Windows 客户端无法再加入 samba 域

Windows 客户端无法再加入 samba 域

免责声明:
我仍在努力充分学习和理解如何正确维护 Samba 域控制器。

问题:

我曾安装过带 AD 控制器的 samba,但现在,距离我最后一台电脑加入仅一个月,它就无法正常工作了。在 Windows 上,它显示“未知用户或密码”,但我已经检查过它们是正确的。

我尝试在“smb.conf”中将日志级别设置为 3,并在尝试加入计算机时记录了以下内容:

[2022/10/04 12:11:58.018256,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ [email protected] from ipv4:172.27.2.58:50124 for krbtgt/[email protected]
[2022/10/04 12:11:58.039839,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: 128
[2022/10/04 12:11:58.040080,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- [email protected]
[2022/10/04 12:11:58.040191,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- [email protected]
[2022/10/04 12:11:58.040341,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: No preauth found, returning PREAUTH-REQUIRED -- [email protected]
[2022/10/04 12:11:58.043598,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/04 12:11:58.054880,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ [email protected] from ipv4:172.27.2.58:50125 for krbtgt/[email protected]
[2022/10/04 12:11:58.076255,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: encrypted-timestamp, 128
[2022/10/04 12:11:58.076483,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- [email protected]
[2022/10/04 12:11:58.076587,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- [email protected]
[2022/10/04 12:11:58.077527,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: ENC-TS Pre-authentication succeeded -- [email protected] using aes256-cts-hmac-sha1-96
[2022/10/04 12:11:58.077840,  3] ../../auth/auth_log.c:635(log_authentication_event_human_readable)
  Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)]\[[email protected]] at [Tue, 04 Oct 2022 12:11:58.077747 CEST] with [aes256-cts-hmac-sha1-96] status [NT_STATUS_OK] workstation [(null)] remote host [ipv4:172.27.2.58:50125] became [EXAMPLE]\[admuser] [S-1-5-21-578677625-3635414378-1858279571-1104]. local host [NULL] 
  {"timestamp": "2022-10-04T12:11:58.086113+0200", "type": "Authentication", "Authentication": {"version": {"major": 1, "minor": 2}, "eventId": 4624, "logonId": "c61be2b0d84a3e12", "logonType": 3, "status": "NT_STATUS_OK", "localAddress": null, "remoteAddress": "ipv4:172.27.2.58:50125", "serviceDescription": "Kerberos KDC", "authDescription": "ENC-TS Pre-authentication", "clientDomain": null, "clientAccount": "[email protected]", "workstation": null, "becameAccount": "admuser", "becameDomain": "EXAMPLE", "becameSid": "S-1-5-21-578677625-3635414378-1858279571-1104", "mappedAccount": "admuser", "mappedDomain": "EXAMPLE", "netlogonComputer": null, "netlogonTrustAccount": null, "netlogonNegotiateFlags": "0x00000000", "netlogonSecureChannelType": 0, "netlogonTrustAccountSid": null, "passwordType": "aes256-cts-hmac-sha1-96", "duration": 31663}}
[2022/10/04 12:11:58.160727,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ authtime: 2022-10-04T12:11:58 starttime: unset endtime: 2022-10-04T22:11:58 renew till: 2022-10-11T12:11:58
[2022/10/04 12:11:58.161033,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, arcfour-hmac-md5, 24, -135, 3, using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96
[2022/10/04 12:11:58.161206,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Requested flags: renewable-ok, canonicalize, renewable, forwardable
[2022/10/04 12:11:58.165799,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/04 12:11:58.178036,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed to verify authenticator checksum: Decrypt integrity check failed for checksum type rsa-md5, key type aes256-cts-hmac-sha1-96
[2022/10/04 12:11:58.178282,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed parsing TGS-REQ from ipv4:172.27.2.58:50126

如您所见,此处报告身份验证成功。到目前为止,它与这里,因此我尝试了以下命令:

 root@SMBDC1:~# host -t SRV _ldap._tcp.example.net
    _ldap._tcp.example.net has SRV record 0 100 389 smbdc1.example.net.
 root@SMBDC1:~# host -t SRV _kerebros._udp.example.net
    Host _kerebros._udp.example.net not found: 3(NXDOMAIN)
 root@SMBDC1:~# host -t A focal.exapmle.net
    Host focal.example.net not found: 3(NXDOMAIN)
    
 root@SMBDC1:~# dig -t SRV _kerebros._udp.frankini.net
    
    ; <<>> DiG 9.16.1-Ubuntu <<>> -t SRV _kerebros._udp.frankini.net
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 138
    ;; flags: qr aa rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
    
    ;; QUESTION SECTION:
    ;_kerebros._udp.frankini.net.   IN      SRV
    
    ;; AUTHORITY SECTION:
    frankini.net.           3600    IN      SOA        
    smbdc1.frankini.net. hostmaster.        frankini.net. 55 900 600 86400 3600
    
    ;; Query time: 3 msec
    ;; SERVER: 172.27.1.1#53(172.27.1.1)
    ;; WHEN: Fri Oct 07 21:44:12 CEST 2022
    ;; MSG SIZE  rcvd: 99

这最初有效但现在我得到“主机未找到“……什么可能改变呢?

我的设置

router:     172.27.0.1
smbdc:      172.27.1.1
dns:        172.27.1.2

dhcp range: 172.27.2.2 - 172.27.2.254

Samba runs on an Orange Pi Zero and I connect to it through Putty and FileZilla

I route communication between the xxx.xxx.0.xxx, xxx.xxx.1.xxx and xxx.xxx.2.xxx ip ranges and set the network mask to be 255.255.0.0

系统

 OS:    Armbian 22.05.3 Focal with Linux 5.15.48-sunxi
 SAMBA: Samba version 4.13.17-Ubuntu

smb配置文件

# Global parameters
[global]
    dns forwarder = 172.27.1.2
    netbios name = SMBDC1
    realm = EXAMPLE.NET
    server role = active directory domain controller
    workgroup = EXAMPLE
    idmap_ldb:use rfc2307 = yes
    host msdfs = yes
    log level = 3

[sysvol]
    path = /var/lib/samba/sysvol
    read only = No

[netlogon]
    path = /var/lib/samba/sysvol/example.net/scripts
    read only = No

更新:

我制作了磁盘映像作为备份,然后进行了一系列测试,但没有成功。所以我最终将映像恢复到原来的磁盘,现在这些命令突然起作用了:

root@SMBDC1:~# host -t SRV _ldap._tcp.example.net
    _ldap._tcp.example.net has SRV record 0 100 389 smbdc1.example.net.
root@SMBDC1:~# host -t SRV _kerberos._udp.example.net
    _kerberos._udp.example.net has SRV record 0 100 88 smbdc1.example.net.
root@SMBDC1:~# host -t A SMBDC1.example.net
    SMBDC1.example.net has address 172.27.1.4

现在的情况如下:

我添加了计算机“测试-W11“使用我的域管理员用户而不是‘管理员’访问域。只有当我这样做时它才有效”[电子邮件保护]“而不是“用户”,以前可以使用。如果有人问,是的,我也尝试过使用管理员,但它只能作为“[电子邮件保护]

计算机重新启动后,我尝试登录,但系统显示用户或密码错误。

这是登录尝试的日志文件:

[2022/10/12 19:39:25.980185,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ user2@EXAMPLE from ipv4:172.27.2.26:50574 for krbtgt/EXAMPLE@EXAMPLE
[2022/10/12 19:39:26.008882,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: 128
[2022/10/12 19:39:26.009229,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- user2@EXAMPLE
[2022/10/12 19:39:26.009433,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- user2@EXAMPLE
[2022/10/12 19:39:26.009709,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: No preauth found, returning PREAUTH-REQUIRED -- user2@EXAMPLE
[2022/10/12 19:39:26.013190,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.024021,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ user2@EXAMPLE from ipv4:172.27.2.26:50575 for krbtgt/EXAMPLE@EXAMPLE
[2022/10/12 19:39:26.051743,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: encrypted-timestamp, 128
[2022/10/12 19:39:26.052093,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- user2@EXAMPLE
[2022/10/12 19:39:26.052302,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- user2@EXAMPLE
[2022/10/12 19:39:26.052948,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: ENC-TS Pre-authentication succeeded -- user2@EXAMPLE using aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.053349,  3] ../../auth/auth_log.c:635(log_authentication_event_human_readable)
  Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)]\ [user2@EXAMPLE] at [Wed, 12 Oct 2022 19:39:26.053205 CEST] with [aes256-cts-hmac-sha1-96] status [NT_STATUS_OK] workstation [(null)] remote host [ipv4:172.27.2.26:50575] became [EXAMPLE]\[user2] [S-1-5-21-578677625-3635414378-1858279571-1105]. local host [NULL] 
  {"timestamp": "2022-10-12T19:39:26.053767+0200", "type": "Authentication", "Authentication": {"version": {"major": 1, "minor": 2}, "eventId": 4624, "logonId": "d3433331ec6a5bf7", "logonType": 3, "status": "NT_STATUS_OK", "localAddress": null, "remoteAddress": "ipv4:172.27.2.26:50575", "serviceDescription": "Kerberos KDC", "authDescription": "ENC-TS Pre-authentication", "clientDomain": null, "clientAccount": "user2@EXAMPLE", "workstation": null, "becameAccount": "user2", "becameDomain": "EXAMPLE", "becameSid": "S-1-5-21-578677625-3635414378-1858279571-1105", "mappedAccount": "user2", "mappedDomain": "EXAMPLE", "netlogonComputer": null, "netlogonTrustAccount": null, "netlogonNegotiateFlags": "0x00000000", "netlogonSecureChannelType": 0, "netlogonTrustAccountSid": null, "passwordType": "aes256-cts-hmac-sha1-96", "duration": 30203}}
[2022/10/12 19:39:26.089947,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ authtime: 2022-10-12T19:39:26 starttime: unset endtime: 2022-10-13T05:39:26 renew till: 2022-10-19T19:39:26
[2022/10/12 19:39:26.090338,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, arcfour-hmac-md5, 24, -135, 3, using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.090474,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Requested flags: renewable-ok, canonicalize, renewable, forwardable
[2022/10/12 19:39:26.097520,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.106943,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed to verify authenticator checksum: Decrypt integrity check failed for checksum type rsa-md5, key type aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.107170,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed parsing TGS-REQ from ipv4:172.27.2.26:50576
[2022/10/12 19:39:26.110456,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.114239,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ [email protected] from ipv4:172.27.2.26:50577 for krbtgt/[email protected]
[2022/10/12 19:39:26.127198,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: 128
[2022/10/12 19:39:26.127410,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- [email protected]
[2022/10/12 19:39:26.127580,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- [email protected]
[2022/10/12 19:39:26.127768,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: No preauth found, returning PREAUTH-REQUIRED -- [email protected]
[2022/10/12 19:39:26.130816,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.140450,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ [email protected] from ipv4:172.27.2.26:50578 for krbtgt/[email protected]
[2022/10/12 19:39:26.152897,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: encrypted-timestamp, 128
[2022/10/12 19:39:26.153102,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- [email protected]
[2022/10/12 19:39:26.153210,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- [email protected]
[2022/10/12 19:39:26.153583,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: ENC-TS Pre-authentication succeeded -- [email protected] using aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.153816,  3] ../../auth/auth_log.c:635(log_authentication_event_human_readable)
  Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)]\[[email protected]] at [Wed, 12 Oct 2022 19:39:26.153732 CEST] with [aes256-cts-hmac-sha1-96] status [NT_STATUS_OK] workstation [(null)] remote host [ipv4:172.27.2.26:50578] became [EXAMPLE]\[user2] [S-1-5-21-578677625-3635414378-1858279571-1105]. local host [NULL]
  {"timestamp": "2022-10-12T19:39:26.154039+0200", "type": "Authentication", "Authentication": {"version": {"major": 1, "minor": 2}, "eventId": 4624, "logonId": "869dfe1fc68f82a8", "logonType": 3, "status": "NT_STATUS_OK", "localAddress": null, "remoteAddress": "ipv4:172.27.2.26:50578", "serviceDescription": "Kerberos KDC", "authDescription": "ENC-TS Pre-authentication", "clientDomain": null, "clientAccount": "[email protected]", "workstation": null, "becameAccount": "user2", "becameDomain": "EXAMPLE", "becameSid": "S-1-5-21-578677625-3635414378-1858279571-1105", "mappedAccount": "user2", "mappedDomain": "EXAMPLE", "netlogonComputer": null, "netlogonTrustAccount": null, "netlogonNegotiateFlags": "0x00000000", "netlogonSecureChannelType": 0, "netlogonTrustAccountSid": null, "passwordType": "aes256-cts-hmac-sha1-96", "duration": 13913}}
[2022/10/12 19:39:26.182189,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ authtime: 2022-10-12T19:39:26 starttime: unset endtime: 2022-10-13T05:39:26 renew till: 2022-10-19T19:39:26
[2022/10/12 19:39:26.182483,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, arcfour-hmac-md5, 24, -135, 3, using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.182612,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Requested flags: renewable-ok, canonicalize, renewable, forwardable
[2022/10/12 19:39:26.187831,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.197162,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed to verify authenticator checksum: Decrypt integrity check failed for checksum type rsa-md5, key type aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.197385,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed parsing TGS-REQ from ipv4:172.27.2.26:50579
[2022/10/12 19:39:26.202216,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.206268,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ [email protected] from ipv4:172.27.2.26:50580 for krbtgt/[email protected]
[2022/10/12 19:39:26.218896,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: 128
[2022/10/12 19:39:26.219112,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- [email protected]
[2022/10/12 19:39:26.219220,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- [email protected]
[2022/10/12 19:39:26.219367,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: No preauth found, returning PREAUTH-REQUIRED -- [email protected]
[2022/10/12 19:39:26.226212,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.236585,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ [email protected] from ipv4:172.27.2.26:50581 for krbtgt/[email protected]
[2022/10/12 19:39:26.249060,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: encrypted-timestamp, 128
[2022/10/12 19:39:26.249272,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- [email protected]
[2022/10/12 19:39:26.249377,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- [email protected]
[2022/10/12 19:39:26.249842,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: ENC-TS Pre-authentication succeeded -- [email protected] using aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.250084,  3] ../../auth/auth_log.c:635(log_authentication_event_human_readable)
  Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)]\[[email protected]] at [Wed, 12 Oct 2022 19:39:26.250002 CEST] with [aes256-cts-hmac-sha1-96] status [NT_STATUS_OK] workstation [(null)] remote host [ipv4:172.27.2.26:50581] became [EXAMPLE]\[user2] [S-1-5-21-578677625-3635414378-1858279571-1105]. local host [NULL] 
  {"timestamp": "2022-10-12T19:39:26.250309+0200", "type": "Authentication", "Authentication": {"version": {"major": 1, "minor": 2}, "eventId": 4624, "logonId": "b111aea5f91526ac", "logonType": 3, "status": "NT_STATUS_OK", "localAddress": null, "remoteAddress": "ipv4:172.27.2.26:50581", "serviceDescription": "Kerberos KDC", "authDescription": "ENC-TS Pre-authentication", "clientDomain": null, "clientAccount": "[email protected]", "workstation": null, "becameAccount": "user2", "becameDomain": "EXAMPLE", "becameSid": "S-1-5-21-578677625-3635414378-1858279571-1105", "mappedAccount": "user2", "mappedDomain": "EXAMPLE", "netlogonComputer": null, "netlogonTrustAccount": null, "netlogonNegotiateFlags": "0x00000000", "netlogonSecureChannelType": 0, "netlogonTrustAccountSid": null, "passwordType": "aes256-cts-hmac-sha1-96", "duration": 13999}}
[2022/10/12 19:39:26.278425,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ authtime: 2022-10-12T19:39:26 starttime: unset endtime: 2022-10-13T05:39:26 renew till: 2022-10-19T19:39:26
[2022/10/12 19:39:26.278721,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, arcfour-hmac-md5, 24, -135, 3, using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.278850,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Requested flags: renewable-ok, canonicalize, renewable, forwardable
[2022/10/12 19:39:26.284069,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.293333,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed to verify authenticator checksum: Decrypt integrity check failed for checksum type rsa-md5, key type aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.293567,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed parsing TGS-REQ from ipv4:172.27.2.26:50582
[2022/10/12 19:39:26.297119,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.301280,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ [email protected] from ipv4:172.27.2.26:50583 for krbtgt/[email protected]
[2022/10/12 19:39:26.314043,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: 128
[2022/10/12 19:39:26.314253,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- [email protected]
[2022/10/12 19:39:26.314361,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- [email protected]
[2022/10/12 19:39:26.314507,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: No preauth found, returning PREAUTH-REQUIRED -- [email protected]
[2022/10/12 19:39:26.317995,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.328064,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ [email protected] from ipv4:172.27.2.26:50584 for krbtgt/[email protected]
[2022/10/12 19:39:26.340620,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: encrypted-timestamp, 128
[2022/10/12 19:39:26.340832,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- [email protected]
[2022/10/12 19:39:26.340934,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- [email protected]
[2022/10/12 19:39:26.341304,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: ENC-TS Pre-authentication succeeded -- [email protected] using aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.341534,  3] ../../auth/auth_log.c:635(log_authentication_event_human_readable)
  Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)]\[[email protected]] at [Wed, 12 Oct 2022 19:39:26.341453 CEST] with [aes256-cts-hmac-sha1-96] status [NT_STATUS_OK] workstation [(null)] remote host [ipv4:172.27.2.26:50584] became [EXAMPLE]\[user2] [S-1-5-21-578677625-3635414378-1858279571-1105]. local host [NULL] 
  {"timestamp": "2022-10-12T19:39:26.341761+0200", "type": "Authentication", "Authentication": {"version": {"major": 1, "minor": 2}, "eventId": 4624, "logonId": "4baa7d35daccf446", "logonType": 3, "status": "NT_STATUS_OK", "localAddress": null, "remoteAddress": "ipv4:172.27.2.26:50584", "serviceDescription": "Kerberos KDC", "authDescription": "ENC-TS Pre-authentication", "clientDomain": null, "clientAccount": "[email protected]", "workstation": null, "becameAccount": "user2", "becameDomain": "EXAMPLE", "becameSid": "S-1-5-21-578677625-3635414378-1858279571-1105", "mappedAccount": "user2", "mappedDomain": "EXAMPLE", "netlogonComputer": null, "netlogonTrustAccount": null, "netlogonNegotiateFlags": "0x00000000", "netlogonSecureChannelType": 0, "netlogonTrustAccountSid": null, "passwordType": "aes256-cts-hmac-sha1-96", "duration": 13987}}
[2022/10/12 19:39:26.369985,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ authtime: 2022-10-12T19:39:26 starttime: unset endtime: 2022-10-13T05:39:26 renew till: 2022-10-19T19:39:26
[2022/10/12 19:39:26.370274,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, arcfour-hmac-md5, 24, -135, 3, using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.370405,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Requested flags: renewable-ok, canonicalize, renewable, forwardable
[2022/10/12 19:39:26.375775,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/12 19:39:26.385121,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed to verify authenticator checksum: Decrypt integrity check failed for checksum type rsa-md5, key type aes256-cts-hmac-sha1-96
[2022/10/12 19:39:26.385343,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed parsing TGS-REQ from ipv4:172.27.2.26:50585
[2022/10/12 19:39:26.388686,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'

日志文件里有什么错误吗?

答案1

这是不是似曾相识?我以为我回答过这个问题,要么是你打字太粗,要么是你拼错了 kerberos 和 example。你的主要问题是,除非你使用“管理员”,否则你无法将计算机加入 SAMBA 域。Windows 允许任何人加入计算机,但 Samba 不允许。这里真的不是讨论这个问题的地方,我建议你去这里: https://lists.samba.org/mailman/listinfo/samba

订阅 samba 邮件列表并来那里与我讨论。

答案2

重定向后这里经过罗兰,我能够立即联系到发现问题的人!

Windows11 版本 22H2 与 Samba 4.15 不兼容,我现在正尝试升级到 Samba 4.16 来修复它!

...碰巧我尝试加入域的所有 PC 都是全新安装的 Win11,所以我从未发现差异(仍然适用于旧版本的 Windows)。

相关内容