A integração do Samba + PowerBroker (aka LikeWise-Open) não funciona

Question

Ubuntu: 12.04 x64
PBIS: kernel Linux 2.4 / 2.6 DEB de 64 bits (do site BeyondTrust)
Samba: 3.6.3 (do repositório do Ubuntu)

Estamos tendo problemas para fazer o samba se integrar ao PowerBroker (também conhecido como PBIS / LikeWise-Open). Nós seguimos estas instruções:

link

O PBIS está funcionando. Os usuários podem acessar o SSH e o TELNET na máquina e fazer o login usando as credenciais do AD. No entanto, não podemos fazer com que o SAMBA seja autenticado no AD. Aqui está a saída do log:

[2013/05/31 09:36:38.385857,  0] rpc_client/cli_pipe_schannel.c:54(get_schannel_session_key_common)
  get_schannel_session_key: could not fetch trust account password for domain 'EXAMPLE'
[2013/05/31 09:36:38.386170,  0] rpc_client/cli_pipe_schannel.c:184(cli_rpc_pipe_open_schannel)
  cli_rpc_pipe_open_schannel: failed to get schannel session key from server DC2.EXAMPLE.COM for domain EXAMPLE.
[2013/05/31 09:36:38.386228,  0] auth/auth_domain.c:193(connect_to_domain_password_server)
  connect_to_domain_password_server: unable to open the domain client session to machine DC2.EXAMPLE.COM. Error was : NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
[2013/05/31 09:36:38.388088,  0] rpc_client/cli_pipe_schannel.c:54(get_schannel_session_key_common)
  get_schannel_session_key: could not fetch trust account password for domain 'EXAMPLE'
[2013/05/31 09:36:38.388378,  0] rpc_client/cli_pipe_schannel.c:184(cli_rpc_pipe_open_schannel)
  cli_rpc_pipe_open_schannel: failed to get schannel session key from server DC2.EXAMPLE.COM for domain EXAMPLE.
[2013/05/31 09:36:38.388435,  0] auth/auth_domain.c:193(connect_to_domain_password_server)
  connect_to_domain_password_server: unable to open the domain client session to machine DC2.EXAMPLE.COM. Error was : NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
[2013/05/31 09:36:38.390201,  0] rpc_client/cli_pipe_schannel.c:54(get_schannel_session_key_common)
  get_schannel_session_key: could not fetch trust account password for domain 'EXAMPLE'
[2013/05/31 09:36:38.390491,  0] rpc_client/cli_pipe_schannel.c:184(cli_rpc_pipe_open_schannel)
  cli_rpc_pipe_open_schannel: failed to get schannel session key from server DC2.EXAMPLE.COM for domain EXAMPLE.
[2013/05/31 09:36:38.390549,  0] auth/auth_domain.c:193(connect_to_domain_password_server)
  connect_to_domain_password_server: unable to open the domain client session to machine DC2.EXAMPLE.COM. Error was : NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
[2013/05/31 09:36:38.390831,  0] auth/auth_domain.c:292(domain_client_validate)

domain_client_validate: servidor de senha do domínio não disponível.

Alguém tem alguma idéia por onde começar?

    

Answer 1

Usando o

net -U <username> ads join

irá quebrar a conexão do PowerBrokers ao AD. Por exemplo, você pode descobrir que suas contas do AD podem mais ser capazes de fazer o SUDO.

A maneira correta de vincular o SAMBA ao AD por meio do PowerBroker é esta:

samba-interop-install --install

    

Answer 2

Encontrei aqui: link

As instruções do Ubuntu: link

estava faltando essa etapa final:

net -U <username> ads join

Depois de ingressar no domínio / ADS, ele funciona bem!