1

Yesterday I configured an Active Directory Server using Arch Linux and Samba 4 following this guide.

I even added a client to the domain and was able to log in successfuly on my client. After a restart it no longer works, I can't use Microsoft RSAT anymore and I tracked down this problem to the kinit administrator@INTERNAL.CORE.COM instruction which returns:

Cannot contact any KDC for realm 'INTERNAL.CORP.COM' while getting initial credentials

Trying to solve my problem I tried googling around and found this:

kinit(v5): Cannot contact any KDC for requested realm while getting initial credentials

The application cannot find the kerberos server. Check firewall, DNS and /etc/hosts.

But, as pointed by the Arch Linux Tutorial posted adobe I tried some commands to test connection:

# host -t SRV _ldap._tcp.internal.corp.com.
# host -t SRV _kerberos._udp.internal.corp.com.
# host -t A core.internal.corp.com.  #core is my server hostname

Which returned:

_ldap._tcp.internal.corp.com has SRV record 0 100 389 core.internal.corp.com.
_kerberos._udp.internal.corp.com has SRV record 0 100 88 core.internal.corp.com.
core.internal.corp.com has address 192.168.0.75

As you can see on my second command it seems that I actually can reach the kerberos service.

Here are some of my config files:

/etc/krb5.conf (copied from /var/lib/samba/private/krb5.conf as pointed on the tutorial )

[libdefaults]
    default_realm = INTERNAL.CORP.COM
    dns_lookup_realm = false
    dns_lookup_kdc = true

/etc/resolv.conf

# Generated by resolvconf
nameserver 192.168.0.75
nameserver 8.8.8.8
search internal.corp
namserver 127.0.0.1

My server hostname is CORE. My NetBIOS Domain is CORP. My DNS Domain is internal.corp.com

I'm out of ideas, any help would be appreciated.

Jim B
  • 23,938
  • 4
  • 35
  • 58
Jose_Sunstrider
  • 51
  • 1
  • 1
  • 8

2 Answers2

3

Searching a little bit more I found a solution to my problem. As posted here, all I needed to do was changing my samba configuration:

/etc/samba/smb.conf Where I added this line into the [global] section.

server services = rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbind, ntp_signd, kcc, dnsupdate, dns, s3fs

Jose_Sunstrider
  • 51
  • 1
  • 1
  • 8
0

I am not sure if this helps, but it is very important to set the nameserver in /etc/resolv.conf to the same IP as samba ad dc like stated here:

The 'nameserver' you set in '/etc/resolv.conf' must be an AD DC, otherwise the join will not be able to find the KDC.

https://wiki.samba.org/index.php/Joining_a_Samba_DC_to_an_Existing_Active_Directory#Configuring_DNS

Anton Sinelnyk
  • 101