Portál AbcLinuxu, 6. května 2025 16:46
FROM ubuntu:latest MAINTAINER rastos RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y samba winbind smbclient dnsutils psmisc EXPOSE 53 88 135 137 138 139 389 445 464 636 1024 3268 3269Z docker image-u vyrobím kontainer:
docker run --name=container --hostname=container --privileged \ --dns 192.168.1.2 --add-host localhost.localdomain:127.0.0.1 -t -i samba:install bashV kontaineri vyrobím Samba AD Server
adminpass=Passw0rd
domain=SAMDOM
realm=SAMDOM.example.org
hostname=container
rm /etc/samba/smb.conf
samba-tool domain provision \
--use-xattrs=no --server-role=dc --adminpass=${adminpass} \
--dns-backend=SAMBA_INTERNAL --domain=${domain} \
--realm=${realm} --use-rfc2307 --host-name=${hostname}
Kontainer má eth0 192.168.1.2.
V /etc/resolv.conf je
domain samdom.example.org nameserver 192.168.1.2V /etc/samba/smb.conf je:
# Global parameters
[global]
workgroup = SAMDOM
realm = SAMDOM.example.org
netbios name = CONTAINER
server role = active directory domain controller
dns forwarder = 192.168.1.2
idmap_ldb:use rfc2307 = yes
xattr_tdb:file = /var/lib/samba/xattr.tdb
[netlogon]
path = /var/lib/samba/sysvol/samdom.example.org/scripts
read only = No
[sysvol]
path = /var/lib/samba/sysvol
read only = No
Sambu spustím takto:
samba -i -d3 -M singleVo VirtualBoxe nabootujem Windows (úplne konkrétne je to trial verzia Win 2008 server). VM má nastavený sieťový adaptér v bridge móde cez docker0. Vo windowsoch nastavím statickú IP adresu 192.168.1.3, a DNS a gateway na 192.168.1.2. Nabootovaný windows vie pingnúť kontainer, ale už kontaktovať DNS server samby nezvládne a tým pádom ani pripojiť sa k AD. (Na to tuším potrebuje nájsť SRV záznam). To vidím na tom, že nslookup hneď po štarte povie:
C:\>nslookup
DNS request timed out.
timeout was 2 seconds.
Default Server: UnKnown
Address: 192.168.1.2
Podľa wireshark-u, pustenom pod tými windowsami, sa ten nslookup opýta na 2.1.168.192.in-addr.arpa a samba odpovie paketom, v ktorom nie je žiadna DNS odpoveď (viď príloha). Samba v tom čase zaloguje hromadu hlášok
Not authoritative for '2.1.168.192.in-addr.arpa', forwarding Not authoritative for '2.1.168.192.in-addr.arpa', forwarding Not authoritative for '2.1.168.192.in-addr.arpa', forwarding Not authoritative for '2.1.168.192.in-addr.arpa', forwarding ...Lookup v kontajneri zafunguje tak napoly:
host container container.samdom.example.org has address 192.168.1.2 host 192.168.1.2 2.1.168.192.in-addr.arpa has no PTR recordČo robím zle? Resp.: ako ďalej?
host -t SRV _ldap._tcp.samdom.example.org. _ldap._tcp.samdom.example.org has SRV record 0 100 389 container.samdom.example.org. host -t SRV _kerberos._udp.samdom.example.org. _kerberos._udp.samdom.example.org has SRV record 0 100 88 container.samdom.example.org. host -t A container.samdom.example.org. container.samdom.example.org has address 192.168.1.2Ale je pravda, že Kerberos samotný tam nemám. Chcel som sa tomu vyhnúť, pretože o ňom prakticky nič neviem. Musím ho mať? b) hovoríš, že v /etc/samba/smb.conf mám namieriť "dns forwarder = ..." na nejaký reálny name server ? To môžem skúsiť, ale má to význam? Nezáleží mi na tom, či v tom kontajneri alebo na tom windowsovom stroji funguje resolvovanie mien mimo tejto mini-siete.
An Active Directory Domain COntroler (AD DC) for domain "SAMDOM" could not be contancted. Ensure that the domain name is typed correctly. If the name is correct, click Details for troubleshooting information.Details povie:
Note: This information is intended for a network administrator. If you are not your network's administrator, notify the administrator that you received this information, which has been recorded in the file C:\Windows\debug\dcdiag.txt. The domain name "SAMDOM" might be a NetBIOS domain name. If this is the case, verify that the domain name is properly registered with WINS. If you are certain that the name is not a NetBIOS domain name, then the following information can help you troubleshoot your DNS configuration. The following error occurred when DNS was queried for the service location (SRV) resource record used to locate an Active Directory Domain Controller (AD DC) for domain "SAMDOM": The error was: "This operation returned because the timeout period expired." (error code 0x000005B4 ERROR_TIMEOUT) The query was for the SRV record for _ldap._tcp.dc._msdcs.SAMDOM The DNS servers used by this computer for name resolution are not responding. This computer is configured to use DNS servers with the following IP addresses: 192.168.1.2 Verify that this computer is connected to the network, that these are the correct DNS server IP addresses, and that at least one of the DNS servers is running.Samba v tom čase zaloguje:
Not authoritative for '_ldap._tcp.dc._msdcs.SAMDOM', forwarding Not authoritative for '_ldap._tcp.dc._msdcs.SAMDOM', forwarding ...Dump paketov je v prílohe, ale nie som si istý, či som chytil to čo som mal, tak som urobil dva pokusy.
host -t SRV _ldap._tcp.dc._msdcs.SAMDOM.example.orga jeste byfh se pokusil pripjit na kopletni DNS nazev tzn. SAMDOM.example.org
# host -t SRV _ldap._tcp.dc._msdcs.samdom.example.org _ldap._tcp.dc._msdcs.samdom.example.org has SRV record 0 100 389 container.samdom.example.org. # host -t A container.samdom.example.org. container.samdom.example.org has address 192.168.1.2Na Windowsoch:
C:\Users\Administrator>nslookup -type=SRV _ldap._tcp.dc._msdcs.SAMDOM.example.org.
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 192.168.1.2
DNS request timed out.
timeout was 2 seconds.
*** Request to UnKnown timed-out
Ale(!) podľa wireshark-u odpoveď prišla. Viď prílohy.
a jeste bych se pokusil pripjit na kopletni DNS nazev tzn. SAMDOM.example.orgMáš na mysli pri pokuse o pripojenie do domény? Skúšal som. S identickým výsledkom ako predtým (len Details button povie príslušné meno, na ktoré robí lookup).
Tiskni
Sdílej:
ISSN 1214-1267, (c) 1999-2007 Stickfish s.r.o.