2

Newly built standalone AD DC (test bed in preparation for replacing venerable NT4 installation). Fresh and fully updated 4.3.11 on 16.04LTS. Followed Samba wikis, simple enough.

Haven't messed with smb.conf, per warnings:

[global]
        workgroup = REALM
        realm = REALM.DOMAIN.TLD
        netbios name = ADDC
        server role = active directory domain controller
        dns forwarder = 1.0.0.1
        idmap_ldb:use rfc2307 = yes

I stayed with Samba's internal DNS backend and Kerberos implementation. I directly copied the krb5.conf produced during provisioning to /etc, as specified:

[libdefaults]
        default_realm = REALM.DOMAIN.TLD
        dns_lookup_realm = false
        dns_lookup_kdc = true

Passing all "Setting up Samba as an Active Directory Domain Controller" wiki tests for "Verifying the File Server" and "Verifying DNS." By which I mean querying _ldap and _Kerberos SRV records as well as A record of ADDC is successful, and resolution works both ways:

$ host DC
DC.realm.domain.tld has address 10.10.10.100
$ host 10.10.10.100
100.10.10.10.in-addr.arpa domain name pointer DC.realm.domain.tld.

But "Verifying Kerberos" tests still fail:

$ kinit
kinit: Cannot contact any KDC for realm 'REALM.DOMAIN.TLD' while getting initial credentials

Obviously Kerberos is not reachable. $netstat shows no "krb" process listening on any port, including port 88. No firewall is running.

But for all the troubleshooting advice to verify that Kerberos is listening on port 88, I can find no direction about what to do if it isn't!

How do I get Samba's Kerberos running?

feldmrob
  • 41
  • 5
  • All the relevant Daemons are running, correct? – Davidw Jul 11 '18 at 04:27
  • 1
    Thanks Davidw for the prompt reply, and sorry for not saying so sooner. I'm on other projects and won't get right back to this one. Also sorry to have missed the obvious -- of course the most likely explanation is the one I somehow didn't think of. I'll research which daemon(s) should be running and fully expect to find they're not. – feldmrob Jul 14 '18 at 03:50
  • Thank you Davidw! It's still not obvious to me how I managed to get the Kerberos config and user auth modules installed without the pam module, but you put me on the right track and now all is well. – feldmrob Jul 17 '18 at 16:26

1 Answers1

2

Samba "Distribution-specific Package Installation" Wiki does not specify Active Directory installation requires explicit Kerberos installation on Ubuntu

But it is in Debian instructions, so I took a shot and now everything works:

  1. Installed missing libpam-krb5

  2. Re-provisioned domain

feldmrob
  • 41
  • 5