Dotaz: docker Samba AD server + Windows AD member vo VM

[rastos]

Příloha:

• netdump.pcap (1187 bytů)

Skúšal som v posledných dňoch rozbehnúť Samba AD server v dockeri a pripojiť k tomu windowsový stroj vo Virtualbox-e. Neúspešne. Bol by som vďačný, keby ma niekto vedel posunúť ďalej.

Stav je nasledovný:

Host má rozhranie docker0 192.168.1.1/24

Docker image vyrobený pomocou Dockerfile:

FROM ubuntu:latest
MAINTAINER rastos

RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y samba winbind smbclient dnsutils psmisc
EXPOSE 53 88 135 137 138 139 389 445 464 636 1024 3268 3269 

Z docker image-u vyrobím kontainer:

docker run --name=container --hostname=container --privileged \
 --dns 192.168.1.2 --add-host localhost.localdomain:127.0.0.1 -t -i samba:install bash

V kontaineri vyrobím Samba AD Server

adminpass=Passw0rd
domain=SAMDOM
realm=SAMDOM.example.org
hostname=container

rm /etc/samba/smb.conf 
samba-tool domain provision \
        --use-xattrs=no --server-role=dc --adminpass=${adminpass} \
        --dns-backend=SAMBA_INTERNAL --domain=${domain} \
        --realm=${realm} --use-rfc2307 --host-name=${hostname}

Kontainer má eth0 192.168.1.2.

V /etc/resolv.conf je

domain samdom.example.org
nameserver 192.168.1.2

V /etc/samba/smb.conf je:

# Global parameters
[global]
        workgroup = SAMDOM
        realm = SAMDOM.example.org
        netbios name = CONTAINER
        server role = active directory domain controller
        dns forwarder = 192.168.1.2
        idmap_ldb:use rfc2307 = yes
        xattr_tdb:file = /var/lib/samba/xattr.tdb

[netlogon]
        path = /var/lib/samba/sysvol/samdom.example.org/scripts
        read only = No

[sysvol]
        path = /var/lib/samba/sysvol
        read only = No

Sambu spustím takto:

samba -i -d3 -M single

Vo VirtualBoxe nabootujem Windows (úplne konkrétne je to trial verzia Win 2008 server). VM má nastavený sieťový adaptér v bridge móde cez docker0. Vo windowsoch nastavím statickú IP adresu 192.168.1.3, a DNS a gateway na 192.168.1.2. Nabootovaný windows vie pingnúť kontainer, ale už kontaktovať DNS server samby nezvládne a tým pádom ani pripojiť sa k AD. (Na to tuším potrebuje nájsť SRV záznam). To vidím na tom, že nslookup hneď po štarte povie:

C:\>nslookup
DNS request timed out.
    timeout was 2 seconds.
Default Server:  UnKnown
Address:  192.168.1.2

Podľa wireshark-u, pustenom pod tými windowsami, sa ten nslookup opýta na 2.1.168.192.in-addr.arpa a samba odpovie paketom, v ktorom nie je žiadna DNS odpoveď (viď príloha). Samba v tom čase zaloguje hromadu hlášok

Not authoritative for '2.1.168.192.in-addr.arpa', forwarding
Not authoritative for '2.1.168.192.in-addr.arpa', forwarding
Not authoritative for '2.1.168.192.in-addr.arpa', forwarding
Not authoritative for '2.1.168.192.in-addr.arpa', forwarding
...

Lookup v kontajneri zafunguje tak napoly:

host container
container.samdom.example.org has address 192.168.1.2
host 192.168.1.2
2.1.168.192.in-addr.arpa has no PTR record

Čo robím zle? Resp.: ako ďalej?

Odpovědi

[NN]

Interni DNS samby supluje pouze dotazy pro registraci viz. Verify DNS. Zbytek muzes poslat dal direktivou dns forwarder = x.x.x.x.

[rastos]

a) Overenie DNS:

host -t SRV _ldap._tcp.samdom.example.org.
_ldap._tcp.samdom.example.org has SRV record 0 100 389 container.samdom.example.org.
host -t SRV _kerberos._udp.samdom.example.org.
_kerberos._udp.samdom.example.org has SRV record 0 100 88 container.samdom.example.org.
host -t A container.samdom.example.org.
container.samdom.example.org has address 192.168.1.2

Ale je pravda, že Kerberos samotný tam nemám. Chcel som sa tomu vyhnúť, pretože o ňom prakticky nič neviem. Musím ho mať?

b) hovoríš, že v /etc/samba/smb.conf mám namieriť "dns forwarder = ..." na nejaký reálny name server ? To môžem skúsiť, ale má to význam? Nezáleží mi na tom, či v tom kontajneri alebo na tom windowsovom stroji funguje resolvovanie mien mimo tejto mini-siete.

[NN]

JJak tedy vypada pokus o propojeni k domene ie. chybova zprava na strane klienta, log na strane serveru a pfipadne pcap komumikace pri overovani?

[rastos]

Přílohy:

• domjoin1.pcap (1220 bytů)
• domjoin2.pcap (2135 bytů)

An Active Directory Domain COntroler (AD DC) for domain
"SAMDOM" could not be contancted.

Ensure that the domain name is typed correctly.

If the name is correct, click Details for troubleshooting information.

Details povie:

Note: This information is intended for a network administrator.  If you are not your 
network's administrator, notify the administrator that you received this information, which 
has been recorded in the file C:\Windows\debug\dcdiag.txt.

The domain name "SAMDOM" might be a NetBIOS domain name.  If this is the case, 
verify that the domain name is properly registered with WINS.

If you are certain that the name is not a NetBIOS domain name, then the following 
information can help you troubleshoot your DNS configuration.

The following error occurred when DNS was queried for the service location (SRV) 
resource record used to locate an Active Directory Domain Controller (AD DC) for domain 
"SAMDOM":

The error was: "This operation returned because the timeout period expired."
(error code 0x000005B4 ERROR_TIMEOUT)

The query was for the SRV record for _ldap._tcp.dc._msdcs.SAMDOM

The DNS servers used by this computer for name resolution are not responding. This 
computer is configured to use DNS servers with the following IP addresses:

192.168.1.2

Verify that this computer is connected to the network, that these are the correct DNS 
server IP addresses, and that at least one of the DNS servers is running.

Samba v tom čase zaloguje:

Not authoritative for '_ldap._tcp.dc._msdcs.SAMDOM', forwarding
Not authoritative for '_ldap._tcp.dc._msdcs.SAMDOM', forwarding
...

Dump paketov je v prílohe, ale nie som si istý, či som chytil to čo som mal, tak som urobil dva pokusy.

[NN]

Otestuj:

host -t SRV _ldap._tcp.dc._msdcs.SAMDOM.example.org

a jeste byfh se pokusil pripjit na kopletni DNS nazev tzn. SAMDOM.example.org

[rastos]

Přílohy:

• nslookup.-type=SRV._ldap._tcp.dc._msdcs.SAMDOM.example.org.pcap (953 bytů)
• nslookup .container.samdom.example.org.pcap (1283 bytů)
• domjoin.samdom.example.org.pcap (1627 bytů)

V kontajneri, kde beží samba:

# host -t SRV _ldap._tcp.dc._msdcs.samdom.example.org 
_ldap._tcp.dc._msdcs.samdom.example.org has SRV record 0 100 389 container.samdom.example.org.
# host -t A container.samdom.example.org.
container.samdom.example.org has address 192.168.1.2

Na Windowsoch:

C:\Users\Administrator>nslookup -type=SRV _ldap._tcp.dc._msdcs.SAMDOM.example.org.
DNS request timed out.
    timeout was 2 seconds.
Server:  UnKnown
Address:  192.168.1.2

DNS request timed out.
    timeout was 2 seconds.
*** Request to UnKnown timed-out

Ale(!) podľa wireshark-u odpoveď prišla. Viď prílohy.

a jeste bych se pokusil pripjit na kopletni DNS nazev tzn. SAMDOM.example.org

Máš na mysli pri pokuse o pripojenie do domény? Skúšal som. S identickým výsledkom ako predtým (len Details button povie príslušné meno, na ktoré robí lookup).