歡迎您光臨本站 註冊首頁

freeradius+Active Directory時ntlm_auth出現問題

←手機掃碼閱讀     火星人 @ 2014-03-04 , reply:0

freeradius+Active Directory時ntlm_auth出現問題

最近在做freeradius+windows Active Directory ,在實驗過程中遇到了幾個問題,請各位大俠們指點以下
已知環境:系統大環境為fc6,samba安裝採用yum install ,版本為Version 3.0.23c-2. Active Directory 為windows server 2003

standard edition ,ip地址為192.168.0.93, 域名為HIZILIN.COM .已知Active Directory中有帳號xiaoqiang ,密碼:pass#word3

問題情況:在fc6大環境下安裝的samba移植到一個經過裁剪的小系統上,出現了下列錯誤。
ntlm_auth --request-nt-key --domain=HIZILIN.COM --username=xiaoqiang --password=pass#word3
NT_STATUS_NO_LOGON_SERVERS: No logon servers (0xc000005e)
ntlm_auth --request-nt-key --domain=HIZILIN.COM --username=xiaoqiang --password=pass      
NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)
而這種配置在fc6大環境下去可以通過驗證 。我的操作步驟、配置文件及log日誌如下,請各位大俠們幫忙分析一下。
步驟如下:
kinit [email protected]
Password for [email protected]:
/usr/kerberos/bin/klist -5
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: [email protected]

Valid starting     Expires            Service principal
04/17/09 10:52:49  04/17/09 20:52:59  krbtgt/[email protected]
        renew until 04/18/09 10:52:49
net ads join -U Administrator%tao123456789
utils/net_ads.c:ads_startup(281)
  ads_connect: Operations error

net rpc join -U Administrator%tao123456789
Joined domain HIZILIN.


smbclient -L HIZILIN.COM -U xiaoqiang%pass#word3
Domain= OS= Server=

        Sharename       Type      Comment
        ---------       ----      -------
        IPC$            IPC             NETLOGON        Disk      Logon server share
        ADMIN$          Disk            SYSVOL          Disk      Logon server share
        C$              Disk      session request to HIZILIN.COM failed (Called name not present)
session request to HIZILIN failed (Called name not present)
Domain= OS= Server=

        Server               Comment
        ---------            -------
        2K3SERVER            
        CHINA                SSSSSS
        LOCALHOST            Linux Samba

        Workgroup            Master
        ---------            -------
        HIZILIN              2K3SERVER
        MSHOME               GAO
        WORKGROUP            JUJUMAO

wbinfo -t
checking the trust secret via RPC calls succeeded

wbinfo -g
Error looking up domain groups

wbinfo -u
Error looking up domain users

wbinfo -D HIZILIN.COM
Name              : HIZILIN
Alt_Name          : HIZILIN.COM
SID               : S-1-5-21-2458468695-833675311-4109839019
Active Directory  : Yes
Native            : No
Primary           : Yes
Sequence          : -1

wbinfo -a xiaoqiang%pass#word3
plaintext password authentication failed
error code was NT_STATUS_NO_SUCH_USER (0xc0000064)
error messsage was: No such user
Could not authenticate user xiaoqiang%pass#word3 with plaintext password
challenge/response password authentication succeeded

ntlm_auth --request-nt-key --domain=HIZILIN.COM --username=xiaoqiang --password=pass#word3
NT_STATUS_NO_LOGON_SERVERS: No logon servers (0xc000005e)
ntlm_auth --request-nt-key --domain=HIZILIN.COM --username=xiaoqiang --password=pass      
NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)

配置文件如下:
grep -v "^;" /etc/samba/smb.conf |grep -v "^#"|grep -v "^$"

workgroup = HIZILIN
   server string = SSSSSS
   security = ads
username map = /etc/samba/smbusers
cups options = raw
   log file = /var/log/samba/%m.log
   max log size = 50
realm = HIZILIN.COM
   wins server = 192.168.0.93
   dns proxy = no

grep -v "^;" /etc/krb5.conf |grep -v "^#"|grep -v "^$"     

default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

default_realm = HIZILIN.COM
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
forwardable = yes

.hizilin.com = HIZILIN.COM
hizilin.com = HIZILIN.COM

profile = /var/kerberos/krb5kdc/kdc.conf

pam = {
   debug = false
   ticket_lifetime = 36000
   renew_lifetime = 36000
   forwardable = true
   krb4_convert = false
}
   

HIZILIN.COM = {
kdc = HIZILIN.COM:88
}

grep -v "^;" /etc/nsswitch.conf |grep -v "^#"|grep -v "^$"
passwd:     files winbind
shadow:     files winbind
group:      files winbind
hosts:      files dns
bootparams: nisplus files
ethers:     files
netmasks:   files
networks:   files
protocols:  files winbind
rpc:        files
services:   files winbind
netgroup:   files winbind
publickey:  nisplus
automount:  files winbind
aliases:    files nisplus

hostname
china

cat /etc/hosts
127.0.0.1 china
::1 china
192.168.0.93 HIZILIN.COM

cat /etc/resolv.conf
search china
nameserver 192.168.0.93
nameserver 218.56.57.58

samba相關log
cat smbd.log
smbd/server.c:main(847)
  smbd version 3.0.23c-2 started.
  Copyright Andrew Tridgell and the Samba Team 1992-2006
printing/print_cups.c:cups_cache_reload(85)
  Unable to connect to CUPS server localhost - Connection refused
printing/print_cups.c:cups_cache_reload(85)
  Unable to connect to CUPS server localhost - Connection refused
printing/nt_printing.c:nt_printing_init(649)
  nt_printing_init: error checking published printers: WERR_ACCESS_DENIED
printing/print_cups.c:cups_cache_reload(85)
  Unable to connect to CUPS server localhost - Connection refused
printing/print_cups.c:cups_cache_reload(85)
  Unable to connect to CUPS server localhost - Connection refused
printing/print_cups.c:cups_cache_reload(85)
  Unable to connect to CUPS server localhost - Connection refused
printing/print_cups.c:cups_cache_reload(85)
  Unable to connect to CUPS server localhost - Connection refused
printing/print_cups.c:cups_cache_reload(85)
  Unable to connect to CUPS server localhost - Connection refused
printing/print_cups.c:cups_cache_reload(85)
  Unable to connect to CUPS server localhost - Connection refused

cat nmbd.log
nmbd/nmbd.c:main(700)
  Netbios nameserver version 3.0.23c-2 started.
  Copyright Andrew Tridgell and the Samba Team 1992-2006
nmbd/nmbd_become_lmb.c:become_local_master_stage2(396)
  *****
  
  Samba name server CHINA is now a local master browser for workgroup HIZILIN on subnet 192.168.0.82
  
  *****
cat winbindd.log
nsswitch/winbindd.c:main(953)
  winbindd version 3.0.23c-2 started.
  Copyright The Samba Team 2000-2004
nsswitch/winbindd_util.c:winbindd_param_init(787)
  winbindd: idmap uid range missing or invalid
nsswitch/winbindd_util.c:winbindd_param_init(788)
  winbindd: cannot continue, exiting.
nsswitch/winbindd.c:main(986)
  Could not init idmap -- netlogon proxy only
lib/pidfile.c:pidfile_create(93)
  ERROR: winbindd is already running. File /var/run/winbindd.pid exists and process id 6721 is running.
nsswitch/winbindd_ads.c:ads_cached_connection(114)
  ads_connect for domain HIZILIN failed: Operations error

cat log.wb-HIZILIN
nsswitch/winbindd_ads.c:ads_cached_connection(114)
  ads_connect for domain HIZILIN failed: Operations error
nsswitch/winbindd_ads.c:ads_cached_connection(114)
  ads_connect for domain HIZILIN failed: Operations error
nsswitch/winbindd_ads.c:ads_cached_connection(114)
  ads_connect for domain HIZILIN failed: Operations error
nsswitch/winbindd_ads.c:ads_cached_connection(114)
  ads_connect for domain HIZILIN failed: Operations error
nsswitch/winbindd_ads.c:ads_cached_connection(114)
  ads_connect for domain HIZILIN failed: Operations error

請各位大俠們給分析一下,哪裡出錯了。尤其是在兩個ntlm_auth命令中為什麼用--password=pass 就提示NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)
而用--password=pass#word3時就提示NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)呢?
《解決方案》

回復 #1 hiziqin 的帖子

使用freeradius 又使用2003的active Directory ?
還是只使用其中的一個
《解決方案》

兩個組合使用。2003 Active Directory中存放用戶帳號,radius將終端用戶的用戶名和密碼與Active Directory 中帳號比較,進行認證。
《解決方案》

怎麼沒人回復啊!繼續尋求問題的解決方式!

[火星人 ] freeradius+Active Directory時ntlm_auth出現問題已經有1066次圍觀

http://coctec.com/docs/service/show-post-23153.html