Төхөөрөмжийг Active Directory-д нэгтгэх — 3-р хэсэг: Алдаа: ERROR_BAD_COMMAND [code 0x00000016]

# /opt/pbis/bin/domainjoin-cli join example.local administrator
Joining to AD Domain:   example.local
With Computer DNS Name: bdvm-c8x64.example.local

administrator@EXAMPLE.LOCAL's password:
Warning: A resumable error occurred while processing the 'hostname' module
ERROR_BAD_COMMAND [code 0x00000016]



Warning: System restart required
Your system has been configured to authenticate to Active Directory for the first time.  It is
recommended that you restart your system to ensure that all applications recognize the new settings.

SUCCESS

# /opt/pbis/bin/domainjoin-cli join example.local administrator
Joining to AD Domain:   example.local
With Computer DNS Name: o7x64tl.example.local

administrator@EXAMPLE.LOCAL's password:
Error: DNS_ERROR_BAD_PACKET [code 0x0000251e]
A bad packet was received from a DNS server. Potentially the requested address does not exist.

Realm: example.local
Domain User: administrator
Domain IP: 11.11.11.11

# realm join example.local -U administrator -v
 * Resolving: _ldap._tcp.example.local
 * Performing LDAP DSE lookup on: 11.11.11.11
 * Successfully discovered: example.local
Password for administrator:
 * Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/bin/net
 * LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.0HT7S1 -U administrator ads join example.local
Enter administrator's password:
Failed to join domain: failed to lookup DC info for domain 'example.local' over rpc: The attempted logon is invalid. This is either due to a bad username or authentication information.
 ! Joining the domain example.local failed
realm: Couldn't join realm: Joining the domain example.local failed

# realm join example.local -U administrator -v
 * Resolving: _ldap._tcp.example.local
 * Performing LDAP DSE lookup on: 11.11.11.11
 * Successfully discovered: example.local
Password for administrator:
 * Couldn't find file: /usr/bin/net
 * Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/bin/net
 * Resolving required packages
 ! Failed to enroll machine in realm: GDBus.Error:org.freedesktop.systemd1.UnitMasked: Unit is masked.
realm: Couldn't join realm: Failed to enroll machine in realm. See diagnostics.

# sudo realm -v discover example.local
sudo: unable to resolve host user-market-2: Connection timed out
 * Resolving: _ldap._tcp.example.local
 * Resolving: example.local
 * No results: example.local
example.local
  type: kerberos
  realm-name: EXAMPLE.LOCAL
  domain-name: example.local
  configured: no

# sudo realm -v discover example.local
sudo: unable to resolve host user-market-2: No such file or directory
 * Resolving: _ldap._tcp.example.local
 * Resolving: example.local
 * No results: example.local
realm: No such realm found: example.local

#  sudo realm -v join example.local
sudo: unable to resolve host user-market-2: Connection timed out
 * Resolving: _ldap._tcp.example.local
 * Performing LDAP DSE lookup on: 11.11.11.11
 * Successfully discovered: example.local
Password for Administrator:
 * Unconditionally checking packages
 * Resolving required packages
 * LANG=C /usr/sbin/adcli join --verbose --domain example.local --domain-realm EXAMPLE.LOCAL --domain-controller 11.11.11.--login-type user --login-user Administrator --stdin-password
 * Using domain name: example.local
 * Calculated computer account name from fqdn: USER-MARKET-2
 * Using domain realm: example.local
 * Sending netlogon pings to domain controller: cldap://11.11.11.11
 * Received NetLogon info from: DC.example.local
 * Wrote out krb5.conf snippet to /var/cache/realmd/adcli-krb5-2lGxqJ/krb5.d/adcli-krb5-conf-ophiP9
 ! Couldn't authenticate as: Administrator@EXAMPLE.LOCAL: Preauthentication failed
adcli: couldn't connect to example.local domain: Couldn't authenticate as: Administrator@EXAMPLE.LOCAL: Preauthentication failed
 ! Failed to join the domain
realm: Couldn't join realm: Failed to join the domain

# sudo realm -v join example.local
 * Resolving: _ldap._tcp.example.local
 * Performing LDAP DSE lookup on: 11.11.11.11
 * Successfully discovered: example.local
 * Unconditionally checking packages
 * Resolving required packages
 * Installing necessary packages: sssd-tools, sssd, libnss-sss, libpam-sss
 ! Failed to enroll machine in realm: The following packages have unmet dependencies:

sssd-tools: Depends: libc6 (>= 2.12) but 2.19-0ubuntu6.15 is to be installed
            Depends: libpopt0 (>= 1.14) but 1.16-8ubuntu1 is to be installed
            Depends: libselinux1 (>= 1.32) but 2.2.2-1ubuntu0.1 is to be installed
            Depends: libsemanage1 (>= 2.0.3) but 2.2-1 is to be installed
            Depends: libtalloc2 (>= 2.0.4~git20101213) but 2.1.5-0ubuntu0.14.04.1 is to be installed
            Depends: sssd-common (= 1.11.5-1ubuntu3) but 1.11.8-0ubuntu0.7 is to be installed

realm: Couldn't join realm: Failed to enroll machine in realm. See diagnostics.

"errors": [
        {
           "description": "failed to generate credentials cache file for keytab file: default",
           "message": "KDC or realm is unreachable or can't resolve address"
        }
     ],

# yum install adcli krb5-workstation sssd
Loaded plugins: fastestmirror, refresh-packagekit, security
Setting up Install Process
Loading mirror speeds from cached hostfile
YumRepo Error: All mirror URLs are not using ftp, http[s] or file.
 Eg. Invalid release/repo/arch combination/
removing mirrorlist with no valid mirrors: /var/cache/yum/x86_64/6/base/mirrorlist.txt
Error: Cannot find a valid baseurl for repo: base

# adcli join example.local
Password for Administrator@EXAMPLE.LOCAL:
adcli: couldn't connect to example.local domain: Couldn't get kerberos ticket for: Administrator@EXAMPLE.LOCAL: Clock skew too great

# sudo realm -v join example.local
 * Resolving: _ldap._tcp.example.local
 * Performing LDAP DSE lookup on: 11.11.11.11
 * Successfully discovered: example.local
 * Unconditionally checking packages
 * Resolving required packages
 * LANG=C /usr/sbin/adcli join --verbose --domain example.local --domain-realm EXAMPLE.LOCAL --domain-controller 11.11.11.11 --login-type computer --no-password
 * Using domain name: example.local
 * Calculated computer account name from fqdn: BDVMU14X86
 * Using domain realm: example.local
 * Sending netlogon pings to domain controller: cldap://11.11.11.11
 * Received NetLogon info from: DC.example.local
 * Wrote out krb5.conf snippet to /var/cache/realmd/adcli-krb5-ffDXAr/krb5.d/adcli-krb5-conf-YCJvaP
 ! Couldn't authenticate as machine account: BDVMU14X86: Client 'BDVMU14X86$@EXAMPLE.LOCAL' not found in Kerberos database
adcli: couldn't connect to example.local domain: Couldn't authenticate as machine account: BDVMU14X86: Client 'BDVMU14X86$@EXAMPLE.LOCAL' not found in Kerberos database
 ! Unable to automatically join the domain
Password for Administrator:
 * Unconditionally checking packages
 * Resolving required packages
 * LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.PF1JS1 -U Administrator ads join example.local
Enter Administrator's password:gss_init_sec_context failed with [ Miscellaneous failure (see text): Clock skew too great]
kinit succeeded but ads_sasl_spnego_gensec_bind(KRB5) failed: An internal error occurred.

Failed to join domain: failed to connect to AD: An internal error occurred.
 ! Joining the domain example.local failed
realm: Couldn't join realm: Joining the domain example.local failed

# realm join example.local -U administrator -v
 * Resolving: _ldap._tcp.example.local
 * Performing LDAP DSE lookup on: 11.11.11.11
 * Successfully discovered: example.local
Password for administrator:
 * Couldn't find file: /usr/bin/net
 * Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/bin/net
 * Resolving required packages
 ! Failed to enroll machine in realm: GDBus.Error:org.freedesktop.systemd1.UnitMasked: Unit is masked.
realm: Couldn't join realm: Failed to enroll machine in realm. See diagnostics.

# systemctl start sssd
Job for sssd.service failed because the control process exited with error code.
See "systemctl  status sssd.service" and "journalctl  -xe" for details.
# systemctl  status sssd.service
● sssd.service - System Security Services Daemon
   Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Wed 2022-09-21 22:08:34 EEST; 5s ago
  Process: 9457 ExecStart=/usr/sbin/sssd -i ${DEBUG_LOGGER} (code=exited, status=4)
 Main PID: 9457 (code=exited, status=4)

Sep 21 22:08:34 slesl15gia systemd[1]: Starting System Security Services Daemon...
Sep 21 22:08:34 slesl15gia sssd[9457]: Cannot read config file /etc/sssd/sssd.conf. Please chec
k that the file is accessible only by the owner and owned by root.root.
Sep 21 22:08:34 slesl15gia systemd[1]: sssd.service: Main process exited, code=exited, status=4
/NOPERMISSION
Sep 21 22:08:34 slesl15gia systemd[1]: Failed to start System Security Services Daemon.
Sep 21 22:08:34 slesl15gia systemd[1]: sssd.service: Unit entered failed state.
Sep 21 22:08:34 slesl15gia systemd[1]: sssd.service: Failed with result 'exit-code'.

# adcli join -D example.local -U administrator
Password for administrator@EXAMPLE.LOCAL:
adcli: joining domain example.local failed: Couldn't lookup computer account: SGIA12$: Can't contact LDAP server

#  authconfig \
  --enablekrb5 \
  --krb5kdc=example.local \
  --krb5adminserver=example.local \
  --krb5realm=EXAMPLE.LOCAL \
  --enablesssd \
  --enablesssdauth \
  --update
authconfig: Authentication module /usr/lib64/security/pam_krb5.so is missing. Authentication process might not work correctly.