfg_load: refreshing parameters from /etc/samba/smb.conf
Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up secrets.ldb
Setting up the registry
ldb_wrap open of hklm.ldb
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
partition_metadata: Migrating partition metadata: open of metadata.tdb gave: (null)
A Kerberos configuration suitable for Samba AD has been generated at /var/lib/samba/private/krb5.conf
Provision OK for domain DN DC=my,DC=domain,DC=name
Starting replication
Using binding ncacn_ip_tcp:192.168.70.201[,seal]
Cannot do GSSAPI to an IP address
Got challenge flags:
Got NTLMSSP neg_flags=0x62898235
NTLMSSP: Set final flags:
Got NTLMSSP neg_flags=0x62088235
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088235
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62088235
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain,DC=name] objects[402/1610] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain,DC=name] objects[804/1610] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain,DC=name] objects[1206/1610] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain,DC=name] objects[1608/1610] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain,DC=name] objects[1610/1610] linked_values[0/0]
Analyze and apply schema objects
Replicated 1610 objects (0 linked attributes) for CN=Schema,CN=Configuration,DC=my,DC=domain,DC=name
Partition[CN=Configuration,DC=my,DC=domain,DC=name] objects[402/1686] linked_values[0/1]
Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=my,DC=domain,DC=name
Partition[CN=Configuration,DC=my,DC=domain,DC=name] objects[804/1686] linked_values[0/1]
Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=my,DC=domain,DC=name
Partition[CN=Configuration,DC=my,DC=domain,DC=name] objects[1206/1686] linked_values[0/1]
Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=my,DC=domain,DC=name
Partition[CN=Configuration,DC=my,DC=domain,DC=name] objects[1608/1686] linked_values[0/16]
Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=my,DC=domain,DC=name
Partition[CN=Configuration,DC=my,DC=domain,DC=name] objects[1686/1686] linked_values[48/48]
Replicated 78 objects (48 linked attributes) for CN=Configuration,DC=my,DC=domain,DC=name
Replicating critical objects from the base DN of the domain
Join failed - cleaning up
ldb_wrap open of secrets.ldb
Could not find machine account in secrets database: Failed to fetch machine account password for DOMAIN from both secrets.ldb (Could not find entry to match filter: '(&(flatname=DOMAIN)(objectclass=primaryDomain))' base: 'cn=Primary Domains': No such object: dsdb_search at ../source4/dsdb/common/util.c:4576) and from /var/lib/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
Deleted CN=SERVER-Z2,OU=Domain Controllers,DC=my,DC=domain,DC=name
Deleted CN=dns-SERVER-Z2,CN=Users,DC=my,DC=domain,DC=name
Deleted CN=NTDS Settings,CN=SERVER-Z2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=my,DC=domain,DC=name
Deleted CN=SERVER-Z2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=my,DC=domain,DC=name
ERROR(runtime): uncaught exception - (8409, 'WERR_DS_DATABASE_ERROR')
File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line 176, in _run
return self.run(*args, **kwargs)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/domain.py", line 661, in run
machinepass=machinepass, use_ntvfs=use_ntvfs, dns_backend=dns_backend)
File "/usr/lib/python2.7/dist-packages/samba/join.py", line 1269, in join_DC
ctx.do_join()
File "/usr/lib/python2.7/dist-packages/samba/join.py", line 1177, in do_join
ctx.join_replicate()
File "/usr/lib/python2.7/dist-packages/samba/join.py", line 903, in join_replicate
replica_flags=ctx.domain_replica_flags)
File "/usr/lib/python2.7/dist-packages/samba/drs_utils.py", line 254, in replicate
(level, ctr) = self.drs.DsGetNCChanges(self.drs_handle, req_level, req)
我用 Google 搜索并尝试了找到的所有解决方案，但没有任何帮助。
请问你能帮帮我吗？
多谢！
答案1
现有主域控制器 server-z1 上的以下命令解决了我的问题：
samba-tool dbcheck --fix
之后，我能够加入附加域控制器 server-z2 并且没有任何错误。
谢谢！