免责声明：
我仍在努力充分学习和理解如何正确维护 Samba 域控制器。
问题：
我曾安装过带 AD 控制器的 samba，但现在，距离我最后一台电脑加入仅一个月，它就无法正常工作了。在 Windows 上，它显示“未知用户或密码”，但我已经检查过它们是正确的。
我尝试在“smb.conf”中将日志级别设置为 3，并在尝试加入计算机时记录了以下内容：
[2022/10/04 12:11:58.018256, 3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: AS-REQ [email protected] from ipv4:172.27.2.58:50124 for krbtgt/[email protected]
[2022/10/04 12:11:58.039839, 3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Client sent patypes: 128
[2022/10/04 12:11:58.040080, 3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Looking for PKINIT pa-data -- [email protected]
[2022/10/04 12:11:58.040191, 3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Looking for ENC-TS pa-data -- [email protected]
[2022/10/04 12:11:58.040341, 3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: No preauth found, returning PREAUTH-REQUIRED -- [email protected]
[2022/10/04 12:11:58.043598, 3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/04 12:11:58.054880, 3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: AS-REQ [email protected] from ipv4:172.27.2.58:50125 for krbtgt/[email protected]
[2022/10/04 12:11:58.076255, 3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Client sent patypes: encrypted-timestamp, 128
[2022/10/04 12:11:58.076483, 3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Looking for PKINIT pa-data -- [email protected]
[2022/10/04 12:11:58.076587, 3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Looking for ENC-TS pa-data -- [email protected]
[2022/10/04 12:11:58.077527, 3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: ENC-TS Pre-authentication succeeded -- [email protected] using aes256-cts-hmac-sha1-96
[2022/10/04 12:11:58.077840, 3] ../../auth/auth_log.c:635(log_authentication_event_human_readable)
Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)]\[[email protected]] at [Tue, 04 Oct 2022 12:11:58.077747 CEST] with [aes256-cts-hmac-sha1-96] status [NT_STATUS_OK] workstation [(null)] remote host [ipv4:172.27.2.58:50125] became [EXAMPLE]\[admuser] [S-1-5-21-578677625-3635414378-1858279571-1104]. local host [NULL]
{"timestamp": "2022-10-04T12:11:58.086113+0200", "type": "Authentication", "Authentication": {"version": {"major": 1, "minor": 2}, "eventId": 4624, "logonId": "c61be2b0d84a3e12", "logonType": 3, "status": "NT_STATUS_OK", "localAddress": null, "remoteAddress": "ipv4:172.27.2.58:50125", "serviceDescription": "Kerberos KDC", "authDescription": "ENC-TS Pre-authentication", "clientDomain": null, "clientAccount": "[email protected]", "workstation": null, "becameAccount": "admuser", "becameDomain": "EXAMPLE", "becameSid": "S-1-5-21-578677625-3635414378-1858279571-1104", "mappedAccount": "admuser", "mappedDomain": "EXAMPLE", "netlogonComputer": null, "netlogonTrustAccount": null, "netlogonNegotiateFlags": "0x00000000", "netlogonSecureChannelType": 0, "netlogonTrustAccountSid": null, "passwordType": "aes256-cts-hmac-sha1-96", "duration": 31663}}
[2022/10/04 12:11:58.160727, 3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: AS-REQ authtime: 2022-10-04T12:11:58 starttime: unset endtime: 2022-10-04T22:11:58 renew till: 2022-10-11T12:11:58
[2022/10/04 12:11:58.161033, 3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, arcfour-hmac-md5, 24, -135, 3, using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96
[2022/10/04 12:11:58.161206, 3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Requested flags: renewable-ok, canonicalize, renewable, forwardable
[2022/10/04 12:11:58.165799, 3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/04 12:11:58.178036, 3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Failed to verify authenticator checksum: Decrypt integrity check failed for checksum type rsa-md5, key type aes256-cts-hmac-sha1-96
[2022/10/04 12:11:58.178282, 3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Failed parsing TGS-REQ from ipv4:172.27.2.58:50126
如您所见，此处报告身份验证成功。到目前为止，它与这里，因此我尝试了以下命令：
root@SMBDC1:~# host -t SRV _ldap._tcp.example.net
_ldap._tcp.example.net has SRV record 0 100 389 smbdc1.example.net.
root@SMBDC1:~# host -t SRV _kerebros._udp.example.net
Host _kerebros._udp.example.net not found: 3(NXDOMAIN)
root@SMBDC1:~# host -t A focal.exapmle.net
Host focal.example.net not found: 3(NXDOMAIN)
root@SMBDC1:~# dig -t SRV _kerebros._udp.frankini.net
; <<>> DiG 9.16.1-Ubuntu <<>> -t SRV _kerebros._udp.frankini.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 138
;; flags: qr aa rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;_kerebros._udp.frankini.net. IN SRV
;; AUTHORITY SECTION:
frankini.net. 3600 IN SOA
smbdc1.frankini.net. hostmaster. frankini.net. 55 900 600 86400 3600
;; Query time: 3 msec
;; SERVER: 172.27.1.1#53(172.27.1.1)
;; WHEN: Fri Oct 07 21:44:12 CEST 2022
;; MSG SIZE rcvd: 99
这最初有效但现在我得到“主机未找到“……什么可能改变呢？
我的设置
router: 172.27.0.1
smbdc: 172.27.1.1
dns: 172.27.1.2
dhcp range: 172.27.2.2 - 172.27.2.254
Samba runs on an Orange Pi Zero and I connect to it through Putty and FileZilla
I route communication between the xxx.xxx.0.xxx, xxx.xxx.1.xxx and xxx.xxx.2.xxx ip ranges and set the network mask to be 255.255.0.0
系统
OS: Armbian 22.05.3 Focal with Linux 5.15.48-sunxi
SAMBA: Samba version 4.13.17-Ubuntu
smb配置文件
# Global parameters
[global]
dns forwarder = 172.27.1.2
netbios name = SMBDC1
realm = EXAMPLE.NET
server role = active directory domain controller
workgroup = EXAMPLE
idmap_ldb:use rfc2307 = yes
host msdfs = yes
log level = 3
[sysvol]
path = /var/lib/samba/sysvol
read only = No
[netlogon]
path = /var/lib/samba/sysvol/example.net/scripts
read only = No
问题：
我认为 focal.exapmle.net 和 _kerebros._udp.example.net 的 DNS 记录不再设置，因此：
1 - 它们是用来做什么的？我认为 Kerebros 是连接 Linux Samba 和 Windows 的部分，对吗？
2 – 它们是 Samba 机器的本地 DNS 吗？
3——我可以以某种方式将它们添加回 DNS 记录吗？