Linuxmuster-linuxclient7 setup schlägt fehl

Julian · 16. November 2021 um 15:29

Hallo liebe Community,

ich bin seit einiger Zeit dabei von 6.2 auf 7 zu migrieren. Ich bin jetzt dabei den ersten Linuxclient nach folgender Anleitung einzurichten: https://docs.linuxmuster.net/de/latest/clients/linux-clients/linux-client-current-method.html

linuxmuster-linuxclient7 setup schlägt bei mir letztendlich fehl, hier der output:

linuxadmin@og11-testrechner:~$ sudo linuxmuster-linuxclient7 setup
[INFO] #### linuxmuster-linuxclient7 setup ####
[INFO] Cleaning sssd cache.
[INFO] Stopping sssd
[INFO] Deleting old kerberos tickets.
[INFO] Cleaning / leaving all domain joins
[INFO] -> Done!
[INFO] Deleting krb5.keytab if it exists ... 
[INFO] Deleting old CA certificate if it exists ... 
[INFO] Deleting /etc/linuxmuster-linuxclient7/network.conf if exists ...
[INFO] Trying to discover available domains...
[INFO] Using first discovered domain linuxmuster.lan
[INFO] Preparing network configuration
[INFO] Writing new network Configuration
[INFO] Deleting obsolete files
[INFO] * /etc/profile.d/99-linuxmuster.sh
[INFO] * /etc/sudoers.d/linuxmuster
[INFO] * /etc/profile.d/linuxmuster-proxy.sh
[INFO] * /etc/bash_completion.d/99-linuxmuster-client-adsso.sh
[INFO] * /etc/profile.d/99-linuxmuster-client-adsso.sh
[INFO] * /etc/sudoers.d/linuxmuster-client-adsso
[INFO] * /usr/sbin/linuxmuster-client-adsso
[INFO] * /usr/sbin/linuxmuster-client-adsso-print-logs
[INFO] * /etc/systemd/system/linuxmuster-client-adsso.service
[INFO] * /home/linuxadmin/.config/autostart/linuxmuster-client-adsso-autostart.desktop
[INFO] * /etc/cups/client.conf
[INFO] * /usr/share/linuxmuster-linuxclient7/templates/linuxmuster-client-adsso.service
[INFO] * /usr/share/linuxmuster-linuxclient7/templates/linuxmuster-client-adsso-autostart.desktop
[INFO] * /etc/security/pam_mount.conf.xml
[INFO] * /usr/share/linuxmuster-linuxclient7/templates/pam_mount.conf.xml
[INFO] Deleting obsolete directories
[INFO] * /etc/linuxmuster-client
[INFO] * /etc/linuxmuster-client-adsso
[INFO] * /usr/share/linuxmuster-client-adsso
[INFO] Applying all configuration templates:
[INFO] * cifs.spnego.conf ...
[DEBUG] -> to /etc/request-key.d/cifs.spnego.conf
[INFO] * common-session ...
[DEBUG] -> to /etc/pam.d/common-session
[INFO] * greeter.dconf-defaults ...
[DEBUG] -> to /etc/gdm3/greeter.dconf-defaults
[INFO] * linuxmuster-linuxclient7.desktop ...
[DEBUG] -> to /home/linuxadmin/.config/autostart/linuxmuster-linuxclient7-autostart.desktop
[INFO] * linuxmuster-linuxclient7.service ...
[DEBUG] -> to /etc/systemd/system/linuxmuster-linuxclient7.service
[INFO] * timesyncd.conf ...
[DEBUG] -> to /etc/systemd/timesyncd.conf
[INFO] * krb5.conf ...
[DEBUG] -> to /etc/krb5.conf
[INFO] * nsswitch.conf ...
[DEBUG] -> to /etc/nsswitch.conf
[INFO] * lightdm.conf ...
[DEBUG] -> to /etc/lightdm/lightdm.conf.d/50-linuxmuster.conf
[INFO] * smb.conf ...
[DEBUG] -> to /etc/samba/smb.conf
[INFO] Reloading systemctl ... 
[INFO] Updating pam configuration ... 
[INFO] Raloading systctl daemon
[INFO] Enabling services:
[INFO] * linuxmuster-linuxclient7
[INFO] * smbd
[INFO] * nmbd
[INFO] * sssd
[INFO] Restarting services:
[INFO] * smbd
[INFO] * nmbd
[INFO] * systemd-timesyncd

[INFO] #### Joining domain linuxmuster.lan ####
 * Resolving: _ldap._tcp.linuxmuster.lan
 * Performing LDAP DSE lookup on: 10.16.1.1
 * Successfully discovered: linuxmuster.lan
Passwort für global-admin: 
 * Unconditionally checking packages
 * Resolving required packages
 * Joining using a truncated netbios name: OG11-TESTRECHNE
 * LANG=C /usr/sbin/adcli join --verbose --domain linuxmuster.lan --domain-realm LINUXMUSTER.LAN --domain-controller 10.16.1.1 --computer-name OG11-TESTRECHNE --login-type user --login-user global-admin --stdin-password
 * Using domain name: linuxmuster.lan
 * Using computer account name: OG11-TESTRECHNE
 * Using domain realm: linuxmuster.lan
 * Sending NetLogon ping to domain controller: 10.16.1.1
 * Received NetLogon info from: server.linuxmuster.lan
 * Wrote out krb5.conf snippet to /var/cache/realmd/adcli-krb5-yA7TdY/krb5.d/adcli-krb5-conf-vgpPIY
 * Authenticated as user: global-admin@LINUXMUSTER.LAN
 * Using GSS-SPNEGO for SASL bind
 * Looked up short domain name: LINUXMUSTER
 * Looked up domain SID: S-1-5-21-2629898062-364914800-2929496482
 * Using fully qualified name: og11-testrechner
 * Using domain name: linuxmuster.lan
 * Using computer account name: OG11-TESTRECHNE
 * Using domain realm: linuxmuster.lan
 * Enrolling computer name: OG11-TESTRECHNE
 * Generated 120 character computer password
 * Using keytab: FILE:/etc/krb5.keytab
 * Found computer account for OG11-TESTRECHNE$ at: CN=OG11-TESTRECHNE,CN=Computers,DC=linuxmuster,DC=lan
 * Sending NetLogon ping to domain controller: 10.16.1.1
 * Received NetLogon info from: server.linuxmuster.lan
 * Set computer password
 * Retrieved kvno '10' for computer account in directory: CN=OG11-TESTRECHNE,CN=Computers,DC=linuxmuster,DC=lan
 * Checking host/OG11-TESTRECHNE
 *    Added host/OG11-TESTRECHNE
 * Checking host/og11-testrechner.linuxmuster.lan
 *    Added host/og11-testrechner.linuxmuster.lan
 * Checking RestrictedKrbHost/OG11-TESTRECHNE
 *    Added RestrictedKrbHost/OG11-TESTRECHNE
 * Checking RestrictedKrbHost/og11-testrechner.linuxmuster.lan
 *    Added RestrictedKrbHost/og11-testrechner.linuxmuster.lan
 * Checking host/og11-testrechner
 *    Added host/og11-testrechner
 * Checking RestrictedKrbHost/og11-testrechner
 *    Added RestrictedKrbHost/og11-testrechner
 * Discovered which keytab salt to use
 * Added the entries to the keytab: OG11-TESTRECHNE$@LINUXMUSTER.LAN: FILE:/etc/krb5.keytab
 * Added the entries to the keytab: host/OG11-TESTRECHNE@LINUXMUSTER.LAN: FILE:/etc/krb5.keytab
 * Added the entries to the keytab: host/og11-testrechner@LINUXMUSTER.LAN: FILE:/etc/krb5.keytab
 * Added the entries to the keytab: RestrictedKrbHost/OG11-TESTRECHNE@LINUXMUSTER.LAN: FILE:/etc/krb5.keytab
 * Added the entries to the keytab: RestrictedKrbHost/og11-testrechner@LINUXMUSTER.LAN: FILE:/etc/krb5.keytab
 * Added the entries to the keytab: host/og11-testrechner.linuxmuster.lan@LINUXMUSTER.LAN: FILE:/etc/krb5.keytab
 * Added the entries to the keytab: RestrictedKrbHost/og11-testrechner.linuxmuster.lan@LINUXMUSTER.LAN: FILE:/etc/krb5.keytab
 * /usr/sbin/update-rc.d sssd enable
 * /usr/sbin/service sssd restart
 * Successfully enrolled machine in realm
[INFO] It looks like the domain was joined successfully.
[INFO] Installing server ca certificate ... 
[DEBUG] Calculating mountpoint of //server.linuxmuster.lan/sysvol
[WARNING] Uid could not be found! Continuing anyway!
[DEBUG] Trying to mount '//server.linuxmuster.lan/sysvol' to '/srv/samba/OG11-TESTRECHNER$/sysvol'
[DEBUG] * Creating directory...
[WARNING] * The target directory already exists, proceeding anyway!
[DEBUG] * Executing '/usr/sbin/mount.cifs -o file_mode=0700,dir_mode=0700,sec=krb5,nodev,nosuid,mfsymlinks,nobrl,vers=3.0,user=OG11-TESTRECHNER$,domain=LINUXMUSTER.LAN //server.linuxmuster.lan/sysvol /srv/samba/OG11-TESTRECHNER$/sysvol' 
[DEBUG] * Trying to mount...
* Error mounting share //server.linuxmuster.lan/sysvol to /srv/samba/OG11-TESTRECHNER$/sysvol!
[FATAL] * Error mounting share //server.linuxmuster.lan/sysvol to /srv/samba/OG11-TESTRECHNER$/sysvol!

[ERROR] Failed to mount sysvol!

================================================================================
The setup FAILED, see previous errors!
Plase check your configuration and try again.
================================================================================

Das ist glaube ich vergleichbar mit dem, soweit ich das verstehen kann, nicht gelöstem Problem hier: https://ask.linuxmuster.net/t/linux-client-20-04-will-einfach-nicht-werden/7776

Ich habe auch die dortigen Ratschläge (hoffentlich alle ) ausprobiert. Der einzige Unterschied fällt mir bei systemctl status sssd auf:

linuxadmin@og11-testrechner:~$ systemctl status sssd
● sssd.service - System Security Services Daemon
     Loaded: loaded (/lib/systemd/system/sssd.service; enabled; vendor preset: enabled)
    Drop-In: /etc/systemd/system/sssd.service.d
             └─override.conf
     Active: active (running) since Tue 2021-11-16 16:02:56 CET; 22min ago
   Main PID: 9835 (sssd)
      Tasks: 4 (limit: 19031)
     Memory: 42.6M
     CGroup: /system.slice/sssd.service
             ├─9835 /usr/sbin/sssd -i --logger=files
             ├─9836 /usr/libexec/sssd/sssd_be --domain linuxmuster.lan --uid 0 --gid 0 --logger=files
             ├─9837 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --logger=files
             └─9838 /usr/libexec/sssd/sssd_pam --uid 0 --gid 0 --logger=files

Nov 16 16:02:56 og11-testrechner sssd_nss[9837]: Starting up
Nov 16 16:02:56 og11-testrechner sssd_pam[9838]: Starting up
Nov 16 16:02:56 og11-testrechner systemd[1]: Started System Security Services Daemon.
Nov 16 16:03:06 og11-testrechner sssd[9867]: response to SOA query was unsuccessful
Nov 16 16:03:06 og11-testrechner sssd[9871]: response to SOA query was unsuccessful
Nov 16 16:03:06 og11-testrechner sssd[9875]: ; TSIG error with server: tsig verify failure
Nov 16 16:03:06 og11-testrechner sssd[9875]: update failed: SERVFAIL
Nov 16 16:15:27 og11-testrechner adcli[10102]: GSSAPI client step 1
Nov 16 16:15:27 og11-testrechner adcli[10102]: GSSAPI client step 1
Nov 16 16:15:27 og11-testrechner adcli[10102]: GSSAPI client step 1

Ich hoffe ich habe keine passende Hilfe im Forum übersehen. Und vielen Dank für eure Arbeit.

Viele Grüße
Julian

Julian · 17. November 2021 um 18:06

Ich habe noch einige Ergänzungen, da ich heute einiges an Zeit ins debuggen gesteckt habe.

Wenn ich

/usr/sbin/mount.cifs -o file_mode=0700,dir_mode=0700,sec=krb5,nodev,nosuid,mfsymlinks,nobrl,vers=3.0,user=OG11-TESTRECHNER$,domain=LINUXMUSTER.LAN //server.linuxmuster.lan/sysvol /srv/samba/OG11-TESTRECHNER$/sysvol

manuell ausführe, bekomme ich einen mount error mit required key not available. Journalctl -u sssd liefert:

Nov 16 14:59:47 og11-testrechner systemd[1]: Starting System Security Services Daemon...
Nov 16 14:59:48 og11-testrechner sssd[1210]: Starting up
Nov 16 14:59:48 og11-testrechner sssd_be[1213]: Starting up
Nov 16 14:59:48 og11-testrechner ldap_child[1216]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: KDC has no support for encryption type. Unable to create GSSAPI-encrypted LDAP connection.
Nov 16 14:59:48 og11-testrechner sssd_nss[1214]: Starting up
Nov 16 14:59:48 og11-testrechner sssd_pam[1215]: Starting up
Nov 16 14:59:48 og11-testrechner systemd[1]: Started System Security Services Daemon.
Nov 16 15:01:16 og11-testrechner ldap_child[1692]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: KDC has no support for encryption type. Unable to create GSSAPI-encrypted LDAP connection.
Nov 16 15:01:18 og11-testrechner ldap_child[1693]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: KDC has no support for encryption type. Unable to create GSSAPI-encrypted LDAP connection.
Nov 16 15:01:22 og11-testrechner ldap_child[1694]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: KDC has no support for encryption type. Unable to create GSSAPI-encrypted LDAP connection.
Nov 16 15:01:22 og11-testrechner ldap_child[1695]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: KDC has no support for encryption type. Unable to create GSSAPI-encrypted LDAP connection.
Nov 16 15:02:43 og11-testrechner ldap_child[1697]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: KDC has no support for encryption type. Unable to create GSSAPI-encrypted LDAP connection.
Nov 16 15:02:45 og11-testrechner ldap_child[1698]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: KDC has no support for encryption type. Unable to create GSSAPI-encrypted LDAP connection.
Nov 16 15:02:49 og11-testrechner ldap_child[1699]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: KDC has no support for encryption type. Unable to create GSSAPI-encrypted LDAP connection.
Nov 16 15:02:49 og11-testrechner ldap_child[1700]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: KDC has no support for encryption type. Unable to create GSSAPI-encrypted LDAP connection.
Nov 16 15:04:00 og11-testrechner ldap_child[2832]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: KDC has no support for encryption type. Unable to create GSSAPI-encrypted LDAP connection.
Nov 16 15:04:05 og11-testrechner ldap_child[2842]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: KDC has no support for encryption type. Unable to create GSSAPI-encrypted LDAP connection.
Nov 16 15:04:19 og11-testrechner systemd[1]: Stopping System Security Services Daemon...
Nov 16 15:04:19 og11-testrechner sssd_pam[1215]: Shutting down
Nov 16 15:04:19 og11-testrechner sssd_be[1213]: Shutting down
Nov 16 15:04:19 og11-testrechner sssd_nss[1214]: Shutting down
Nov 16 15:04:19 og11-testrechner systemd[1]: sssd.service: Succeeded.
Nov 16 15:04:19 og11-testrechner systemd[1]: Stopped System Security Services Daemon.
Nov 16 15:04:19 og11-testrechner systemd[1]: Starting System Security Services Daemon...
Nov 16 15:04:20 og11-testrechner sssd[2878]: Starting up
Nov 16 15:04:21 og11-testrechner sssd_be[2887]: Starting up
Nov 16 15:04:21 og11-testrechner sssd_nss[2888]: Starting up
Nov 16 15:04:21 og11-testrechner sssd_pam[2889]: Starting up
Nov 16 15:04:21 og11-testrechner ldap_child[2890]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: KDC has no support for encryption type. Unable to create GSSAPI-encrypted LDAP connection.
Nov 16 15:04:21 og11-testrechner systemd[1]: Started System Security Services Daemon.
Nov 16 15:04:21 og11-testrechner systemd[1]: Stopping System Security Services Daemon...
Nov 16 15:04:21 og11-testrechner sssd_pam[2889]: Shutting down
Nov 16 15:04:21 og11-testrechner sssd_be[2887]: Shutting down
Nov 16 15:04:21 og11-testrechner sssd_nss[2888]: Shutting down
Nov 16 15:04:21 og11-testrechner systemd[1]: sssd.service: Succeeded.
Nov 16 15:04:21 og11-testrechner systemd[1]: Stopped System Security Services Daemon.
Nov 16 15:04:39 og11-testrechner systemd[1]: Starting System Security Services Daemon...
Nov 16 15:04:39 og11-testrechner sssd[3431]: Starting up
Nov 16 15:04:39 og11-testrechner sssd_be[3432]: Starting up
Nov 16 15:04:39 og11-testrechner sssd_nss[3433]: Starting up
Nov 16 15:04:39 og11-testrechner sssd_pam[3434]: Starting up
Nov 16 15:04:39 og11-testrechner systemd[1]: Started System Security Services Daemon.
Nov 16 15:04:49 og11-testrechner sssd[3492]: response to SOA query was unsuccessful
Nov 16 15:04:49 og11-testrechner sssd[3496]: response to SOA query was unsuccessful
Nov 16 15:04:49 og11-testrechner sssd[3500]: ; TSIG error with server: tsig verify failure
Nov 16 15:04:49 og11-testrechner sssd[3500]: update failed: SERVFAIL
Nov 16 15:17:10 og11-testrechner adcli[4434]: GSSAPI client step 1
Nov 16 15:17:10 og11-testrechner adcli[4434]: GSSAPI client step 1
Nov 16 15:17:10 og11-testrechner adcli[4434]: GSSAPI client step 1
Nov 16 15:22:07 og11-testrechner systemd[1]: Stopping System Security Services Daemon...
Nov 16 15:22:07 og11-testrechner sssd_pam[3434]: Shutting down
Nov 16 15:22:07 og11-testrechner sssd_be[3432]: Shutting down
Nov 16 15:22:07 og11-testrechner sssd_nss[3433]: Shutting down
Nov 16 15:22:08 og11-testrechner systemd[1]: sssd.service: Main process exited, code=dumped, status=11/SEGV
Nov 16 15:22:08 og11-testrechner systemd[1]: sssd.service: Failed with result 'core-dump'.
Nov 16 15:22:08 og11-testrechner systemd[1]: Starting System Security Services Daemon...
Nov 16 15:22:08 og11-testrechner systemd[1]: sssd.service: Succeeded.
Nov 16 15:22:08 og11-testrechner systemd[1]: Stopped System Security Services Daemon.
Nov 16 15:22:28 og11-testrechner systemd[1]: Starting System Security Services Daemon...
Nov 16 15:22:28 og11-testrechner sssd[5218]: Starting up
Nov 16 15:22:29 og11-testrechner sssd_be[5219]: Starting up
Nov 16 15:22:30 og11-testrechner sssd_nss[5220]: Starting up
Nov 16 15:22:30 og11-testrechner sssd_pam[5221]: Starting up
Nov 16 15:22:30 og11-testrechner systemd[1]: Started System Security Services Daemon.
Nov 16 15:22:39 og11-testrechner sssd[5252]: response to SOA query was unsuccessful
Nov 16 15:22:39 og11-testrechner sssd[5256]: response to SOA query was unsuccessful
Nov 16 15:22:39 og11-testrechner sssd[5260]: ; TSIG error with server: tsig verify failure
Nov 16 15:22:39 og11-testrechner sssd[5260]: update failed: SERVFAIL
Nov 16 15:24:32 og11-testrechner systemd[1]: Stopping System Security Services Daemon...
Nov 16 15:24:32 og11-testrechner sssd_pam[5221]: Shutting down
Nov 16 15:24:32 og11-testrechner sssd_be[5219]: Shutting down
Nov 16 15:24:32 og11-testrechner sssd_nss[5220]: Shutting down
Nov 16 15:24:32 og11-testrechner systemd[1]: sssd.service: Succeeded.
Nov 16 15:24:32 og11-testrechner systemd[1]: Stopped System Security Services Daemon.
Nov 16 15:24:33 og11-testrechner systemd[1]: Starting System Security Services Daemon...
Nov 16 15:24:33 og11-testrechner sssd[5284]: Starting up
Nov 16 15:24:34 og11-testrechner systemd[1]: sssd.service: Succeeded.
Nov 16 15:24:34 og11-testrechner systemd[1]: Stopped System Security Services Daemon.
Nov 16 15:24:50 og11-testrechner systemd[1]: Starting System Security Services Daemon...
Nov 16 15:24:50 og11-testrechner sssd[5821]: Starting up
Nov 16 15:24:50 og11-testrechner sssd_be[5822]: Starting up
Nov 16 15:24:50 og11-testrechner sssd_nss[5823]: Starting up
Nov 16 15:24:50 og11-testrechner sssd_pam[5824]: Starting up
Nov 16 15:24:50 og11-testrechner systemd[1]: Started System Security Services Daemon.
Nov 16 15:25:00 og11-testrechner sssd[5852]: response to SOA query was unsuccessful
Nov 16 15:25:00 og11-testrechner sssd[5856]: response to SOA query was unsuccessful
Nov 16 15:25:00 og11-testrechner sssd[5860]: ; TSIG error with server: tsig verify failure
Nov 16 15:25:00 og11-testrechner sssd[5860]: update failed: SERVFAIL
Nov 16 15:37:21 og11-testrechner adcli[6075]: GSSAPI client step 1
Nov 16 15:37:21 og11-testrechner adcli[6075]: GSSAPI client step 1
Nov 16 15:37:21 og11-testrechner adcli[6075]: GSSAPI client step 1
Nov 16 15:40:30 og11-testrechner systemd[1]: Stopping System Security Services Daemon...
Nov 16 15:40:30 og11-testrechner sssd_pam[5824]: Shutting down
Nov 16 15:40:30 og11-testrechner sssd_be[5822]: Shutting down
Nov 16 15:40:30 og11-testrechner sssd_nss[5823]: Shutting down
Nov 16 15:40:30 og11-testrechner systemd[1]: sssd.service: Succeeded.
Nov 16 15:40:30 og11-testrechner systemd[1]: Stopped System Security Services Daemon.
Nov 16 15:40:30 og11-testrechner systemd[1]: Starting System Security Services Daemon...
Nov 16 15:40:30 og11-testrechner sssd[6225]: Starting up
Nov 16 15:40:31 og11-testrechner systemd[1]: sssd.service: Succeeded.
Nov 16 15:40:31 og11-testrechner systemd[1]: Stopped System Security Services Daemon.
Nov 16 15:40:46 og11-testrechner systemd[1]: Starting System Security Services Daemon...
Nov 16 15:40:46 og11-testrechner sssd[6765]: Starting up
Nov 16 15:40:46 og11-testrechner sssd_be[6766]: Starting up
Nov 16 15:40:46 og11-testrechner sssd_nss[6767]: Starting up
Nov 16 15:40:46 og11-testrechner sssd_pam[6768]: Starting up
Nov 16 15:40:46 og11-testrechner systemd[1]: Started System Security Services Daemon.
Nov 16 15:40:56 og11-testrechner sssd[6797]: response to SOA query was unsuccessful
Nov 16 15:40:56 og11-testrechner sssd[6801]: response to SOA query was unsuccessful
Nov 16 15:40:56 og11-testrechner sssd[6805]: ; TSIG error with server: tsig verify failure
Nov 16 15:40:56 og11-testrechner sssd[6805]: update failed: SERVFAIL
Nov 16 15:45:36 og11-testrechner systemd[1]: Stopping System Security Services Daemon...
Nov 16 15:45:36 og11-testrechner sssd_pam[6768]: Shutting down
Nov 16 15:45:36 og11-testrechner sssd_be[6766]: Shutting down
Nov 16 15:45:36 og11-testrechner sssd_nss[6767]: Shutting down
Nov 16 15:45:36 og11-testrechner systemd[1]: sssd.service: Succeeded.
Nov 16 15:45:36 og11-testrechner systemd[1]: Stopped System Security Services Daemon.
Nov 16 15:45:36 og11-testrechner systemd[1]: Starting System Security Services Daemon...
Nov 16 15:45:37 og11-testrechner sssd[6907]: Starting up
Nov 16 15:45:38 og11-testrechner systemd[1]: sssd.service: Succeeded.
Nov 16 15:45:38 og11-testrechner systemd[1]: Stopped System Security Services Daemon.
Nov 16 15:45:55 og11-testrechner systemd[1]: Starting System Security Services Daemon...
Nov 16 15:45:55 og11-testrechner sssd[7451]: Starting up
Nov 16 15:45:55 og11-testrechner sssd_be[7452]: Starting up
Nov 16 15:45:55 og11-testrechner sssd_nss[7453]: Starting up
Nov 16 15:45:55 og11-testrechner sssd_pam[7454]: Starting up
Nov 16 15:45:55 og11-testrechner systemd[1]: Started System Security Services Daemon.
Nov 16 15:46:05 og11-testrechner sssd[7484]: response to SOA query was unsuccessful
Nov 16 15:46:05 og11-testrechner sssd[7488]: response to SOA query was unsuccessful
Nov 16 15:46:05 og11-testrechner sssd[7492]: ; TSIG error with server: tsig verify failure
Nov 16 15:46:05 og11-testrechner sssd[7492]: update failed: SERVFAIL
Nov 16 15:49:13 og11-testrechner systemd[1]: Stopping System Security Services Daemon...
Nov 16 15:49:13 og11-testrechner sssd_pam[7454]: Shutting down
Nov 16 15:49:13 og11-testrechner sssd_nss[7453]: Shutting down
Nov 16 15:49:13 og11-testrechner sssd_be[7452]: Shutting down
Nov 16 15:49:13 og11-testrechner systemd[1]: sssd.service: Succeeded.
Nov 16 15:49:13 og11-testrechner systemd[1]: Stopped System Security Services Daemon.
Nov 16 15:49:14 og11-testrechner systemd[1]: Starting System Security Services Daemon...
Nov 16 15:49:14 og11-testrechner sssd[7527]: Starting up
Nov 16 15:49:15 og11-testrechner systemd[1]: sssd.service: Succeeded.
Nov 16 15:49:15 og11-testrechner systemd[1]: Stopped System Security Services Daemon.
Nov 16 15:50:06 og11-testrechner systemd[1]: Starting System Security Services Daemon...
Nov 16 15:50:06 og11-testrechner sssd[8096]: Starting up
Nov 16 15:50:06 og11-testrechner sssd_be[8097]: Starting up
Nov 16 15:50:06 og11-testrechner sssd_nss[8098]: Starting up
Nov 16 15:50:06 og11-testrechner sssd_pam[8099]: Starting up
Nov 16 15:50:06 og11-testrechner systemd[1]: Started System Security Services Daemon.
Nov 16 15:50:16 og11-testrechner sssd[8128]: response to SOA query was unsuccessful
Nov 16 15:50:16 og11-testrechner sssd[8132]: response to SOA query was unsuccessful
Nov 16 15:50:16 og11-testrechner sssd[8136]: ; TSIG error with server: tsig verify failure
Nov 16 15:50:16 og11-testrechner sssd[8136]: update failed: SERVFAIL
Nov 16 16:02:11 og11-testrechner systemd[1]: Stopping System Security Services Daemon...
Nov 16 16:02:11 og11-testrechner sssd_pam[8099]: Shutting down
Nov 16 16:02:11 og11-testrechner sssd_be[8097]: Shutting down
Nov 16 16:02:11 og11-testrechner sssd_nss[8098]: Shutting down
Nov 16 16:02:11 og11-testrechner systemd[1]: sssd.service: Succeeded.
Nov 16 16:02:11 og11-testrechner systemd[1]: Stopped System Security Services Daemon.
Nov 16 16:02:11 og11-testrechner systemd[1]: Starting System Security Services Daemon...
Nov 16 16:02:11 og11-testrechner sssd[8862]: Starting up
Nov 16 16:02:12 og11-testrechner systemd[1]: sssd.service: Succeeded.
Nov 16 16:02:12 og11-testrechner systemd[1]: Stopped System Security Services Daemon.
Nov 16 16:02:56 og11-testrechner systemd[1]: Starting System Security Services Daemon...
Nov 16 16:02:56 og11-testrechner sssd[9835]: Starting up
Nov 16 16:02:56 og11-testrechner sssd_be[9836]: Starting up
Nov 16 16:02:56 og11-testrechner sssd_nss[9837]: Starting up
Nov 16 16:02:56 og11-testrechner sssd_pam[9838]: Starting up
Nov 16 16:02:56 og11-testrechner systemd[1]: Started System Security Services Daemon.
Nov 16 16:03:06 og11-testrechner sssd[9867]: response to SOA query was unsuccessful
Nov 16 16:03:06 og11-testrechner sssd[9871]: response to SOA query was unsuccessful
Nov 16 16:03:06 og11-testrechner sssd[9875]: ; TSIG error with server: tsig verify failure
Nov 16 16:03:06 og11-testrechner sssd[9875]: update failed: SERVFAIL
Nov 16 16:15:27 og11-testrechner adcli[10102]: GSSAPI client step 1
Nov 16 16:15:27 og11-testrechner adcli[10102]: GSSAPI client step 1
Nov 16 16:15:27 og11-testrechner adcli[10102]: GSSAPI client step 1

Hier ist denke ich die Zeile „Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: KDC has no support for encryption type. Unable to create GSSAPI-encrypted LDAP connection.“ auffällig. Habe aber alle notwendigen Pakete für GSSAPI support installiert.

Dann habe ich mir noch die samba configs angeguckt. Da fiel mir auf dem Client in der smb.conf folgendes auf:
tls cafile = /var/lib/samba/private/linuxmuster.lan.pem
Diese Datei existiert weder auf dem Server, noch auf dem Client.

Für Hilfe wäre ich sehr dankbar.

Viele Grüße
Julian

baumhof · 17. November 2021 um 18:22

Hallo Julian,

die Datei gibt es bei mir auch nicht.
Aber diese:
/var/lib/samba/sysvol/linuxmuster.lan/tls/cacert.pem

Hast du auf dem Server schon mal:
sophomorix-school --gpo-create default-school
ausgeführt?
Hat vielelicht nix damit zu tun: schadet aber auch nicht.

LG

Holger

Julian · 17. November 2021 um 21:07

Hallo Holger,

vielen Dank für deine Antwort.

/var/lib/samba/sysvol/linuxmuster.lan/tls/cacert.pem existiert bei mir auch.

sophomorix-school --gpo-create default-school habe ich auch ausprobiert.

VG
Julian

dorian · 17. November 2021 um 22:09

Hi,

Klappt kinit global-admin?

VG, Dorian

Julian · 22. November 2021 um 13:36

Anscheinend ja. Er gibt keine Fehlermeldung aus. Habe zu Testzwecken mal das falsche Passwort eingegeben und dann meckert er.

Julian · 23. November 2021 um 12:26

Ich recherchiere weiterhin auch der

Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: KDC has no support for encryption type. Unable to create GSSAPI-encrypted LDAP connection.

Sache hinterher. Ich verstehe den Aufbau dahinter nicht so ganz, vielleicht kann mir da ja jemand weiterhelfen. Ich habe mit dieser Anleitung die Einstellungen der Firewall überprüft. Da fällt mir in der /etc/krb5.conf folgendes auf:

# cat /etc/krb5.conf
# Autogenerated config. Do not edit manualy.

[libdefaults]
        default_realm = LINUXMUSTER.LAN
        dns_lookup_kdc = no
        dns_lookup_realm = no
        ticket_lifetime = 24h
        default_keytab_name = /usr/local/etc/squid/squid.keytab
        default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
        default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
        permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
[realms]
        LINUXMUSTER.LAN = {
                kdc = server.linuxmuster.lan
                admin_server = server.linuxmuster.lan
                default_domain = linuxmuster.lan
        }
[domain_realm]
        .linuxmuster.lan = LINUXMUSTER.LAN
        linuxmuster.lan = LINUXMUSTER.LAN

Da wird der Linuxmuster als KDC angegeben. Ich finde da aber keinen laufenden Kerberos Service (habe im Ubuntu Wiki nachgeschaut, wie der Service heißen sollte). Und die Config hier schließt GSSAPI Verschlüsselung ja anscheinend aus? Sollte aber vielleicht auch egal sein weil es nicht der Kerberos Server ist? Ich verstehe nicht, wie da die einzelnen Zahnräder ineinandergreifen. Ich habe nur linuxerfahrung und dieses ganze AD zeugs ist völlig neu für mich.

dorian · 23. November 2021 um 12:34

Hi,

Deine Kerberos config sieht sehr merkwürdig aus …
Da stimmt irgendwas nicht. Eigentlich sollte das Setup sie überschreiben, damit sie so aussieht:

github.com

linuxmuster/linuxmuster-linuxclient7/blob/master/usr/share/linuxmuster-linuxclient7/templates/krb5.conf

# /etc/krb5.conf
#
# WARNING! All changes to this file will be overwritten by linuxmuster-linuxclient7 setup and upgrade!
#

[libdefaults]
        default_realm = @@realm@@
        ticket_lifetime = 24h
        renew_lifetime = 7d

Bei mir sieht sie so aus:

VG, Dorian

Julian · 23. November 2021 um 12:47

Da habe ich mich glaube ich absolut unklar ausgedrückt. Das oben ist die config der Firewall. Auf dem Server sieht meine /etc/krb5.conf aus wie bei dir.

dorian · 23. November 2021 um 12:57

Achso.

Auf dem Linuxmuster Server gibt es auch keinen laufenden Kerberos Service. Kerberos wird vom Samba zur Verfügung gestellt.

Teste bitte nochmal folgendes:

klist -l
kdestroy
kinit global-admin
klist -l
sudo klist -k

Und bitte jeweils den Output posten.

Julian · 23. November 2021 um 13:18

root@og11-testrechner:/# klist -l
Principal name                 Cache name
--------------                 ----------
root@og11-testrechner:/# kdestroy
kdestroy: No credentials cache found beim Zerstören des Zwischenspeichers
root@og11-testrechner:/# kinit global-admin
Passwort für global-admin@LINUXMUSTER.LAN: 
root@og11-testrechner:/# klist -l
Principal name                 Cache name
--------------                 ----------
global-admin@LINUXMUSTER.LAN   FILE:/tmp/krb5cc_0
root@og11-testrechner:/# klist -k
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
  16 OG11-TESTRECHNE$@LINUXMUSTER.LAN
  16 OG11-TESTRECHNE$@LINUXMUSTER.LAN
  16 OG11-TESTRECHNE$@LINUXMUSTER.LAN
  16 host/OG11-TESTRECHNE@LINUXMUSTER.LAN
  16 host/OG11-TESTRECHNE@LINUXMUSTER.LAN
  16 host/OG11-TESTRECHNE@LINUXMUSTER.LAN
  16 host/og11-testrechner@LINUXMUSTER.LAN
  16 host/og11-testrechner@LINUXMUSTER.LAN
  16 host/og11-testrechner@LINUXMUSTER.LAN
  16 RestrictedKrbHost/OG11-TESTRECHNE@LINUXMUSTER.LAN
  16 RestrictedKrbHost/OG11-TESTRECHNE@LINUXMUSTER.LAN
  16 RestrictedKrbHost/OG11-TESTRECHNE@LINUXMUSTER.LAN
  16 RestrictedKrbHost/og11-testrechner@LINUXMUSTER.LAN
  16 RestrictedKrbHost/og11-testrechner@LINUXMUSTER.LAN
  16 RestrictedKrbHost/og11-testrechner@LINUXMUSTER.LAN
  16 host/og11-testrechner.linuxmuster.lan@LINUXMUSTER.LAN
  16 host/og11-testrechner.linuxmuster.lan@LINUXMUSTER.LAN
  16 host/og11-testrechner.linuxmuster.lan@LINUXMUSTER.LAN
  16 RestrictedKrbHost/og11-testrechner.linuxmuster.lan@LINUXMUSTER.LAN
  16 RestrictedKrbHost/og11-testrechner.linuxmuster.lan@LINUXMUSTER.LAN
  16 RestrictedKrbHost/og11-testrechner.linuxmuster.lan@LINUXMUSTER.LAN
root@og11-testrechner:/#

Julian · 23. November 2021 um 14:09

Nachdem ich oben geschrieben habe, dass er bei

/usr/sbin/mount.cifs -o file_mode=0700,dir_mode=0700,sec=krb5,nodev,nosuid,mfsymlinks,nobrl,vers=3.0,user=OG11-TESTRECHNER$,domain=LINUXMUSTER.LAN //server.linuxmuster.lan/sysvol /srv/samba/OG11-TESTRECHNER$/sysvol

einen mount error mit required key not available ausgibt, habe ich grad mal getestet ob es geht wenn ich vorher kinit global-admin ausführe und das funktioniert. Falls diese Information weiterhilft.

dorian · 23. November 2021 um 18:17

Kannst du mal probieren, einen kinit global-admin zu machen und dann das setup auszuführen?

Julian · 24. November 2021 um 14:06

Also wenn ich kinit global-admin durchführe und dann den setup, schlägt es mit der gleichen Meldung fehl. Wenn ich kinit global-admin durchführe und dann manuell

/usr/sbin/mount.cifs -o file_mode=0700,dir_mode=0700,sec=krb5,nodev,nosuid,mfsymlinks,nobrl,vers=3.0,user=OG11-TESTRECHNER$,domain=LINUXMUSTER.LAN //server.linuxmuster.lan/sysvol /srv/samba/OG11-TESTRECHNER$/sysvol

bekomme ich eine neue Fehlermeldung, wenn ich den linuxmuster-linuxclient7 setup durchführe:

root@og11-testrechner:/home/linuxadmin# kinit global-admin
Passwort für global-admin@LINUXMUSTER.LAN: 
root@og11-testrechner:/home/linuxadmin# /usr/sbin/mount.cifs -o file_mode=0700,dir_mode=0700,sec=krb5,nodev,nosuid,mfsymlinks,nobrl,vers=3.0,user=OG11-TESTRECHNER$,domain=LINUXMUSTER.LAN //server.linuxmuster.lan/sysvol /srv/samba/OG11-TESTRECHNER$/sysvol
root@og11-testrechner:/home/linuxadmin# linuxmuster-linuxclient7 setup
[INFO] #### linuxmuster-linuxclient7 setup ####
[INFO] Cleaning sssd cache.
[INFO] Stopping sssd
[INFO] Deleting old kerberos tickets.
[INFO] Cleaning / leaving all domain joins
[INFO] * linuxmuster.lan
[INFO] -> Done!
[INFO] Deleting krb5.keytab if it exists ... 
[INFO] Deleting old CA certificate if it exists ... 
[INFO] Deleting /etc/linuxmuster-linuxclient7/network.conf if exists ...
[INFO] Trying to discover available domains...
[INFO] Using first discovered domain linuxmuster.lan
[INFO] Preparing network configuration
[INFO] Writing new network Configuration
[INFO] Deleting obsolete files
[INFO] * /etc/profile.d/99-linuxmuster.sh
[INFO] * /etc/sudoers.d/linuxmuster
[INFO] * /etc/profile.d/linuxmuster-proxy.sh
[INFO] * /etc/bash_completion.d/99-linuxmuster-client-adsso.sh
[INFO] * /etc/profile.d/99-linuxmuster-client-adsso.sh
[INFO] * /etc/sudoers.d/linuxmuster-client-adsso
[INFO] * /usr/sbin/linuxmuster-client-adsso
[INFO] * /usr/sbin/linuxmuster-client-adsso-print-logs
[INFO] * /etc/systemd/system/linuxmuster-client-adsso.service
[INFO] * /home/linuxadmin/.config/autostart/linuxmuster-client-adsso-autostart.desktop
[INFO] * /etc/cups/client.conf
[INFO] * /usr/share/linuxmuster-linuxclient7/templates/linuxmuster-client-adsso.service
[INFO] * /usr/share/linuxmuster-linuxclient7/templates/linuxmuster-client-adsso-autostart.desktop
[INFO] * /etc/security/pam_mount.conf.xml
[INFO] * /usr/share/linuxmuster-linuxclient7/templates/pam_mount.conf.xml
[INFO] Deleting obsolete directories
[INFO] * /etc/linuxmuster-client
[INFO] * /etc/linuxmuster-client-adsso
[INFO] * /usr/share/linuxmuster-client-adsso
[INFO] Applying all configuration templates:
[INFO] * cifs.spnego.conf ...
[DEBUG] -> to /etc/request-key.d/cifs.spnego.conf
[INFO] * common-session ...
[DEBUG] -> to /etc/pam.d/common-session
[INFO] * greeter.dconf-defaults ...
[DEBUG] -> to /etc/gdm3/greeter.dconf-defaults
[INFO] * linuxmuster-linuxclient7.desktop ...
[DEBUG] -> to /home/linuxadmin/.config/autostart/linuxmuster-linuxclient7-autostart.desktop
[INFO] * linuxmuster-linuxclient7.service ...
[DEBUG] -> to /etc/systemd/system/linuxmuster-linuxclient7.service
[INFO] * timesyncd.conf ...
[DEBUG] -> to /etc/systemd/timesyncd.conf
[INFO] * krb5.conf ...
[DEBUG] -> to /etc/krb5.conf
[INFO] * nsswitch.conf ...
[DEBUG] -> to /etc/nsswitch.conf
[INFO] * lightdm.conf ...
[DEBUG] -> to /etc/lightdm/lightdm.conf.d/50-linuxmuster.conf
[INFO] * smb.conf ...
[DEBUG] -> to /etc/samba/smb.conf
[INFO] Reloading systemctl ... 
[INFO] Updating pam configuration ... 
[INFO] Raloading systctl daemon
[INFO] Enabling services:
[INFO] * linuxmuster-linuxclient7
[INFO] * smbd
[INFO] * nmbd
[INFO] * sssd
[INFO] Restarting services:
[INFO] * smbd
[INFO] * nmbd
[INFO] * systemd-timesyncd

[INFO] #### Joining domain linuxmuster.lan ####
 * Resolving: _ldap._tcp.linuxmuster.lan
 * Performing LDAP DSE lookup on: 10.16.1.1
 * Successfully discovered: linuxmuster.lan
Passwort für global-admin: 
 * Unconditionally checking packages
 * Resolving required packages
 * Joining using a truncated netbios name: OG11-TESTRECHNE
 * LANG=C /usr/sbin/adcli join --verbose --domain linuxmuster.lan --domain-realm LINUXMUSTER.LAN --domain-controller 10.16.1.1 --computer-name OG11-TESTRECHNE --login-type user --login-user global-admin --stdin-password
 * Using domain name: linuxmuster.lan
 * Using computer account name: OG11-TESTRECHNE
 * Using domain realm: linuxmuster.lan
 * Sending NetLogon ping to domain controller: 10.16.1.1
 * Received NetLogon info from: server.linuxmuster.lan
 * Wrote out krb5.conf snippet to /var/cache/realmd/adcli-krb5-wLpHvs/krb5.d/adcli-krb5-conf-Rdpscr
 * Authenticated as user: global-admin@LINUXMUSTER.LAN
 * Using GSS-SPNEGO for SASL bind
 * Looked up short domain name: LINUXMUSTER
 * Looked up domain SID: S-1-5-21-2629898062-364914800-2929496482
 * Using fully qualified name: og11-testrechner
 * Using domain name: linuxmuster.lan
 * Using computer account name: OG11-TESTRECHNE
 * Using domain realm: linuxmuster.lan
 * Enrolling computer name: OG11-TESTRECHNE
 * Generated 120 character computer password
 * Using keytab: FILE:/etc/krb5.keytab
 * Found computer account for OG11-TESTRECHNE$ at: CN=OG11-TESTRECHNE,CN=Computers,DC=linuxmuster,DC=lan
 * Sending NetLogon ping to domain controller: 10.16.1.1
 * Received NetLogon info from: server.linuxmuster.lan
 * Set computer password
 * Retrieved kvno '21' for computer account in directory: CN=OG11-TESTRECHNE,CN=Computers,DC=linuxmuster,DC=lan
 * Checking host/OG11-TESTRECHNE
 *    Added host/OG11-TESTRECHNE
 * Checking host/og11-testrechner.linuxmuster.lan
 *    Added host/og11-testrechner.linuxmuster.lan
 * Checking RestrictedKrbHost/OG11-TESTRECHNE
 *    Added RestrictedKrbHost/OG11-TESTRECHNE
 * Checking RestrictedKrbHost/og11-testrechner.linuxmuster.lan
 *    Added RestrictedKrbHost/og11-testrechner.linuxmuster.lan
 * Checking host/og11-testrechner
 *    Added host/og11-testrechner
 * Checking RestrictedKrbHost/og11-testrechner
 *    Added RestrictedKrbHost/og11-testrechner
 * Discovered which keytab salt to use
 * Added the entries to the keytab: OG11-TESTRECHNE$@LINUXMUSTER.LAN: FILE:/etc/krb5.keytab
 * Added the entries to the keytab: host/OG11-TESTRECHNE@LINUXMUSTER.LAN: FILE:/etc/krb5.keytab
 * Added the entries to the keytab: host/og11-testrechner@LINUXMUSTER.LAN: FILE:/etc/krb5.keytab
 * Added the entries to the keytab: RestrictedKrbHost/OG11-TESTRECHNE@LINUXMUSTER.LAN: FILE:/etc/krb5.keytab
 * Added the entries to the keytab: RestrictedKrbHost/og11-testrechner@LINUXMUSTER.LAN: FILE:/etc/krb5.keytab
 * Added the entries to the keytab: host/og11-testrechner.linuxmuster.lan@LINUXMUSTER.LAN: FILE:/etc/krb5.keytab
 * Added the entries to the keytab: RestrictedKrbHost/og11-testrechner.linuxmuster.lan@LINUXMUSTER.LAN: FILE:/etc/krb5.keytab
 * /usr/sbin/update-rc.d sssd enable
 * /usr/sbin/service sssd restart
 * Successfully enrolled machine in realm
[INFO] It looks like the domain was joined successfully.
[INFO] Installing server ca certificate ... 
[DEBUG] Calculating mountpoint of //server.linuxmuster.lan/sysvol
[WARNING] Uid could not be found! Continuing anyway!
[DEBUG] Trying to mount '//server.linuxmuster.lan/sysvol' to '/srv/samba/OG11-TESTRECHNER$/sysvol'
[DEBUG] * Creating directory...
[DEBUG] * The mountpoint is already mounted.
[DEBUG] Calculating mountpoint of //server.linuxmuster.lan/sysvol
[INFO] Copying CA certificate from server to client!
[INFO] === Trying to unmount all shares of user OG11-TESTRECHNER$ ===
[INFO] Mount basedir /home/OG11-TESTRECHNER$/media does not exist -> nothing to unmount
[INFO] * Trying to unmount /srv/samba/OG11-TESTRECHNER$/sysvol...
[INFO] * Deleting /srv/samba/OG11-TESTRECHNER$/sysvol...
[INFO] Deleting /srv/samba/OG11-TESTRECHNER$...
[INFO] ===> Finished unmounting all shares of user OG11-TESTRECHNER$ ===
[INFO] Adjusting sssd.conf
[INFO] Writing new Configuration
[INFO] Restarting sssd
[INFO] Testing if the domain join actually works
[INFO] * Checking if the group "domain users" exists
[INFO] * Trying to get a kerberos ticket for the Computer Account
kinit: Schlüsseltabelle enthält keine passenden Schlüssel für OG11-TESTRECHNER$@LINUXMUSTER.LAN bei Anfängliche Anmeldedaten werden geholt.
[ERROR] Could not get a kerberos ticket for the Computer Account!
[ERROR] Logins of non-cached users WILL NOT WORK!
[ERROR] Please try to re-join the Domain.

================================================================================
The setup FAILED, see previous errors!
Plase check your configuration and try again.
================================================================================
root@og11-testrechner:/home/linuxadmin#

Julian · 24. November 2021 um 14:19

Mir fällt da übrigens immer und immer wieder das Problem mit dem Rechnernamen auf. Der komplette Rechnername ist og11-testrechner. Dann taucht er mal als OG11-TESTRECHNE$ und hier auch als OG11-TESTRECHNER$. Wenn ich kinit og11-testrechner eingebe sagt er:

root@og11-testrechner:/home/linuxadmin# kinit og11-testrechner
kinit: KDC unterstützt diesen Verschlüsselungstyp nicht bei Anfängliche Anmeldedaten werden geholt.

Bei kinit og11-testrechne:

root@og11-testrechner:/home/linuxadmin# kinit og11-testrechne
Passwort für og11-testrechne@LINUXMUSTER.LAN:

Passwort kenne ich nicht, aber er fragt eins ab. Das passt doch alles nicht zusammen?

baumhof · 24. November 2021 um 14:25

Hallo,

das Problem besteht ja schon länger.
Deswegen fabulier ich mal ein wenig esoterisch rum:

wurde die Systemzeit von Client und server schon verglichen?
steht der Rechner mit genau dem Namen in der devices.csv:
og11-testrechner Und dabei meine ich z.B. alles klein geschrieben.
wurde mal versucht dem Rechner in der devices.csv ein neuen Namen zu geben, der vielelicht kein „-“ enthält und der etwas kürzer ist: r123pc04 ist ja ganz beliebt… (linuxmuster-import-devices nicht vergessen).
Danach Cleint booten, Rechner umnennen (das ist, meine ich, in mehreren Dateien nötig) reboot (paranoia hilft) dann domjoin machen

LG

Holger

dorian · 24. November 2021 um 15:53

Hi,

Ich glaube, den Hostname ist zu lang. Teste bitte mal einen kürzeren.

(Hier sieht man, dass in der Schlüsseltabelle der letzte Buchstabe (das R) fehlt. Daran liegt es denke ich)

VG, Dorian

Julian · 25. November 2021 um 14:23

Liebe Leute,

es lag wirklich am Hostnamen. Er war offensichtlich ein Zeichen zu lang. Habe es auf og11-test abgekürzt, am - liegt es also nicht. Ich danke euch für eure Zeit und Hilfe. Auch wenn ich innerlich ein wenig koche, weil mich so eine **** irgendwie 20 Stunden Arbeit gekostet hat. Immerhin habe ich beim debuggen einiges über die inner workings gelernt und hoffe, dass ich das später nochmal gebrauchen kann.

Viele Grüße
Julian

baumhof · 25. November 2021 um 14:59

Hallo Julian,

soweit ich weiß ist das eine Microsofteinschränkung von AnuDazumal: 15 Zeichen: mehr ist nicht.
OG11-TESTRECHNER sind 16 Zeichen
OG11-TESTRECHNE sind 15 Zeichen

… sorry, dass ich nicht früher drauf gekommen bin

LG
Holger

dorian · 25. November 2021 um 19:02

Hi,

Ich bau bei Gelegenheit mal eine Warnung in den client ein:

Vielleicht tröstet dich ja ein bisschen, dass du mit deinen 20h vielen Anderen diese Zeit ersparst

VG, Dorian